model-monitoring-gsq-ci.yml

name: model-monitoring-gsq-ci

on:
  pull_request:
    branches:
      - main 
    paths:
      - assets/model_monitoring/**
      - .github/workflows/model-monitoring-gsq-ci.yml
      

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
env:
  momoComponentsRootPath: assets/model_monitoring/components
  testsRootPath: assets/model_monitoring/components/tests
  pytest_report_folder: results
  pytest_report_file: junit3.xml
  scripts_setup_dir: scripts/setup
permissions:
  # Required to clone repo
  contents: read
  # Required for OIDC login to Azure
  id-token: write

defaults:
  run:
    shell: bash

jobs:
  check-execution-context:
    uses: Azure/azureml-assets/.github/workflows/check-execution-context.yaml@main
  run-momo-tests:
    name: Run GSQ Monitoring Component Tests
    runs-on: ubuntu-latest
    needs: check-execution-context
    environment: Testing
    steps:
      - name: Clone branch
        uses: Azure/azureml-assets/.github/actions/clone-repo@main
        with:
          forked-pr: ${{ needs.check-execution-context.outputs.forked_pr }}
      - name: Use Python 3.8
        uses: actions/setup-python@v4
        with:
          python-version: '3.8'

      - name: Install fusepy
        run: sudo apt-get install -y fuse

      - name: Log in to Azure and create resources
        uses: ./.github/actions/create-azure-resources
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          scripts-setup-dir: ${{ env.scripts_setup_dir }}

      - name: Refresh login (background process)
        run: |
          while true; do
            token_request=$ACTIONS_ID_TOKEN_REQUEST_TOKEN
            token_uri=$ACTIONS_ID_TOKEN_REQUEST_URL
            token=$(curl -H "Authorization: bearer $token_request" "${token_uri}&audience=api://AzureADTokenExchange" | jq .value -r)

            expiration_time=$(jq -R 'split(".") | .[1] | @base64d | fromjson | .exp' <<< $token)
            expiration_time_formatted=$(date -u -d @$expiration_time +"%Y-%m-%dT%H:%M:%SZ")
            current_time=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
            echo "Token expires at: $expiration_time_formatted, Current time: $current_time"

            az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -t ${{ secrets.AZURE_TENANT_ID }} --federated-token $token --output none

            sleep_timer=$((expiration_time - $(date +%s) - 30))
            echo "Sleeping for $sleep_timer seconds"
            sleep $sleep_timer
          done &

      - name: Install dependencies
        run: pip install -r ${{ env.testsRootPath }}/gsq-requirements.txt

      - name: Test asset
        run: python -m pytest --junitxml=${{ env.pytest_report_folder }}/${{ env.pytest_report_file }} ${{ env.momoComponentsRootPath }}/tests/unit/test_gsq_metrics.py ${{ env.momoComponentsRootPath }}/tests/unit/test_gsq_histogram.py ${{ env.momoComponentsRootPath }}/tests/e2e/test_generation_safety_quality_e2e.py -o log_level=DEBUG -m gsq_test
        env:
          SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          RESOURCE_GROUP: ${{ env.resource_group }}
          WORKSPACE_NAME: ${{ env.workspace }}
      - name: Upload test results
        uses: actions/upload-artifact@v3
        if: always()
        with:
          name: ${{ env.pytest_report_folder }}
          path: ${{ env.pytest_report_folder }}
  report:
      name: Publish test results
      if: always()
      runs-on: ubuntu-latest
      needs: run-momo-tests

      permissions:
        # Required for EnricoMi/publish-unit-test-result-action
        checks: write
        issues: read
        pull-requests: write

      steps:
        - name: Download test results
          id: download-artifact
          uses: actions/download-artifact@v3
          with:
            name: ${{ env.pytest_report_folder }}
            path: ${{ env.pytest_report_folder }}
          continue-on-error: true

        - name: Publish test results
          if: steps.download-artifact.outputs.download-path != ''
          uses: EnricoMi/publish-unit-test-result-action@v2
          with:
            check_name: Test Results for ${{ github.workflow }}
            junit_files: ${{ env.pytest_report_folder }}/**/*.xml