[Do not merge] read/alter policies while testing for DT-1100 #2707
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Github action to Build Sam artifact, add/promote semantic tagging and then run tests | |
| name: Build, Publish to Sherlock, and Run Integration Tests | |
| on: | |
| pull_request: | |
| paths-ignore: ['**.md'] | |
| push: | |
| branches: | |
| - develop | |
| paths-ignore: ['**.md'] | |
| env: | |
| BEE_CREATE_RUN_NAME: 'bee-create-${{ github.event.repository.name }}-${{ github.run_id }}-${{ github.run_attempt }}' | |
| BEE_DESTROY_RUN_NAME: 'bee-destroy-${{ github.event.repository.name }}-${{ github.run_id }}-${{ github.run_attempt }}' | |
| RAWLS_SWAT_TESTS_RUN_NAME: 'rawls-swat-tests-${{ github.event.repository.name }}-${{ github.run_id }}-${{ github.run_attempt }}' | |
| jobs: | |
| tag: | |
| uses: ./.github/workflows/tag.yml | |
| with: | |
| release-branches: develop | |
| secrets: inherit | |
| extract-branch: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| branch-name: ${{ steps.extract-branch.outputs.branch-name }} | |
| steps: | |
| # we need this because github can't actually provide the branch name reliably | |
| # https://github.com/orgs/community/discussions/5251 | |
| - name: Extract branch | |
| id: extract-branch | |
| run: | | |
| if [[ '${{ github.event_name }}' == 'push' ]]; then | |
| BRANCH_NAME=${{ github.ref_name }} | |
| elif [[ '${{ github.event_name }}' == 'pull_request' ]]; then | |
| BRANCH_NAME=${{ github.head_ref }} | |
| else | |
| echo "Failed to extract branch information" | |
| exit 1 | |
| fi | |
| echo "branch-name=$BRANCH_NAME" >> $GITHUB_OUTPUT | |
| sam-build-tag-publish-job: | |
| runs-on: ubuntu-latest | |
| needs: [ tag, extract-branch ] | |
| permissions: | |
| contents: 'read' | |
| id-token: 'write' | |
| outputs: | |
| custom-version-json: ${{ steps.render-sam-version.outputs.custom-version-json }} | |
| tag: ${{ needs.tag.outputs.tag }} | |
| steps: | |
| - uses: 'actions/checkout@v3' | |
| - name: debug outputs | |
| run: |- | |
| echo "github.ref ${{ github.ref }}" | |
| echo "github.ref_name ${{ github.ref_name }}" | |
| echo "GITHUB_REF_NAME ${GITHUB_REF_NAME}" | |
| echo "github.ref_type ${{ github.ref_type }}" | |
| echo "github.head_ref ${{ github.head_ref }}" | |
| echo "github ${{ github }}" | |
| # Builds Sam elsewhere to protect secrets. Upon success, will tag the commit in git. | |
| - name: dispatch build to terra-github-workflows | |
| uses: broadinstitute/workflow-dispatch@v3 | |
| with: | |
| workflow: sam-build | |
| repo: broadinstitute/terra-github-workflows | |
| ref: refs/heads/main | |
| token: ${{ secrets.BROADBOT_TOKEN}} # github token for access to kick off a job in the private repo | |
| inputs: '{ "repository": "${{ github.event.repository.full_name }}", "ref": "${{ needs.extract-branch.outputs.branch-name }}", "sam-release-tag": "${{ needs.tag.outputs.tag }}" }' | |
| - name: Render Sam version | |
| id: render-sam-version | |
| env: | |
| GITHUB_CONTEXT: ${{ toJSON(github) }} | |
| run: | | |
| echo "$GITHUB_CONTEXT" | |
| echo 'custom-version-json={\"sam\":{\"appVersion\":\"${{ needs.tag.outputs.tag }}\"}}' >> $GITHUB_OUTPUT | |
| prepare-configs: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| log-results: ${{ steps.prepare-outputs.outputs.log-results }} | |
| test-context: ${{ steps.prepare-outputs.outputs.test-context }} | |
| steps: | |
| - id: prepare-outputs | |
| run: |- | |
| echo 'log-results=true' >> $GITHUB_OUTPUT | |
| if ${{ github.ref_name == 'develop' }}; then | |
| echo 'test-context=dev-merge' >> $GITHUB_OUTPUT | |
| else | |
| echo 'test-context=pr-test' >> $GITHUB_OUTPUT | |
| fi | |
| report-to-sherlock: | |
| # Report new Sam version to Broad DevOps | |
| uses: broadinstitute/sherlock/.github/workflows/client-report-app-version.yaml@main | |
| needs: [ sam-build-tag-publish-job ] | |
| with: | |
| new-version: ${{ needs.sam-build-tag-publish-job.outputs.tag }} | |
| chart-name: 'sam' | |
| permissions: | |
| contents: 'read' | |
| id-token: 'write' | |
| set-version-in-dev: | |
| # Put new Sam version in Broad dev environment | |
| uses: broadinstitute/sherlock/.github/workflows/client-set-environment-app-version.yaml@main | |
| needs: [ sam-build-tag-publish-job, report-to-sherlock ] | |
| if: ${{ github.ref_name == 'develop' }} | |
| with: | |
| new-version: ${{ needs.sam-build-tag-publish-job.outputs.tag }} | |
| chart-name: 'sam' | |
| environment-name: 'dev' | |
| secrets: | |
| sync-git-token: ${{ secrets.BROADBOT_TOKEN }} | |
| permissions: | |
| id-token: 'write' | |
| create-bee-workflow: | |
| strategy: | |
| matrix: | |
| terra-env: [ dev ] # what versions of apps do we use to emulate types of environments | |
| runs-on: ubuntu-latest | |
| needs: [sam-build-tag-publish-job] | |
| permissions: | |
| contents: 'read' | |
| id-token: 'write' | |
| steps: | |
| - name: Echo Sam version | |
| run: | | |
| echo '${{ needs.sam-build-tag-publish-job.outputs.custom-version-json }}' | |
| - name: dispatch to terra-github-workflows | |
| uses: broadinstitute/[email protected] | |
| with: | |
| run-name: "${{ env.BEE_CREATE_RUN_NAME }}-${{ matrix.terra-env }}" | |
| workflow: bee-create | |
| repo: broadinstitute/terra-github-workflows | |
| ref: refs/heads/main | |
| token: ${{ secrets.BROADBOT_TOKEN}} # github token for access to kick off a job in the private repo | |
| # manually recalculate b/c env context is broken https://github.com/actions/runner/issues/480 | |
| inputs: '{ | |
| "run-name": "${{ env.BEE_CREATE_RUN_NAME }}-${{ matrix.terra-env }}", | |
| "bee-name": "${{ github.event.repository.name }}-${{ github.run_id }}-${{ matrix.terra-env }}", | |
| "version-template": "${{ matrix.terra-env }}", | |
| "custom-version-json": "${{ needs.sam-build-tag-publish-job.outputs.custom-version-json }}" | |
| }' | |
| sam-smoke-test-job: | |
| strategy: | |
| matrix: | |
| terra-env: [ dev ] # what versions of apps do we use to emulate types of environments | |
| testing-env: [ qa ] # what env resources to use, e.g. SA keys | |
| runs-on: ubuntu-latest | |
| needs: [create-bee-workflow] | |
| permissions: | |
| contents: 'read' | |
| id-token: 'write' | |
| steps: | |
| - name: dispatch to terra-github-workflows | |
| uses: broadinstitute/workflow-dispatch@v3 | |
| with: | |
| workflow: .github/workflows/sam-smoke-tests.yaml | |
| repo: broadinstitute/terra-github-workflows | |
| ref: refs/heads/main | |
| token: ${{ secrets.BROADBOT_TOKEN }} # github token for access to kick off a job in the private repo | |
| # manually recalculate b/c env context is broken https://github.com/actions/runner/issues/480 | |
| # The smoke tests just need an access token for an enabled user on the Sam host that is being tested. | |
| inputs: '{ "sam-hostname": "sam.${{ github.event.repository.name }}-${{ github.run_id }}-${{ matrix.terra-env }}.bee.envs-terra.bio", "ENV": "${{ matrix.testing-env }}", "smoke-test-user-email": "firecloud-${{ matrix.testing-env }}@broad-dsde-${{ matrix.testing-env }}.iam.gserviceaccount.com" }' | |
| sam-swat-test-job: | |
| strategy: | |
| matrix: | |
| terra-env: [ dev ] # what versions of apps do we use to emulate types of environments | |
| testing-env: [ qa ] # what env resources to use, e.g. SA keys | |
| runs-on: ubuntu-latest | |
| needs: [sam-smoke-test-job, prepare-configs, extract-branch] | |
| permissions: | |
| contents: 'read' | |
| id-token: 'write' | |
| steps: | |
| - name: dispatch to terra-github-workflows | |
| uses: broadinstitute/workflow-dispatch@v3 | |
| with: | |
| workflow: .github/workflows/sam-swat-tests.yaml | |
| repo: broadinstitute/terra-github-workflows | |
| ref: refs/heads/main | |
| token: ${{ secrets.BROADBOT_TOKEN}} # github token for access to kick off a job in the private repo | |
| # manually recalculate b/c env context is broken https://github.com/actions/runner/issues/480 | |
| inputs: '{ "bee-name": "${{ github.event.repository.name }}-${{ github.run_id }}-${{ matrix.terra-env }}", "ENV": "${{ matrix.testing-env }}", "log-results": "${{ needs.prepare-configs.outputs.log-results }}", "test-context": "${{ needs.prepare-configs.outputs.test-context }}", "caller_run_id": "${{ github.run_id }}", "ref": "${{ needs.extract-branch.outputs.branch-name }}" }' | |
| rawls-swat-test-job: | |
| strategy: | |
| matrix: | |
| terra-env: [ dev ] # what versions of apps do we use to emulate types of environments | |
| testing-env: [ qa ] # what env resources to use, e.g. SA keys | |
| test-group: [ | |
| { group_name: workspaces, tag: "-n org.broadinstitute.dsde.test.api.BillingsTest -n org.broadinstitute.dsde.test.api.WorkspacesTest" }, | |
| { group_name: workspacesAuthDomains, tag: "-n org.broadinstitute.dsde.test.api.AuthDomainsTest" }, | |
| { group_name: workflows, tag: "-n org.broadinstitute.dsde.test.api.MethodsTest" } | |
| ] # Rawls test groups | |
| runs-on: ubuntu-latest | |
| needs: [sam-smoke-test-job, prepare-configs] | |
| permissions: | |
| contents: 'read' | |
| id-token: 'write' | |
| steps: | |
| - name: dispatch to terra-github-workflows | |
| env: | |
| rawls_base_test_entrypoint: "testOnly -- -l ProdTest -l NotebooksCanaryTest" | |
| test-context: ${{ needs.prepare-configs.outputs.test-context }} | |
| uses: broadinstitute/workflow-dispatch@v4 | |
| with: | |
| run-name: "${{ env.RAWLS_SWAT_TESTS_RUN_NAME }}-${{ matrix.terra-env }}-${{ matrix.testing-env }}-${{ matrix.test-group.group_name }}" | |
| workflow: .github/workflows/rawls-swat-tests.yaml | |
| repo: broadinstitute/terra-github-workflows | |
| ref: refs/heads/main | |
| token: ${{ secrets.BROADBOT_TOKEN }} # github token for access to kick off a job in the private repo | |
| # manually recalculate b/c env context is broken https://github.com/actions/runner/issues/480 | |
| inputs: '{ | |
| "additional-args": "{\"logging\":\"true\",\"java-version\":\"17\",\"billing-project\":\"\"}", | |
| "run-name": "${{ env.RAWLS_SWAT_TESTS_RUN_NAME }}-${{ matrix.terra-env }}-${{ matrix.testing-env }}-${{ matrix.test-group.group_name }}", | |
| "bee-name": "${{ github.event.repository.name }}-${{ github.run_id }}-${{ matrix.terra-env }}", | |
| "ENV": "${{ matrix.testing-env }}", | |
| "test-group-name": "${{ matrix.test-group.group_name }}", | |
| "test-command": "${{ env.rawls_base_test_entrypoint }} ${{ matrix.test-group.tag }}", | |
| "test-context": "${{ env.test-context }}" | |
| }' | |
| orch-swat-test-job: | |
| strategy: | |
| matrix: | |
| terra-env: [ dev ] # what versions of apps do we use to emulate types of environments | |
| testing-env: [ qa ] # what env resources to use, e.g. SA keys | |
| runs-on: ubuntu-latest | |
| needs: [ sam-smoke-test-job, prepare-configs ] | |
| permissions: | |
| contents: 'read' | |
| id-token: 'write' | |
| steps: | |
| - name: dispatch to terra-github-workflows | |
| uses: broadinstitute/workflow-dispatch@v3 | |
| env: | |
| test-context: ${{ needs.prepare-configs.outputs.test-context }} | |
| with: | |
| workflow: .github/workflows/orch-swat-tests.yaml | |
| repo: broadinstitute/terra-github-workflows | |
| ref: refs/heads/main | |
| token: ${{ secrets.BROADBOT_TOKEN}} # github token for access to kick off a job in the private repo | |
| # manually recalculate b/c env context is broken https://github.com/actions/runner/issues/480 | |
| inputs: '{ | |
| "bee-name": "${{ github.event.repository.name }}-${{ github.run_id }}-${{ matrix.terra-env }}", | |
| "ENV": "${{ matrix.testing-env }}", | |
| "test-context": "${{ env.test-context }}" | |
| }' | |
| destroy-bee-workflow: | |
| strategy: | |
| matrix: | |
| terra-env: [ dev ] # what versions of apps do we use to emulate types of environments | |
| runs-on: ubuntu-latest | |
| needs: [sam-swat-test-job, rawls-swat-test-job, orch-swat-test-job] | |
| if: always() # always run to confirm bee is destroyed | |
| permissions: | |
| contents: 'read' | |
| id-token: 'write' | |
| steps: | |
| - name: dispatch to terra-github-workflows | |
| uses: broadinstitute/[email protected] | |
| with: | |
| run-name: "${{ env.BEE_DESTROY_RUN_NAME }}-${{ matrix.terra-env }}" | |
| workflow: bee-destroy | |
| repo: broadinstitute/terra-github-workflows | |
| ref: refs/heads/main | |
| token: ${{ secrets.BROADBOT_TOKEN}} # github token for access to kick off a job in the private repo | |
| # manually recalculate b/c env context is broken https://github.com/actions/runner/issues/480 | |
| inputs: '{ | |
| "run-name": "${{ env.BEE_DESTROY_RUN_NAME }}-${{ matrix.terra-env }}", | |
| "bee-name": "${{ github.event.repository.name }}-${{ github.run_id }}-${{ matrix.terra-env }}" | |
| }' |