Cherry pick of order CI workflows

.github/workflows/build-push-release.yaml → .github/workflows/_build.yaml

@@ -1,12 +1,6 @@
-name: warden bbuild (push)
+name: build
 on:
-  push:
-    branches: ["main", "release-*"]
-    tags:
-      - '^v?\d+\.\d+\.\d+(?:-.*)?$'
-permissions:
-  id-token: write # This is required for requesting the JWT token
-  contents: read # This is required for actions/checkout
+  workflow_call:
 
 jobs:
   compute-tags:
@@ -16,7 +10,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-      - name: Get the latest tag
+      - if: ${{ github.event_name == 'push' }}
+        name: Get the latest tag
         id: get_tag
         run: |
           {

.github/workflows/gitleaks.yaml → .github/workflows/_gitleaks.yaml

@@ -1,7 +1,6 @@
 name: gitleaks
 on:
-  pull_request:
-    types: [opened, edited, synchronize, reopened, ready_for_review]
+  workflow_call:
 
 env:
   GITLEAKS_VERSION: 8.18.2

.github/workflows/_integration-tests.yaml

@@ -0,0 +1,31 @@
+name: integration tests
+
+on:
+  workflow_call:
+    inputs:
+      directory-version:
+        description: 'The image directory to test'
+        required: true
+        type: string
+      image-version:
+        description: 'The image version to test'
+        required: true
+        type: string
+
+jobs:
+  integration-test:
+    if: ${{ github.event_name == 'push' || github.event.pull_request.draft == false}}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/rebase
+      - uses: ./.github/actions/create-k3d-cluster
+      - uses: ./.github/actions/setup-go
+      - name: run test
+        run: make verify-on-cluster
+        env:
+          IMG_DIRECTORY: ${{inputs.directory-version}}
+          IMG_VERSION: ${{inputs.image-version}}
+      - name: show warden logs
+        if: failure()
+        run: kubectl logs -l app=warden -n kyma-system --prefix=true;

.github/workflows/unit-tests.yaml → .github/workflows/_unit-tests.yaml

@@ -1,10 +1,7 @@
 name: unit tests
 
 on:
-  pull_request:
-    paths-ignore:
-      - '**.md'
-    types: [opened, reopened, synchronize, ready_for_review, converted_to_draft]
+  workflow_call:
 
 jobs:
   unit-tests:

.github/workflows/upgrade-test.yaml → .github/workflows/_upgrade-test.yaml

@@ -1,8 +1,7 @@
 name: upgrade test
 
 on:
-  push:
-    branches: [ "main" ]
+  workflow_call:
 
 jobs:
   upgrade-test:

.github/workflows/pull.yaml

@@ -0,0 +1,27 @@
+name: pull
+
+on:
+  pull_request_target:
+    types: [ opened, edited, synchronize, reopened, ready_for_review ]
+
+permissions:
+  id-token: write # This is required for requesting the JWT token
+  contents: read # This is required for actions/checkout
+
+jobs:
+  unit-tests:
+    uses: ./.github/workflows/_unit-tests.yaml
+
+  gitleaks:
+    uses: ./.github/workflows/_gitleaks.yaml
+
+  builds:
+    needs: [unit-tests, gitleaks]
+    uses: ./.github/workflows/_build.yaml
+
+  integrations:
+    needs: builds
+    uses: ./.github/workflows/_integration-tests.yaml
+    with:
+      directory-version: dev
+      image-version: ${{ github.event.number }}

.github/workflows/push.yaml

@@ -0,0 +1,20 @@
+name: push
+
+on:
+  push:
+    branches: [ "main", "release-*" ]
+
+jobs:
+  builds:
+    uses: ./.github/workflows/_build.yaml
+
+  integrations:
+    needs: builds
+    uses: ./.github/workflows/_integration-tests.yaml
+    with:
+      directory-version: prod
+      image-version: ${{ github.sha }}
+
+  upgrades:
+    needs: builds
+    uses: ./.github/workflows/upgrade-tests.yaml

.github/workflows/release.yaml

@@ -0,0 +1,10 @@
+name: release
+
+on:
+  push:
+    tags:
+      - '^v?\d+\.\d+\.\d+(?:-.*)?$'
+
+jobs:
+  builds:
+    uses: ./.github/workflows/_build.yaml