kubescape/.github/workflows/00-pr-scanner.yaml

name: 00-pr_scanner
permissions: read-all
on:
    workflow_dispatch: {}
    pull_request:
        types: [opened, reopened, synchronize, ready_for_review]
        paths-ignore:
            - "**.yaml"
            - "**.yml"
            - "**.md"
            - "**.sh"
            - "website/*"
            - "examples/*"
            - "docs/*"
            - "build/*"
            - ".github/*"

concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}
    cancel-in-progress: true

jobs:
    pr-scanner:
        permissions:
            actions: read
            artifact-metadata: read
            attestations: read
            checks: read
            contents: write
            deployments: read
            discussions: read
            id-token: write
            issues: read
            models: read
            packages: read
            pages: read
            pull-requests: write
            repository-projects: read
            security-events: read
            statuses: read
        uses: ./.github/workflows/a-pr-scanner.yaml
        with:
            RELEASE: ""
            CLIENT: test
            CGO_ENABLED: 0
            GO111MODULE: ""
        secrets: inherit

    wf-preparation:
        name: secret-validator
        runs-on: ubuntu-latest
        outputs:
            TEST_NAMES: ${{ steps.export_tests_to_env.outputs.TEST_NAMES }}
            is-secret-set: ${{ steps.check-secret-set.outputs.is-secret-set }}

        steps:
            - name: check if the necessary secrets are set in github secrets
              id: check-secret-set
              env:
                  CUSTOMER: ${{ secrets.CUSTOMER }}
                  USERNAME: ${{ secrets.USERNAME }}
                  PASSWORD: ${{ secrets.PASSWORD }}
                  CLIENT_ID: ${{ secrets.CLIENT_ID_PROD }}
                  SECRET_KEY: ${{ secrets.SECRET_KEY_PROD }}
                  REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
                  REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
              run: "echo \"is-secret-set=${{ env.CUSTOMER != '' && env.USERNAME != '' && env.PASSWORD != '' && env.CLIENT_ID != '' && env.SECRET_KEY != '' && env.REGISTRY_USERNAME != '' && env.REGISTRY_PASSWORD != '' }}\" >> $GITHUB_OUTPUT\n"

            - id: export_tests_to_env
              name: set test name
              run: |
                  echo "TEST_NAMES=$input" >> $GITHUB_OUTPUT
              env:
                  input: '[
                      "scan_nsa",
                      "scan_mitre",
                      "scan_with_exceptions",
                      "scan_repository",
                      "scan_local_file",
                      "scan_local_glob_files",
                      "scan_local_list_of_files",
                      "scan_git_repository_and_submit_to_backend",
                      "scan_and_submit_to_backend",
                      "scan_customer_configuration",
                      "scan_compliance_score",
                      "scan_custom_framework_scanning_file_scope_testing",
                      "scan_custom_framework_scanning_cluster_scope_testing",
                      "scan_custom_framework_scanning_cluster_and_file_scope_testing"
                      ]'

    run-system-tests:
        strategy:
            fail-fast: false
            matrix:
                TEST: ${{ fromJson(needs.wf-preparation.outputs.TEST_NAMES) }}
        needs: [wf-preparation, pr-scanner]
        if: ${{ (needs.wf-preparation.outputs.is-secret-set == 'true') && (always() && (contains(needs.*.result, 'success') || contains(needs.*.result, 'skipped')) && !(contains(needs.*.result, 'failure')) && !(contains(needs.*.result, 'cancelled'))) }}
        runs-on: ubuntu-latest
        permissions:
            actions: read
            contents: read
            pull-requests: write
        steps:
            - uses: actions/checkout@v4
              with:
                  fetch-depth: 0
                  submodules: recursive

            - uses: actions/setup-go@v4
              name: Installing go
              with:
                  go-version: "1.25"

            - uses: anchore/sbom-action/download-syft@v0
              name: Setup Syft

            - uses: goreleaser/goreleaser-action@v6
              name: Build
              with:
                  distribution: goreleaser
                  version: latest
                  args: build --clean --snapshot --single-target
              env:
                  RELEASE: ""
                  CLIENT: test
                  CGO_ENABLED: 0

            - name: chmod +x
              run: chmod +x -R ${PWD}/dist/cli_linux_amd64_v1/kubescape

            - name: Checkout systests repo
              uses: actions/checkout@v4
              with:
                  repository: armosec/system-tests
                  path: system-tests

            - uses: actions/setup-python@v4
              with:
                  python-version: "3.9"
                  cache: "pip"

            - name: create env
              run: ./create_env.sh
              working-directory: system-tests

            - name: Generate uuid
              id: uuid
              run: |
                  echo "RANDOM_UUID=$(uuidgen)" >> $GITHUB_OUTPUT

            - name: Create k8s Kind Cluster
              id: kind-cluster-install
              uses: helm/kind-action@v1.10.0
              with:
                  cluster_name: ${{ steps.uuid.outputs.RANDOM_UUID }}

            - name: run-tests-on-local-built-kubescape
              env:
                  CUSTOMER: ${{ secrets.CUSTOMER }}
                  USERNAME: ${{ secrets.USERNAME }}
                  PASSWORD: ${{ secrets.PASSWORD }}
                  CLIENT_ID: ${{ secrets.CLIENT_ID_PROD }}
                  SECRET_KEY: ${{ secrets.SECRET_KEY_PROD }}
                  REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
                  REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
              working-directory: system-tests
              run: |
                  echo "Test history:"
                  echo " ${{ matrix.TEST }} " >/tmp/testhistory
                  cat /tmp/testhistory
                  source systests_python_env/bin/activate

                  python3 systest-cli.py             \
                    -t ${{ matrix.TEST }}            \
                    -b production                    \
                    -c CyberArmorTests               \
                    --duration 3                     \
                    --logger DEBUG                   \
                    --kwargs kubescape=${GITHUB_WORKSPACE}/dist/cli_linux_amd64_v1/kubescape

                  deactivate

            - name: Test Report
              uses: mikepenz/action-junit-report@v5
              if: always()
              with:
                  github_token: ${{ secrets.GITHUB_TOKEN }}
                  report_paths: "system-tests/**/results_xml_format/**.xml"
                  commit: ${{github.event.workflow_run.head_sha}}