x509-certificate-exporter/.github/workflows/test.yaml

name: Tests

# Same shape as lint.yaml / security.yaml: scoped on PR via path
# detection, runs everything unconditionally when called from another
# workflow (e.g. release).
on:
  pull_request:
  workflow_call:
    inputs:
      skip-e2e:
        description: Skip the E2E suite.
        type: boolean
        default: false

# Read-only by default — every job here just runs the test suite. The
# release.yaml caller doesn't pass any privileged token through.
permissions:
  contents: read

# Silence Dagger's Cloud upload and analytics paths globally.
env:
  DAGGER_NO_NAG: "1"
  DAGGER_CLOUD_TOKEN: ""
  DO_NOT_TRACK: "1"

jobs:
  changes:
    name: Detect changed paths
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    outputs:
      go: ${{ steps.filter.outputs.go }}
      e2e: ${{ steps.filter.outputs.e2e }}
      helm_examples: ${{ steps.filter.outputs.helm_examples }}
      helm_fixtures: ${{ steps.filter.outputs.helm_fixtures }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 1
      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4
        id: filter
        with:
          # Unit tests fire on any Go change; e2e additionally on
          # anything that materially affects the deployed flow — chart
          # templates, fixtures, the Tiltfile, and the seeders.
          filters: |
            go:
              - '**/*.go'
              - 'go.mod'
              - 'go.sum'
              - 'dagger/**'
            e2e:
              - '**/*.go'
              - 'go.mod'
              - 'go.sum'
              - 'dagger/**'
              - 'chart/**'
              - 'dev/scenarios/**'
              - 'dev/seed/**'
              - 'dev/seed-hostpath/**'
              - 'dev/values.yaml'
              - 'test/e2e/**'
              - 'build/Dockerfile.*'
              - '.goreleaser.yaml'
              - 'flake.nix'
              - 'flake.lock'
            helm_examples:
              - 'chart/**'
              - 'docs/examples/**'
              - 'dagger/**'
            helm_fixtures:
              - 'chart/**'
              - 'test/schema/**'
              - 'dagger/**'

  unit:
    name: Unit tests
    needs: changes
    if: |
      always() &&
      (github.event_name != 'pull_request' || needs.changes.outputs.go == 'true')
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 1
      - uses: ./.github/actions/dagger
        with:
          args: test

  helm-examples:
    name: Helm examples
    needs: changes
    if: |
      always() &&
      (github.event_name != 'pull_request' || needs.changes.outputs.helm_examples == 'true')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 1
      - uses: ./.github/actions/dagger
        with:
          args: test-helm-examples

  helm-fixtures:
    name: Helm schema fixtures
    needs: changes
    if: |
      always() &&
      (github.event_name != 'pull_request' || needs.changes.outputs.helm_fixtures == 'true')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 1
      - uses: ./.github/actions/dagger
        with:
          args: test-helm-fixtures

  e2e:
    name: E2E tests
    needs: changes
    if: |
      always() &&
      !inputs.skip-e2e &&
      (github.event_name != 'pull_request' || needs.changes.outputs.e2e == 'true')
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 1
      # Bring up the same toolset as the local dev shell — k3d, helm,
      # tilt, goreleaser, kubectl, task — from flake.nix. Single source
      # of truth between dev and CI for the e2e tooling. Renovate
      # tracks both refs via the `# vXX` comment.
      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
      - uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
      - run: nix develop --command task test:e2e