test.yaml

name: Tests
on:
  pull_request:
    branches: [ "master", "release/**", "core-snap-security-release/**", "security-release/**" ]
  push:
    branches: [ "release/**", "core-snap-security-release/**", "security-release/**" ]

concurrency:
  group: ${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  go-channels:
    runs-on: ubuntu-latest
    outputs:
      go-channels: ${{ steps.resolve-go-channels.outputs.go-channels }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Resolve Go snap channels
        id: resolve-go-channels
        uses: ./.github/actions/resolve-go-channels
        with:
          include-snapd-build-go-channel: true
          include-snapd-build-fips-go-channel: true
          include-latest-go-channel: true
 
  snap-builds:
    uses: ./.github/workflows/snap-builds.yaml
    with:
      runs-on: ${{ matrix.runs-on }}
      toolchain: ${{ matrix.toolchain }}
      variant: ${{ matrix.variant }}
    strategy:
      matrix:
        runs-on:
          - '["ubuntu-22.04"]'
          - '["ubuntu-22.04-arm"]'
        toolchain:
          - default
          - FIPS
        variant:
          # test version is a build of snapd with test keys and should
          # only be installed by test runners. The pristine versions
          # are the build that should be installed by human users.
          - pristine
          - test
        # Exclude building everything for ARM but the version for testing
        # to keep the number of builds down as we currently don't have a
        # clear need for these excluded builds.
        exclude:
          - runs-on: '["ubuntu-22.04-arm"]'
            toolchain: FIPS
          - runs-on: '["ubuntu-22.04-arm"]'
            variant: pristine

  cache-build-deps:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Download Debian dependencies
      run: |
          sudo apt clean
          sudo apt update
          sudo apt build-dep -d -y ${{ github.workspace }}
          # for indent
          sudo apt install texinfo autopoint

    - name: Copy dependencies
      run: |
        sudo tar cvf cached-apt.tar /var/cache/apt

    - name: upload Debian dependencies
      uses: actions/upload-artifact@v4
      with:
        name: debian-dependencies
        path: ./cached-apt.tar

  static-checks:
    uses: ./.github/workflows/static-checks.yaml
    needs:
      - go-channels
      - cache-build-deps
    with:
      runs-on: ubuntu-latest
      gochannel: ${{ matrix.gochannel }}

    strategy:
      # we cache successful runs so it's fine to keep going
      fail-fast: false      
      matrix:
        gochannel: ${{ fromJson(needs.go-channels.outputs.go-channels) }}

  branch-static-checks:
    runs-on: ubuntu-latest
    needs: [cache-build-deps]
    if: github.ref != 'refs/heads/master'
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        # needed for git commit history
        fetch-depth: 0

    - name: check-branch-ubuntu-daily-spread
      run: |
        # Compare the daily system in master and in the current branch
        get_daily_system() {
          json1=$1
          json2=$2
          jq -s '{ include: [ .[0].include, .[1].include ] | add }' "$json1" "$json2" | \
            jq '.include.[] | select(.group == "ubuntu-daily") | .systems'
        }

        wget -q -O master_fundsys.json https://raw.githubusercontent.com/snapcore/snapd/master/.github/workflows/fundamental-systems.json
        wget -q -O master_nonfundsys.json https://raw.githubusercontent.com/snapcore/snapd/master/.github/workflows/non-fundamental-systems.json
        
        master_daily="$(get_daily_system master_fundsys.json master_nonfundsys.json)"
        branch_daily="$(get_daily_system .github/workflows/fundamental-systems.json .github/workflows/non-fundamental-systems.json)"
        test "$master_daily" == "$branch_daily"
      shell: bash

  # The required-static-checks job was introduced to maintain a consistent
  # status check name, regardless of changes to the Go channel used for static
  # checks. This avoids the need to update required status checks whenever the
  # Go channel changes.
  required-static-checks:
    runs-on: ubuntu-latest
    needs:
      - static-checks
      - branch-static-checks
    if: always()
    steps:
      - name: Filter out branch-static-checks from needs
        run: |
          # The branch-static-checks job is skipped when testing on the master
          # branch. The combine-results action treats skipped jobs as failed
          # because a failure earlier in the chain (e.g., in cache-build-deps)
          # would also cause branch-static-checks to be skipped, which
          # constitutes a legitimate failure. To handle this, when
          # branch-static-checks is skipped during testing on the master branch
          # we remove it from the list of dependencies whose results are checked.
          if [[ "${GITHUB_REF}" == "refs/heads/master" ]]; then
            filtered_needs=$(echo '${{ toJSON(needs) }}' | jq 'del(.["branch-static-checks"])')
            echo "NEEDS_FILTERED=$(echo $filtered_needs | jq -c)" >> $GITHUB_ENV
          else
            echo "NEEDS_FILTERED=$(echo '${{ toJSON(needs) }}' | jq -c)" >> $GITHUB_ENV
          fi
        shell: bash

      - name: Checkout code
        uses: actions/checkout@v4

      - name: Confirm required static checks passed
        uses: ./.github/actions/combine-results
        with:
          needs-json: ${{ env.NEEDS_FILTERED }}

  unit-tests:
    uses: ./.github/workflows/unit-tests.yaml
    needs:
      - go-channels
      - static-checks 
    name: "unit-tests (Go default ${{ matrix.gochannel }})"
    with:
      runs-on: ubuntu-latest
      gochannel: ${{ matrix.gochannel }}
      skip-coverage: ${{ matrix.gochannel == 'latest/stable' }}
      code: 'go'
    strategy:
      # we cache successful runs so it's fine to keep going
      fail-fast: false      
      matrix:
        gochannel: ${{ fromJson(needs.go-channels.outputs.go-channels) }}

  unit-tests-c:
    uses: ./.github/workflows/unit-tests.yaml
    needs:
      - cache-build-deps
    name: "unit-tests (C ${{ matrix.test-case.c-compiler }})"
    with:
      runs-on: ubuntu-latest
      code: 'c'
      c-compiler: ${{ matrix.test-case.c-compiler }}
    strategy:
      # we cache successful runs so it's fine to keep going
      fail-fast: false
      matrix:
        test-case:
          - { c-compiler: gcc }
          - { c-compiler: clang }

  unit-tests-special:
    uses: ./.github/workflows/unit-tests.yaml
    needs:
      - go-channels
      - static-checks
    name: "unit-tests (Go ${{ matrix.gochannel }} ${{ matrix.test-case.go-build-tags }}
          ${{ matrix.test-case.go-test-race && ' test-race' || ''}}
          ${{ matrix.test-case.snapd-debug && ' snapd-debug' || ''}})"
    with:
      runs-on: ubuntu-latest
      gochannel: ${{ matrix.gochannel }}
      skip-coverage: ${{ matrix.gochannel == 'latest/stable' || matrix.test-case.skip-coverage }}
      go-build-tags: ${{ matrix.test-case.go-build-tags }}
      go-test-race: ${{ matrix.test-case.go-test-race }}
      snapd-debug: ${{ matrix.test-case.snapd-debug }}
      code: 'go'
    strategy:
      # we cache successful runs so it's fine to keep going
      fail-fast: false
      matrix:
        gochannel: ${{ fromJson(needs.go-channels.outputs.go-channels) }}
        test-case:
          - { go-build-tags: snapd_debug,           skip-coverage: false, snapd-debug: true,  go-test-race: false}
          - { go-build-tags: withbootassetstesting, skip-coverage: false, snapd-debug: false, go-test-race: false}
          - { go-build-tags: nosecboot,             skip-coverage: false, snapd-debug: false, go-test-race: false}
          - { go-build-tags: faultinject,           skip-coverage: false, snapd-debug: false, go-test-race: false}
          - { go-build-tags: statelocktrace,        skip-coverage: true,  snapd-debug: false, go-test-race: false}
          - { go-build-tags: snapdusergo,           skip-coverage: false, snapd-debug: false, go-test-race: false}
          - { go-build-tags: "",                    skip-coverage: true,  snapd-debug: false, go-test-race: true }

  unit-tests-cross-distro:
    uses: ./.github/workflows/unit-tests-cross-distro.yaml
    needs: [static-checks]
    with:
      runs-on: ubuntu-latest
      distro: ${{ matrix.distro }}

    strategy:
      fail-fast: false
      matrix:
        distro:
          # TODO add arch?
          - fedora:latest
          - opensuse/tumbleweed
  
  # The required-unit-tests job was introduced to maintain a consistent
  # status check name, regardless of changes to the Go channel used for unit
  # tests. This avoids the need to update required status checks whenever the
  # Go channel changes.
  required-unit-tests:
    runs-on: ubuntu-latest
    needs:
      - unit-tests
      - unit-tests-special
      - unit-tests-c
      - unit-tests-cross-distro
    if: always()
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Confirm required unit tests passed
        uses: ./.github/actions/combine-results
        with:
          needs-json: ${{ toJSON(needs) }}

  code-coverage:
    needs: [unit-tests, unit-tests-special, unit-tests-c]
    runs-on: ubuntu-20.04
    env:
      GOPATH: ${{ github.workspace }}
      # Set PATH to ignore the load of magic binaries from /usr/local/bin And
      # to use the go snap automatically. Note that we install go from the
      # snap in a step below. Without this we get the GitHub-controlled latest
      # version of go.
      PATH: /snap/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:${{ github.workspace }}/bin
      GOROOT: ""
    steps:
    - name: Download the coverage files
      uses: actions/download-artifact@v4
      with:
        pattern: coverage-files-*
        path: .coverage/
        merge-multiple: true

    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@v4
      # uploading to codecov occasionally fails, so continue running the test
      # workflow regardless of the upload
      continue-on-error: true
      with:
        fail_ci_if_error: true
        flags: unittests
        name: codecov-umbrella
        files: .coverage/coverage-*.cov
        verbose: true

  read-systems:
    runs-on: ubuntu-latest
    outputs:
      fundamental-systems: ${{ steps.read-systems.outputs.fundamental-systems }}
      non-fundamental-systems: ${{ steps.read-systems.outputs.non-fundamental-systems }}
      nested-systems: ${{ steps.read-systems.outputs.nested-systems }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Read matrix file
        id: read-systems
        shell: bash
        run: |
          echo "fundamental-systems=$(jq -c . ./.github/workflows/fundamental-systems.json)" >> $GITHUB_OUTPUT
          echo "non-fundamental-systems=$(jq -c . ./.github/workflows/non-fundamental-systems.json)" >> $GITHUB_OUTPUT
          echo "nested-systems=$(jq -c . ./.github/workflows/nested-systems.json)" >> $GITHUB_OUTPUT

  spread-fundamental:
    uses: ./.github/workflows/spread-tests.yaml
    needs: [unit-tests, unit-tests-c, snap-builds, read-systems]
    name: "spread ${{ matrix.group }}"
    with:
      # Github doesn't support passing sequences as parameters.
      # Instead here we create a json array and pass it as a string.
      # Then in the spread workflow it turns it into a sequence 
      # using the fromJSON expression.
      runs-on: '["self-hosted", "spread-enabled"]'
      group: ${{ matrix.group }}
      backend: ${{ matrix.backend }}
      systems: ${{ matrix.systems }}
      tasks: ${{ matrix.tasks }}
      rules: ${{ matrix.rules }}
      is-fundamental: true
    strategy:
      # FIXME: enable fail-fast mode once spread can cancel an executing job.
      # Disable fail-fast mode as it doesn't function with spread. It seems
      # that cancelling tasks requires short, interruptible actions and
      # interrupting spread, notably, does not work today. As such disable
      # fail-fast while we tackle that problem upstream.
      fail-fast: false
      matrix: ${{ fromJson(needs.read-systems.outputs.fundamental-systems) }}

  spread-not-fundamental-pr:
    uses: ./.github/workflows/spread-tests.yaml
    if: github.event_name == 'pull_request'
    # For workflow runs that are PRs, run this non-fundamental systems job
    # only after the fundamental systems job succeeds.
    needs: [unit-tests, unit-tests-c, snap-builds, read-systems, spread-fundamental]
    name: "spread ${{ matrix.group }}"
    with:
      # Github doesn't support passing sequences as parameters.
      # Instead here we create a json array and pass it as a string.
      # Then in the spread workflow it turns it into a sequence 
      # using the fromJSON expression.
      runs-on: '["self-hosted", "spread-enabled"]'
      group: ${{ matrix.group }}
      backend: ${{ matrix.backend }}
      systems: ${{ matrix.systems }}
      tasks: ${{ matrix.tasks }}
      rules: ${{ matrix.rules }}
    strategy:
      # FIXME: enable fail-fast mode once spread can cancel an executing job.
      # Disable fail-fast mode as it doesn't function with spread. It seems
      # that cancelling tasks requires short, interruptible actions and
      # interrupting spread, notably, does not work today. As such disable
      # fail-fast while we tackle that problem upstream.
      fail-fast: false
      matrix: ${{ fromJson(needs.read-systems.outputs.non-fundamental-systems) }}

  spread-not-fundamental-not-pr:
    uses: ./.github/workflows/spread-tests.yaml
    if: github.event_name != 'pull_request'
    # For workflow runs that are not for PRs, no need to impose a dependency
    # on the fundamental systems job's success before running this job.
    needs: [unit-tests, unit-tests-c, snap-builds, read-systems]
    name: "spread ${{ matrix.group }}"
    with:
      # Github doesn't support passing sequences as parameters.
      # Instead here we create a json array and pass it as a string.
      # Then in the spread workflow it turns it into a sequence 
      # using the fromJSON expression.
      runs-on: '["self-hosted", "spread-enabled"]'
      group: ${{ matrix.group }}
      backend: ${{ matrix.backend }}
      systems: ${{ matrix.systems }}
      tasks: ${{ matrix.tasks }}
      rules: ${{ matrix.rules }}
    strategy:
      # FIXME: enable fail-fast mode once spread can cancel an executing job.
      # Disable fail-fast mode as it doesn't function with spread. It seems
      # that cancelling tasks requires short, interruptible actions and
      # interrupting spread, notably, does not work today. As such disable
      # fail-fast while we tackle that problem upstream.
      fail-fast: false
      matrix: ${{ fromJson(needs.read-systems.outputs.non-fundamental-systems) }}

  spread-nested:
    uses: ./.github/workflows/spread-tests.yaml
    needs: [unit-tests, unit-tests-c, snap-builds, read-systems]
    name: "spread ${{ matrix.group }}"
    with:
      # Github doesn't support passing sequences as parameters.
      # Instead here we create a json array and pass it as a string.
      # Then in the spread workflow it turns it into a sequence 
      # using the fromJSON expression.
      runs-on: '["self-hosted", "spread-enabled"]'
      group: ${{ matrix.group }}
      backend: ${{ matrix.backend }}
      systems: ${{ matrix.systems }}
      tasks: ${{ matrix.tasks }}
      rules: ${{ matrix.rules }}
    strategy:
      # FIXME: enable fail-fast mode once spread can cancel an executing job.
      # Disable fail-fast mode as it doesn't function with spread. It seems
      # that cancelling tasks requires short, interruptible actions and
      # interrupting spread, notably, does not work today. As such disable
      # fail-fast while we tackle that problem upstream.
      fail-fast: false
      matrix: ${{ fromJson(needs.read-systems.outputs.nested-systems) }}

  # The spread-results-reporter needs the PR number to be able to 
  # comment on the relevant PR with spread failures. Because the PR 
  # number is not in the github.event object during the 
  # spread-results-reporter.yaml job run, we upload it along side other 
  # artifacts to be subsequently downloaded by spread-results-reporter.
  upload_pr_number:
    if: ${{ github.event.pull_request.number }}
    runs-on: ubuntu-latest
    steps:
      - name: Create PR number file
        run: echo "${{ github.event.pull_request.number }}" > pr_number
      
      - name: Upload PR number
        uses: actions/upload-artifact@v4
        with:
          name: pr_number 
          path: pr_number