name: build_test
on:
  workflow_dispatch:
  push:
    paths-ignore:
      - "**.md"
    branches:
      - main
  pull_request:

permissions:
  contents: read

jobs:
  lint:
    name: "Lint"
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - name: Set up Go 1.22
        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
        with:
          go-version: 1.22

      - name: Check out code into the Go module directory
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      # source: https://github.com/golangci/golangci-lint-action
      - name: golangci-lint
        uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
        with:
          version: v1.59

  helm_build_test:
    name: "[Helm] Build and Test"
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - name: Set up Go 1.22
        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
        with:
          go-version: 1.22

      - name: Check out code into the Go module directory
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Bootstrap e2e
        env:
          KIND_VERSION: 0.23.0
          BATS_VERSION: 1.11.0
        run: |
          mkdir -p $GITHUB_WORKSPACE/bin
          echo "${GITHUB_WORKSPACE}/bin" >> $GITHUB_PATH
          GOBIN="${GITHUB_WORKSPACE}/bin" go install sigs.k8s.io/kind@v${KIND_VERSION}
          curl -sSLO https://github.com/bats-core/bats-core/archive/v${BATS_VERSION}.tar.gz && tar -zxvf v${BATS_VERSION}.tar.gz && bash bats-core-${BATS_VERSION}/install.sh ${GITHUB_WORKSPACE}

      - name: Create a kind cluster and install Gatekeeper
        env:
          GATEKEEPER_VERSION: 3.16.3
          KUBERNETES_VERSION: 1.26.0
        run: |
          kind create cluster --image kindest/node:v${KUBERNETES_VERSION} --name gatekeeper

          helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
          helm install gatekeeper/gatekeeper \
            --version ${GATEKEEPER_VERSION} \
            --set validatingWebhookTimeoutSeconds=15 \
            --set enableExternalData=true \
            --name-template=gatekeeper \
            --namespace security \
            --create-namespace \
            --debug

      - name: Build and install attest-provider
        run: |
          ./scripts/generate-tls-cert.sh
          make docker-buildx kind-load-image
          helm install attest-provider charts/attest-provider \
            --set provider.tls.caBundle="$(cat certs/ca.crt | base64 | tr -d '\n\r')" \
            --set image="docker/attest-provider:dev" \
            --set tufRoot=staging \
            --set tufMetadataSource=https://docker.github.io/tuf-staging/metadata \
            --set tufTargetsSource=https://docker.github.io/tuf-staging/targets \
            --set parameters="mode=strict" \
            --namespace security \
            --wait --debug

      - name: Run e2e
        run: |
          export GATEKEEPER_NAMESPACE=security
          bats -t test/bats/test.bats