Skip to content
Functional Tests (with Cloud Resources)

build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 #8393

Sign in to view logs

build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3

build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 #8393

Workflow file for this run

.github/workflows/functional-test-cloud.yaml at f71a5b6
# ------------------------------------------------------------
# Copyright 2023 The Radius Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ------------------------------------------------------------
# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
---
name: Functional Tests (with Cloud Resources)
on:
# Enable manual trigger
workflow_dispatch:
inputs:
branch:
description: Branch to run the workflow on
required: true
default: main
schedule:
# Run three times a day at 6 AM PDT (1 PM UTC), 12 PM PDT (7 PM UTC), and 6 PM PDT (1 AM UTC next day)
- cron: 0 1,13,19 * * *
# Dispatch on external events
repository_dispatch:
types: [deployment-engine.run-functional-tests]
# Expected client_payload:
# src_image: Source image in ACR (e.g. radiusdeploymentengine.azurecr.io/deployment-engine)
# dest_image: Destination image in GHCR (e.g. ghcr.io/radius-project/deployment-engine)
# tag: Tag for the image (e.g. latest, 0.1, 0.1.0-rc1, pr-123)
# pull_request_target runs in the context of the base branch, providing access to secrets.
# For external contributors, the approval-gate job requires manual approval before tests run.
# SECURITY: We use pull_request_target but do NOT run any code from the PR until after approval.
pull_request_target:
branches:
- main
- features/*
- release/*
permissions: {}
env:
GOPROXY: https://proxy.golang.org
# gotestsum version - see: https://github.com/gotestyourself/gotestsum
GOTESTSUM_VER: 1.13.0
# Helm version
HELM_VER: v3.19.4
# KinD cluster version
KIND_VER: v0.29.0
# Kubectl version
KUBECTL_VER: v1.25.0
# Azure Keyvault CSI driver chart version
AZURE_KEYVAULT_CSI_DRIVER_VER: 1.4.2
# Azure workload identity webhook chart version
AZURE_WORKLOAD_IDENTITY_WEBHOOK_VER: 1.3.0
# Container registry for storing container images
CONTAINER_REGISTRY: ${{ vars.FUNCTIONAL_TEST_CONTAINER_REGISTRY }}
# Container registry for storing Bicep recipe artifacts
BICEP_RECIPE_REGISTRY: ${{ vars.FUNCTIONAL_TEST_BICEP_RECIPE_REGISTRY }}
# The radius functional test timeout
FUNCTIONALTEST_TIMEOUT: 60m
# The Azure Location to store test resources
AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
# The base directory for storing test logs
RADIUS_CONTAINER_LOG_BASE: dist/container_logs
# The Radius helm chart location.
RADIUS_CHART_LOCATION: deploy/Chart/
# The region for AWS resources
AWS_REGION: ${{ vars.AWS_REGION }}
# The current GitHub action link
ACTION_LINK: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
# Server where terraform test modules are deployed
TF_RECIPE_MODULE_SERVER_URL: http://tf-module-server.radius-test-tf-module-server.svc.cluster.local
# The functional test GitHub app id
FUNCTIONAL_TEST_APP_ID: ${{ vars.FUNCTIONAL_TEST_APP_ID }}
# Private Git repository where terraform module for testing is stored.
TF_RECIPE_PRIVATE_GIT_SOURCE: git::https://github.com/radius-project/terraform-private-modules//kubernetes-redis
# bicep-types ACR url for pulling latest Radius Bicep types (AWS)
BICEP_TYPES_REGISTRY: biceptypes.azurecr.io
# bicep-types ACR url for uploading test Radius Bicep types
TEST_BICEP_TYPES_REGISTRY: ${{ vars.TEST_BICEP_TYPES_REGISTRY }}
# Kubernetes client QPS and Burst settings for high-concurrency CI environments
RADIUS_QPS_AND_BURST: "800"
jobs:
# Approval gate for external contributors. This job uses GitHub Environment protection
# to require manual approval before running tests on PRs from non-members.
# - Org members (OWNER, MEMBER, COLLABORATOR): Tests run immediately
# - Dependabot: Tests run immediately
# - External contributors: Requires approval via GitHub UI button
approval-gate:
name: Approval Gate
runs-on: ubuntu-24.04
timeout-minutes: 5
# Only run for external contributors on pull_request_target events.
# Trusted users (dependabot, org members) skip this job entirely.
# External contributors require approval via 'external-contributor-approval' environment.
if: |
github.event_name == 'pull_request_target' &&
github.actor != 'dependabot[bot]' &&
!contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association)
environment: external-contributor-approval
permissions: {}
steps:
- name: Approved
run: echo "Tests approved to run"
setup:
name: Setup
needs: [approval-gate]
# Run for all events. For PRs, approval-gate either succeeds (external contributors approved)
# or is skipped (trusted users like org members and dependabot).
if: |
always() &&
(github.event_name != 'pull_request_target' || needs.approval-gate.result == 'success' || needs.approval-gate.result == 'skipped') &&
(github.event_name != 'schedule' || github.repository == vars.RADIUS_REPOSITORY)
runs-on: ubuntu-24.04
timeout-minutes: 5
permissions:
contents: read # Required for listing the commits
pull-requests: read # Required for fetching PR details
env:
DE_IMAGE: ghcr.io/radius-project/deployment-engine
DE_TAG: latest
outputs:
REL_VERSION: ${{ steps.gen-id.outputs.REL_VERSION }}
UNIQUE_ID: ${{ steps.gen-id.outputs.UNIQUE_ID }}
PR_NUMBER: ${{ steps.gen-id.outputs.PR_NUMBER }}
CHECKOUT_REPO: ${{ steps.gen-id.outputs.CHECKOUT_REPO }}
CHECKOUT_REF: ${{ steps.gen-id.outputs.CHECKOUT_REF }}
RAD_CLI_ARTIFACT_NAME: ${{ steps.gen-id.outputs.RAD_CLI_ARTIFACT_NAME }}
DE_IMAGE: ${{ steps.gen-id.outputs.DE_IMAGE }}
DE_TAG: ${{ steps.gen-id.outputs.DE_TAG }}
BASE_SHA: ${{ steps.gen-id.outputs.BASE_SHA }}
steps:
- name: Log Event Information
run: |
echo "Event Name: ${{ github.event_name }}"
echo "Actor: ${{ github.actor }}"
echo "Author Association: ${{ github.event.pull_request.author_association }}"
- name: Set up checkout target (scheduled)
if: github.event_name == 'schedule'
run: |
echo "CHECKOUT_REPO=${{ github.repository }}" >> $GITHUB_ENV
echo "CHECKOUT_REF=refs/heads/main" >> $GITHUB_ENV
- name: Set up checkout target (repository_dispatch)
if: github.event_name == 'repository_dispatch'
run: |
echo "CHECKOUT_REPO=${{ github.repository }}" >> $GITHUB_ENV
echo "CHECKOUT_REF=refs/heads/main" >> $GITHUB_ENV
- name: Set up checkout target (pull_request_target)
if: github.event_name == 'pull_request_target'
run: |
{
echo "CHECKOUT_REPO=${{ github.event.pull_request.head.repo.full_name }}"
echo "CHECKOUT_REF=${{ github.event.pull_request.head.sha }}"
echo "PR_NUMBER=${{ github.event.pull_request.number }}"
echo "BASE_SHA=${{ github.event.pull_request.base.sha }}"
} >> "${GITHUB_ENV}"
- name: Set up checkout target (workflow_dispatch)
if: github.event_name == 'workflow_dispatch'
run: |
{
echo "CHECKOUT_REPO=${{ github.repository }}"
echo "CHECKOUT_REF=refs/heads/${{ github.event.inputs.branch }}"
} >> "${GITHUB_ENV}"
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Set DE image and tag (repository_dispatch from deployment-engine.run-functional-tests)
if: github.event_name == 'repository_dispatch'
shell: bash
env:
DEST_IMAGE: ${{ github.event.client_payload.dest_image }}
TAG: ${{ github.event.client_payload.tag }}
run: |
{
echo "DE_IMAGE=${DEST_IMAGE}"
echo "DE_TAG=${TAG}"
} >> "$GITHUB_ENV"
- name: Generate ID for release
id: gen-id
run: |
BASE_STR="RADIUS|${GITHUB_SHA}|${GITHUB_SERVER_URL}|${GITHUB_REPOSITORY}|${GITHUB_RUN_ID}|${GITHUB_RUN_ATTEMPT}"
if [ "$GITHUB_EVENT_NAME" == "schedule" ]; then
# Add run number to randomize unique id for scheduled runs.
BASE_STR="${GITHUB_RUN_NUMBER}|${BASE_STR}"
fi
UNIQUE_ID=func$(echo $BASE_STR | sha1sum | head -c 10)
echo "REL_VERSION=pr-${UNIQUE_ID}" >> $GITHUB_ENV
# Set output variables to be used in the other jobs
{
echo "REL_VERSION=pr-${UNIQUE_ID}"
echo "UNIQUE_ID=${UNIQUE_ID}"
echo "CHECKOUT_REPO=${{ env.CHECKOUT_REPO }}"
echo "CHECKOUT_REF=${{ env.CHECKOUT_REF }}"
echo "RAD_CLI_ARTIFACT_NAME=rad_cli_linux_amd64"
echo "PR_NUMBER=${{ env.PR_NUMBER }}"
echo "DE_IMAGE=${{ env.DE_IMAGE }}"
echo "DE_TAG=${{ env.DE_TAG }}"
echo "BASE_SHA=${{ env.BASE_SHA }}"
} >> "${GITHUB_OUTPUT}"
changes:
name: Changes
needs: setup
if: always() && needs.setup.result == 'success'
uses: ./.github/workflows/__changes.yml
with:
ref: ${{ needs.setup.outputs.CHECKOUT_REF }}
repository: ${{ needs.setup.outputs.CHECKOUT_REPO }}
base_sha: ${{ needs.setup.outputs.BASE_SHA }}
permissions:
contents: read
pull-requests: read
build:
name: Build Radius for test
needs: [setup, changes]
# Skip if only docs/markdown changed
if: always() && needs.changes.outputs.only_changed != 'true'
runs-on: ubuntu-24.04
timeout-minutes: 15
permissions:
contents: read # Required for listing the commits
packages: write # Required for uploading the package
pull-requests: write # Required for updating pull requests
id-token: write # Required for azure/login
env:
REL_VERSION: ${{ needs.setup.outputs.REL_VERSION }}
UNIQUE_ID: ${{ needs.setup.outputs.UNIQUE_ID }}
PR_NUMBER: ${{ needs.setup.outputs.PR_NUMBER }}
CHECKOUT_REPO: ${{ needs.setup.outputs.CHECKOUT_REPO }}
CHECKOUT_REF: ${{ needs.setup.outputs.CHECKOUT_REF }}
RAD_CLI_ARTIFACT_NAME: ${{ needs.setup.outputs.RAD_CLI_ARTIFACT_NAME }}
DE_IMAGE: ${{ needs.setup.outputs.DE_IMAGE }}
DE_TAG: ${{ needs.setup.outputs.DE_TAG }}
DAPR_VER: 1.14.4
ACTION_LINK: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
steps:
- name: Get GitHub app token
if: github.repository == vars.RADIUS_REPOSITORY
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
id: get_installation_token
with:
app-id: ${{ env.FUNCTIONAL_TEST_APP_ID }}
private-key: ${{ secrets.FUNCTIONAL_TEST_APP_PRIVATE_KEY }}
permission-pull-requests: write
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: ${{ env.CHECKOUT_REPO }}
ref: ${{ env.CHECKOUT_REF }}
persist-credentials: false
- name: Setup Go
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
with:
go-version-file: go.mod
cache-dependency-path: go.sum
cache: true
- uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
if: env.PR_NUMBER != ''
continue-on-error: true
with:
GITHUB_TOKEN: ${{ steps.get_installation_token.outputs.token }}
header: teststatus
number: ${{ env.PR_NUMBER }}
recreate: true
message: |
## Radius functional test overview
:mag: **[Go to test action run](${{ env.ACTION_LINK }})**
<details>
<summary> Click here to see the test run details</summary>
| Name | Value |
|------|-------|
|**Repository** | ${{ env.CHECKOUT_REPO }} |
|**Commit ref** | ${{ env.CHECKOUT_REF }} |
|**Unique ID** | ${{ env.UNIQUE_ID }} |
|**Image tag** | ${{ env.REL_VERSION }} |
* gotestsum ${{ env.GOTESTSUM_VER }}
* KinD: ${{ env.KIND_VER }}
* Dapr: ${{ env.DAPR_VER }}
* Azure KeyVault CSI driver: ${{ env.AZURE_KEYVAULT_CSI_DRIVER_VER }}
* Azure Workload identity webhook: ${{ env.AZURE_WORKLOAD_IDENTITY_WEBHOOK_VER }}
* Bicep recipe location `${{ env.BICEP_RECIPE_REGISTRY }}/test/testrecipes/test-bicep-recipes/<name>:${{ env.REL_VERSION }}`
* Terraform recipe location `${{ env.TF_RECIPE_MODULE_SERVER_URL }}/<name>.zip` (in cluster)
* applications-rp test image location: `${{ env.CONTAINER_REGISTRY }}/applications-rp:${{ env.REL_VERSION }}`
* dynamic-rp test image location: `${{ env.CONTAINER_REGISTRY }}/dynamic-rp:${{ env.REL_VERSION }}`
* controller test image location: `${{ env.CONTAINER_REGISTRY }}/controller:${{ env.REL_VERSION }}`
* ucp test image location: `${{ env.CONTAINER_REGISTRY }}/ucpd:${{ env.REL_VERSION }}`
* deployment-engine test image location: `${{ env.DE_IMAGE }}:${{ env.DE_TAG }}`
</details>
## Test Status
- name: Login to GitHub Container Registry
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ github.token }}
- uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
if: env.PR_NUMBER != ''
continue-on-error: true
with:
GITHUB_TOKEN: ${{ steps.get_installation_token.outputs.token }}
header: teststatus
number: ${{ env.PR_NUMBER }}
append: true
message: |
:hourglass: Building Radius and pushing container images for functional tests...
- name: Build and Push container images
run: |
make build && make docker-build && make docker-push
env:
DOCKER_REGISTRY: ${{ env.CONTAINER_REGISTRY }}
DOCKER_TAG_VERSION: ${{ env.REL_VERSION }}
- name: Upload CLI binary
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
with:
name: ${{ env.RAD_CLI_ARTIFACT_NAME }}
path: |
./dist/linux_amd64/release/rad
- uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
if: success() && env.PR_NUMBER != ''
continue-on-error: true
with:
GITHUB_TOKEN: ${{ steps.get_installation_token.outputs.token }}
header: teststatus
number: ${{ env.PR_NUMBER }}
append: true
message: |
:white_check_mark: Container images build succeeded
- uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
if: failure() && env.PR_NUMBER != ''
continue-on-error: true
with:
GITHUB_TOKEN: ${{ steps.get_installation_token.outputs.token }}
header: teststatus
number: ${{ env.PR_NUMBER }}
append: true
message: |
:x: Container images build failed
- uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
if: env.PR_NUMBER != ''
continue-on-error: true
with:
GITHUB_TOKEN: ${{ steps.get_installation_token.outputs.token }}
header: teststatus
number: ${{ env.PR_NUMBER }}
append: true
message: |
:hourglass: Publishing Bicep Recipes for functional tests...
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version-file: .node-version
- name: Generate Bicep extensibility types from OpenAPI specs
run: |
make generate-bicep-types VERSION=${{ env.REL_VERSION == 'edge' && 'latest' || env.REL_VERSION }}
- name: Setup and verify bicep CLI
run: |
curl -Lo bicep https://github.com/Azure/bicep/releases/latest/download/bicep-linux-x64
chmod +x ./bicep
sudo mv ./bicep /usr/local/bin/bicep
bicep --version
- name: Login to Azure (for private test bicep-types ACR)
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
with:
client-id: ${{ secrets.AZURE_SP_TESTS_APPID }}
tenant-id: ${{ secrets.AZURE_SP_TESTS_TENANTID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTIONID_TESTS }}
- name: Publish Radius test bicep types
run: |
bicep publish-extension ./hack/bicep-types-radius/generated/index.json --target br:${{ env.TEST_BICEP_TYPES_REGISTRY }}/test/radius:${{ env.REL_VERSION == 'edge' && 'latest' || env.REL_VERSION }} --force
- name: Generate test bicepconfig.json
run: |
if [[ "${{ env.REL_VERSION }}" == "edge" ]]; then
RADIUS_VERSION="latest"
else
RADIUS_VERSION="${{ env.REL_VERSION }}"
fi
cat <<EOF > ./test/bicepconfig.json
{
"experimentalFeaturesEnabled": {
"extensibility": true
},
"extensions": {
"radius": "br:${{ env.TEST_BICEP_TYPES_REGISTRY }}/test/radius:$RADIUS_VERSION",
"aws": "br:${{ env.BICEP_TYPES_REGISTRY }}/aws:latest"
}
}
EOF
- name: Publish Bicep Test Recipes
run: |
mkdir ./bin
cp ./dist/linux_amd64/release/rad ./bin/rad
chmod +x ./bin/rad
export PATH=$GITHUB_WORKSPACE/bin:$PATH
which rad || { echo "cannot find rad"; exit 1; }
rad bicep download
rad version
make publish-test-bicep-recipes
env:
BICEP_RECIPE_REGISTRY: ${{ env.BICEP_RECIPE_REGISTRY }}
BICEP_RECIPE_TAG_VERSION: ${{ env.REL_VERSION }}
- uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
if: success() && env.PR_NUMBER != ''
continue-on-error: true
with:
GITHUB_TOKEN: ${{ steps.get_installation_token.outputs.token }}
header: teststatus
number: ${{ env.PR_NUMBER }}
append: true
message: |
:white_check_mark: Recipe publishing succeeded
- uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
if: failure() && env.PR_NUMBER != ''
continue-on-error: true
with:
GITHUB_TOKEN: ${{ steps.get_installation_token.outputs.token }}
header: teststatus
number: ${{ env.PR_NUMBER }}
append: true
message: |
:x: Test recipe publishing failed
skip-tests:
name: Skip Functional Tests
needs: [setup, changes]
if: always() && needs.changes.outputs.only_changed == 'true'
runs-on: ubuntu-24.04
timeout-minutes: 5
permissions:
contents: read # Required for listing the commits
steps:
- name: Get GitHub app token
if: github.repository == vars.RADIUS_REPOSITORY
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
id: get_installation_token
with:
app-id: ${{ env.FUNCTIONAL_TEST_APP_ID }}
private-key: ${{ secrets.FUNCTIONAL_TEST_APP_PRIVATE_KEY }}
permission-checks: write
- uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
with:
token: ${{ steps.get_installation_token.outputs.token }}
name: Functional Test Run
status: completed
conclusion: success
repo: ${{ github.repository }}
sha: ${{ needs.setup.outputs.CHECKOUT_REF }}
output: |
{"summary":"Skipped functional tests"}
tests:
name: Run ${{ matrix.name }} functional tests
needs: [setup, build]
if: always() && needs.setup.result == 'success' && needs.build.result == 'success'
# Approval gate (via environment protection) ensures external contributors are approved before reaching here
strategy:
fail-fast: true
matrix:
os: [ubuntu-24.04]
name: [corerp-cloud, ucp-cloud]
runs-on: ${{ matrix.os }}
timeout-minutes: 60
permissions:
id-token: write # Required for requesting the JWT
contents: read # Required for listing the commits
checks: write # Required for publishing test results
packages: read # Required for pulling images from ghcr.io inside KinD
env:
UNIQUE_ID: ${{ needs.setup.outputs.UNIQUE_ID }}
REL_VERSION: ${{ needs.setup.outputs.REL_VERSION }}
CHECKOUT_REPO: ${{ needs.setup.outputs.CHECKOUT_REPO }}
CHECKOUT_REF: ${{ needs.setup.outputs.CHECKOUT_REF }}
PR_NUMBER: ${{ needs.setup.outputs.PR_NUMBER }}
AZURE_TEST_RESOURCE_GROUP: radtest-${{ needs.setup.outputs.UNIQUE_ID }}-${{ matrix.name }}
RAD_CLI_ARTIFACT_NAME: ${{ needs.setup.outputs.RAD_CLI_ARTIFACT_NAME }}
BICEP_RECIPE_TAG_VERSION: ${{ needs.setup.outputs.REL_VERSION }}
DE_IMAGE: ${{ needs.setup.outputs.DE_IMAGE }}
DE_TAG: ${{ needs.setup.outputs.DE_TAG }}
steps:
- name: Get GitHub app token
if: github.repository == vars.RADIUS_REPOSITORY
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
id: get_installation_token
with:
app-id: ${{ env.FUNCTIONAL_TEST_APP_ID }}
private-key: ${{ secrets.FUNCTIONAL_TEST_APP_PRIVATE_KEY }}
owner: ${{ github.repository_owner }}
repositories: |
radius
terraform-private-modules
permission-checks: write
permission-pull-requests: write
permission-contents: read
- uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
if: always()
with:
token: ${{ steps.get_installation_token.outputs.token }}
name: Functional Test Run
status: in_progress
repo: ${{ github.repository }}
sha: ${{ env.CHECKOUT_REF }}
details_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
- name: Checkout Radius repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: ${{ env.CHECKOUT_REPO }}
ref: ${{ env.CHECKOUT_REF }}
persist-credentials: false
- name: Checkout Samples repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
if: matrix.name == 'samples'
with:
repository: radius-project/samples
ref: refs/heads/edge
path: samples
persist-credentials: false
- name: Setup Go
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
with:
go-version-file: go.mod
cache-dependency-path: go.sum
cache: true
- name: Download rad CLI
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: ${{ env.RAD_CLI_ARTIFACT_NAME }}
path: ${{ runner.temp }}/rad-cli-artifact
- name: Copy rad CLI to bin
run: |
mkdir -p ./bin
cp "${{ runner.temp }}/rad-cli-artifact/rad" ./bin/rad
chmod +x ./bin/rad
# Verify it is the expected binary
file ./bin/rad | grep -q "ELF" || { echo "Downloaded rad binary is not a valid ELF executable"; exit 1; }
# Verify it is the expected rad CLI binary by running a harmless command
./bin/rad version >/dev/null 2>&1 || { echo "Downloaded rad binary is not a working rad CLI executable"; exit 1; }
- name: Login to Azure
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
with:
client-id: ${{ secrets.AZURE_SP_TESTS_APPID }}
tenant-id: ${{ secrets.AZURE_SP_TESTS_TENANTID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTIONID_TESTS }}
- uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
continue-on-error: true
with:
GITHUB_TOKEN: ${{ steps.get_installation_token.outputs.token }}
header: teststatus
number: ${{ env.PR_NUMBER }}
append: true
message: |
:hourglass: Starting ${{ matrix.name }} functional tests...
- name: Create azure resource group - ${{ env.AZURE_TEST_RESOURCE_GROUP }}
run: |
current_time=$(date +%s)
az group create \
--location ${{ env.AZURE_LOCATION }} \
--name $RESOURCE_GROUP \
--subscription ${{ secrets.AZURE_SUBSCRIPTIONID_TESTS }} \
--tags creationTime=$current_time
while [ $(az group exists --name $RESOURCE_GROUP) = false ]; do sleep 2; done
env:
RESOURCE_GROUP: ${{ env.AZURE_TEST_RESOURCE_GROUP }}
- uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
with:
version: ${{ env.HELM_VER }}
# The role-to-assume is the role that the github action will assume to execute aws commands and
# construct cloud control client in test code.
- name: configure aws credentials using assumed role
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
with:
role-to-assume: ${{ secrets.AWS_GH_ACTIONS_ROLE }}
role-session-name: GitHub_to_AWS_via_FederatedOIDC
aws-region: ${{ env.AWS_REGION }}
# create kind cluster with OIDC provider.
- name: Create KinD cluster
run: |
set -euo pipefail
curl -sSLo "kind" "https://github.com/kubernetes-sigs/kind/releases/download/${{ env.KIND_VER }}/kind-linux-amd64"
chmod +x ./kind
# Parse and validate Azure workload identity values from secret JSON.
OIDC_JSON='${{ secrets.FUNCTEST_AZURE_OIDC_JSON }}'
if ! echo "${OIDC_JSON}" | jq -e . >/dev/null; then
echo "FUNCTEST_AZURE_OIDC_JSON is not valid JSON."
echo "Expected keys: AZURE_OIDC_ISSUER, AZURE_OIDC_ISSUER_PUBLIC_KEY, AZURE_OIDC_ISSUER_PRIVATE_KEY"
exit 1
fi
AZURE_OIDC_ISSUER="$(echo "${OIDC_JSON}" | jq -er '.AZURE_OIDC_ISSUER')"
AZURE_OIDC_ISSUER_PUBLIC_KEY="$(echo "${OIDC_JSON}" | jq -er '.AZURE_OIDC_ISSUER_PUBLIC_KEY')"
AZURE_OIDC_ISSUER_PRIVATE_KEY="$(echo "${OIDC_JSON}" | jq -er '.AZURE_OIDC_ISSUER_PRIVATE_KEY')"
AUTHKEY=$(printf '%s' "${{ github.actor }}:${{ github.token }}" | base64)
echo "{\"auths\":{\"ghcr.io\":{\"auth\":\"${AUTHKEY}\"}}}" > "./ghcr_secret.json"
# Create KinD cluster with OIDC Issuer keys
printf '%s' "${AZURE_OIDC_ISSUER_PUBLIC_KEY}" | base64 -d > sa.pub
printf '%s' "${AZURE_OIDC_ISSUER_PRIVATE_KEY}" | base64 -d > sa.key
openssl pkey -pubin -in sa.pub -noout >/dev/null
openssl pkey -in sa.key -check -noout >/dev/null
cat <<EOF | ./kind create cluster --name radius --config=-
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
extraMounts:
- hostPath: ./sa.pub
containerPath: /etc/kubernetes/pki/sa.pub
- hostPath: ./sa.key
containerPath: /etc/kubernetes/pki/sa.key
- hostPath: ./ghcr_secret.json
containerPath: /var/lib/kubelet/config.json
kubeadmConfigPatches:
- |
kind: ClusterConfiguration
apiServer:
extraArgs:
service-account-issuer: $AZURE_OIDC_ISSUER
service-account-key-file: /etc/kubernetes/pki/sa.pub
service-account-signing-key-file: /etc/kubernetes/pki/sa.key
controllerManager:
extraArgs:
service-account-private-key-file: /etc/kubernetes/pki/sa.key
EOF
- name: Install Azure Keyvault CSI driver chart
run: |
helm repo add csi-secrets-store-provider-azure https://azure.github.io/secrets-store-csi-driver-provider-azure/charts
helm install csi csi-secrets-store-provider-azure/csi-secrets-store-provider-azure --version ${{ env.AZURE_KEYVAULT_CSI_DRIVER_VER }}
- name: Install azure workload identity webhook chart
run: |
helm repo add azure-workload-identity https://azure.github.io/azure-workload-identity/charts
helm install workload-identity-webhook azure-workload-identity/workload-identity-webhook --namespace radius-default --create-namespace --version ${{ env.AZURE_WORKLOAD_IDENTITY_WEBHOOK_VER }} --set azureTenantID=${{ secrets.AZURE_SP_TESTS_TENANTID }}
- name: Login to GitHub Container Registry
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ github.token }}
- name: Download Bicep
run: |
export PATH=$GITHUB_WORKSPACE/bin:$PATH
which rad || { echo "cannot find rad"; exit 1; }
rad bicep download
rad version
- name: Install gotestsum (test reporting tool)
run: |
go install gotest.tools/gotestsum@v${{ env.GOTESTSUM_VER }}
- uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
if: failure() && env.PR_NUMBER != ''
continue-on-error: true
with:
GITHUB_TOKEN: ${{ steps.get_installation_token.outputs.token }}
header: teststatus
number: ${{ env.PR_NUMBER }}
append: true
message: |
:x: Test tool installation for ${{ matrix.name }} failed. Please check [the logs](${{ env.ACTION_LINK }}) for more details
- name: Install Radius
run: |
export PATH=$GITHUB_WORKSPACE/bin:$PATH
which rad || { echo "cannot find rad"; exit 1; }
echo "*** Installing Radius to Kubernetes ***"
rad install kubernetes \
--chart ${{ env.RADIUS_CHART_LOCATION }} \
--set rp.image=${{ env.CONTAINER_REGISTRY }}/applications-rp,rp.tag=${{ env.REL_VERSION }} \
--set dynamicrp.image=${{ env.CONTAINER_REGISTRY }}/dynamic-rp,dynamicrp.tag=${{ env.REL_VERSION }} \
--set controller.image=${{ env.CONTAINER_REGISTRY }}/controller,controller.tag=${{ env.REL_VERSION }} \
--set ucp.image=${{ env.CONTAINER_REGISTRY }}/ucpd,ucp.tag=${{ env.REL_VERSION }} \
--set de.image=${{ env.DE_IMAGE }},de.tag=${{ env.DE_TAG }} \
--set bicep.image=${{ env.CONTAINER_REGISTRY }}/bicep,bicep.tag=${{ env.REL_VERSION }} \
--set global.azureWorkloadIdentity.enabled=true \
--set global.aws.irsa.enabled=true
echo "*** Verify manifests are registered ***"
rm -f registermanifest_logs.txt
# Find the pod with container "ucp"
POD_NAME=$(
kubectl get pods -n radius-system \
-o jsonpath='{range .items[*]}{.metadata.name}{" "}{.spec.containers[*].name}{"\n"}{end}' \
| grep "ucp" \
| head -n1 \
| cut -d" " -f1
)
echo "Found ucp pod: $POD_NAME"
if [ -z "$POD_NAME" ]; then
echo "No pod with container 'ucp' found in namespace radius-system."
exit 1
fi
# Poll logs for up to iterations, 30 seconds each (upto 3 minutes total)
for i in {1..6}; do
kubectl logs "$POD_NAME" -n radius-system | tee registermanifest_logs.txt > /dev/null
# Exit on error
if grep -qi "Service initializer terminated with error" registermanifest_logs.txt; then
echo "Error found in ucp logs:"
grep -i "Service initializer terminated with error" registermanifest_logs.txt
exit 1
fi
# Check for success
if grep -q "Successfully registered manifests" registermanifest_logs.txt; then
echo "Successfully registered manifests - message found."
break
fi
echo "Logs not ready, waiting 30 seconds..."
sleep 30
done
# Final check to ensure success message was found
if ! grep -q "Successfully registered manifests" registermanifest_logs.txt; then
echo "Manifests not registered after 3 minutes."
exit 1
fi
echo "*** Create workspace, group and environment for test ***"
rad workspace create kubernetes
rad group create kind-radius
rad group switch kind-radius
# The functional test is designed to use default namespace. So you must create the environment for default namespace.
rad env create kind-radius --namespace default
rad env switch kind-radius
echo "*** Configuring Azure provider ***"
rad env update kind-radius --azure-subscription-id ${{ secrets.AZURE_SUBSCRIPTIONID_TESTS }} \
--azure-resource-group ${{ env.AZURE_TEST_RESOURCE_GROUP }}
rad credential register azure wi \
--client-id ${{ secrets.AZURE_SP_TESTS_APPID }} \
--tenant-id ${{ secrets.AZURE_SP_TESTS_TENANTID }}
echo "*** Configuring AWS provider ***"
rad env update kind-radius --aws-region ${{ env.AWS_REGION }} --aws-account-id ${{ secrets.FUNCTEST_AWS_ACCOUNT_ID }}
rad credential register aws irsa \
--iam-role ${{ secrets.FUNC_TEST_RAD_IRSA_ROLE }}
- uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
if: failure() && env.PR_NUMBER != ''
continue-on-error: true
with:
GITHUB_TOKEN: ${{ steps.get_installation_token.outputs.token }}
header: teststatus
number: ${{ env.PR_NUMBER }}
append: true
message: |
:x: Failed to install Radius for ${{ matrix.name }} functional test. Please check [the logs](${{ env.ACTION_LINK }}) for more details
- name: Publish Terraform test recipes
run: |
make publish-test-terraform-recipes
- name: Generate test bicepconfig.json
run: |
if [[ "${{ env.REL_VERSION }}" == "edge" ]]; then
RADIUS_VERSION="latest"
else
RADIUS_VERSION="${{ env.REL_VERSION }}"
fi
cat <<EOF > ./test/bicepconfig.json
{
"experimentalFeaturesEnabled": {
"extensibility": true
},
"extensions": {
"radius": "br:${{ env.TEST_BICEP_TYPES_REGISTRY }}/test/radius:$RADIUS_VERSION",
"aws": "br:${{ env.BICEP_TYPES_REGISTRY }}/aws:latest"
},
"cloud": {
"credentialPrecedence": ["AzureCLI", "Environment"]
}
}
EOF
- name: Restore Bicep artifacts before running functional tests
# The exact files chosen to run the command can be changed, but we need 1 that uses the Radius extension and 1 that uses the AWS extension so we can restore both Bicep artifacts before the tests start
run: |
# Restore Radius Bicep types
bicep restore ./test/functional-portable/corerp/cloud/resources/testdata/corerp-azure-connection-database-service.bicep --force
# Restore AWS Bicep types
bicep restore ./test/functional-portable/corerp/cloud/resources/testdata/aws-logs-loggroup.bicep --force
- name: Run functional tests
run: |
set -euo pipefail
# Ensure rad cli is in path before running tests.
export PATH=$GITHUB_WORKSPACE/bin:$PATH
# Make directory to capture functional test results
mkdir -p ./dist/functional_test
cd $GITHUB_WORKSPACE
which rad || { echo "cannot find rad"; exit 1; }
# Populate the following test environment variables from JSON secret.
# AZURE_COSMOS_MONGODB_ACCOUNT_ID
# AZURE_MSSQL_RESOURCE_ID
# AZURE_MSSQL_USERNAME
# AZURE_MSSQL_PASSWORD
PREPROVISIONED_JSON='${{ secrets.FUNCTEST_PREPROVISIONED_RESOURCE_JSON }}'
if ! echo "${PREPROVISIONED_JSON}" | jq -e . >/dev/null; then
echo "FUNCTEST_PREPROVISIONED_RESOURCE_JSON is not valid JSON."
echo "Expected keys: AZURE_COSMOS_MONGODB_ACCOUNT_ID, AZURE_MSSQL_RESOURCE_ID, AZURE_MSSQL_USERNAME, AZURE_MSSQL_PASSWORD"
exit 1
fi
export AZURE_COSMOS_MONGODB_ACCOUNT_ID="$(echo "${PREPROVISIONED_JSON}" | jq -er '.AZURE_COSMOS_MONGODB_ACCOUNT_ID')"
export AZURE_MSSQL_RESOURCE_ID="$(echo "${PREPROVISIONED_JSON}" | jq -er '.AZURE_MSSQL_RESOURCE_ID')"
export AZURE_MSSQL_USERNAME="$(echo "${PREPROVISIONED_JSON}" | jq -er '.AZURE_MSSQL_USERNAME')"
export AZURE_MSSQL_PASSWORD="$(echo "${PREPROVISIONED_JSON}" | jq -er '.AZURE_MSSQL_PASSWORD')"
make test-functional-${{ matrix.name }}
env:
DOCKER_REGISTRY: ${{ env.CONTAINER_REGISTRY }}
TEST_TIMEOUT: ${{ env.FUNCTIONALTEST_TIMEOUT }}
RADIUS_CONTAINER_LOG_PATH: ${{ github.workspace }}/${{ env.RADIUS_CONTAINER_LOG_BASE }}
AWS_REGION: ${{ env.AWS_REGION }}
AWS_ACCOUNT_ID: ${{ secrets.FUNCTEST_AWS_ACCOUNT_ID }}
RADIUS_SAMPLES_REPO_ROOT: ${{ github.workspace }}/samples
# Test_MongoDB_Recipe_Parameters is using the following environment variable.
INTEGRATION_TEST_RESOURCE_GROUP_NAME: ${{ env.AZURE_TEST_RESOURCE_GROUP }}
# Enable Azure resource location verification in tests
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTIONID_TESTS }}
BICEP_RECIPE_REGISTRY: ${{ env.BICEP_RECIPE_REGISTRY }}
BICEP_RECIPE_TAG_VERSION: ${{ env.BICEP_RECIPE_TAG_VERSION }}
GH_TOKEN: ${{ steps.get_installation_token.outputs.token }}
GOTESTSUM_OPTS: --junitfile ./dist/functional_test/results.xml
- name: Process Functional Test Results
uses: ./.github/actions/process-test-results
# In case of failure, upload functional_test_results to artifacts so that they are not erased by subsequent runs.
if: failure() && github.repository == vars.RADIUS_REPOSITORY
with:
test_group_name: Functional Tests - ${{ matrix.name }}
artifact_name: functional_test_results_${{ matrix.name }}
result_directory: dist/functional_test/
- name: Collect Pod details
if: always()
run: |
POD_STATE_LOG_FILENAME='${{ env.RADIUS_CONTAINER_LOG_BASE }}/${{ matrix.name }}-tests-pod-states.log'
mkdir -p $(dirname $POD_STATE_LOG_FILENAME)
{
echo "kubectl get pods -A"
kubectl get pods -A
echo "kubectl describe pods -A"
kubectl describe pods -A
} >> "${POD_STATE_LOG_FILENAME}"
- name: Upload container logs
if: always()
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
with:
name: ${{ matrix.name }}_container_logs
path: ./${{ env.RADIUS_CONTAINER_LOG_BASE }}
- name: Get Terraform recipe publishing logs
if: always()
run: |
# Create pod-logs directory
mkdir -p recipes/pod-logs
# Get pod logs and save to file
namespace="radius-test-tf-module-server"
label="app.kubernetes.io/name=tf-module-server"
pod_names=($(kubectl get pods -l $label -n $namespace -o jsonpath='{.items[*].metadata.name}'))
for pod_name in "${pod_names[@]}"; do
kubectl logs $pod_name -n $namespace > recipes/pod-logs/${pod_name}.txt
done
echo "Pod logs saved to recipes/pod-logs/"
# Get kubernetes events and save to file
kubectl get events -n $namespace > recipes/pod-logs/events.txt
- name: Upload Terraform recipe publishing logs
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
if: always()
with:
name: ${{ matrix.name }}_recipes-pod-logs
path: recipes/pod-logs
if-no-files-found: error
- uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
if: success() && env.PR_NUMBER != ''
continue-on-error: true
with:
GITHUB_TOKEN: ${{ steps.get_installation_token.outputs.token }}
header: teststatus
number: ${{ env.PR_NUMBER }}
append: true
message: |
:white_check_mark: ${{ matrix.name }} functional tests succeeded
- uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
if: failure() && env.PR_NUMBER != ''
continue-on-error: true
with:
GITHUB_TOKEN: ${{ steps.get_installation_token.outputs.token }}
header: teststatus
number: ${{ env.PR_NUMBER }}
append: true
message: |
:x: ${{ matrix.name }} functional test failed. Please check [the logs](${{ env.ACTION_LINK }}) for more details
- uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
if: cancelled() && env.PR_NUMBER != ''
continue-on-error: true
with:
GITHUB_TOKEN: ${{ steps.get_installation_token.outputs.token }}
header: teststatus
number: ${{ env.PR_NUMBER }}
append: true
message: |
:x: ${{ matrix.name }} functional test cancelled. Please check [the logs](${{ env.ACTION_LINK }}) for more details
- name: Delete azure resource group - ${{ env.AZURE_TEST_RESOURCE_GROUP }}
if: always()
run: |
# if deletion fails, purge workflow will purge the resource group and its resources later.
az group delete \
--subscription ${{ secrets.AZURE_SUBSCRIPTIONID_TESTS }} \
--name ${{ env.AZURE_TEST_RESOURCE_GROUP }} \
--yes --verbose
report-test-results:
# Report final test status. Runs after all tests complete (or are skipped).
if: always() && github.repository == vars.RADIUS_REPOSITORY
name: Report test results
needs: [setup, build, tests]
runs-on: ubuntu-24.04
timeout-minutes: 5
permissions:
contents: read
checks: read
env:
CHECKOUT_REF: ${{ needs.setup.outputs.CHECKOUT_REF }}
steps:
- name: Get GitHub app token
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
id: get_installation_token
with:
app-id: ${{ env.FUNCTIONAL_TEST_APP_ID }}
private-key: ${{ secrets.FUNCTIONAL_TEST_APP_PRIVATE_KEY }}
permission-checks: write
- name: Get tests job status
id: get_test_status
run: |
# from: https://github.com/orgs/community/discussions/26526#discussioncomment-3252209
ALL_JOBS_STATUS=$(curl -X GET -s -u "admin:${{ steps.get_installation_token.outputs.token }}" https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/jobs | jq ".jobs[] | {job_status: .conclusion}")
echo "All jobs status: $ALL_JOBS_STATUS"
TEST_STATUS="success"
for job_status in $(echo "$ALL_JOBS_STATUS" | jq -r '.[]'); do
echo "Job Status: $job_status"
if [[ "$job_status" == "failure" ]]; then
echo "Found failed test. Setting test status to failure"
TEST_STATUS="failure"
break
elif [[ "$job_status" == "cancelled" ]]; then
echo "Found cancelled test. Setting test status to cancelled"
TEST_STATUS="cancelled"
fi
done
echo "Test Status: $TEST_STATUS"
echo "test_status=$TEST_STATUS" >> $GITHUB_OUTPUT
- uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
if: always()
with:
token: ${{ steps.get_installation_token.outputs.token }}
name: Functional Test Run
repo: ${{ github.repository }}
sha: ${{ env.CHECKOUT_REF }}
status: completed
conclusion: ${{ steps.get_test_status.outputs.test_status }}
output: |
{"summary":"Functional Test run completed. See links for more information.","title":"Functional Test Run"}
details_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
report-failure:
name: Report test failure
needs: [build, tests]
runs-on: ubuntu-24.04
timeout-minutes: 5
if: failure() && github.event_name == 'schedule' && github.repository == vars.RADIUS_REPOSITORY
steps:
- name: Create failure issue for failing scheduled run
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
github-token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
script: |
github.rest.issues.create({
...context.repo,
title: `Scheduled functional test failed - Run ID: ${context.runId}`,
labels: ['test-failure'],
body: `## Bug information \n\nThis issue is automatically generated if the scheduled functional test fails. The Radius functional test operates on a schedule of every 4 hours during weekdays and every 12 hours over the weekend. It's important to understand that the test may fail due to workflow infrastructure issues, like network problems, rather than the flakiness of the test itself. For the further investigation, please visit [here](${process.env.ACTION_LINK}).`
})