nightly-quality-gate.yaml

name: "Nightly Quality Gate"
on:
  # allow for kicking off quality gate check manually
  workflow_dispatch:

  # run 2 AM (UTC) daily
  schedule:
    - cron:  '0 2 * * *'

jobs:

  select-providers:
    runs-on: ubuntu-22.04
    outputs:
      providers: ${{ steps.determine-providers.outputs.providers }}
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac #v4.0.0
        with:
          # in order to properly resolve the version from git
          fetch-depth: 0

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          tools: false

      - name: Determine providers
        id: determine-providers
        run: |
          # select all providers as test subjects (this populates the matrix downstream)
          content=`cd tests/quality && poetry run make all-providers`
          echo $content
          echo "providers=$content" >> $GITHUB_OUTPUT

  validate-provider:
    runs-on: ubuntu-22.04
    needs: select-providers
    strategy:
      matrix:
        provider: ${{fromJson(needs.select-providers.outputs.providers)}}
      fail-fast: false
    permissions:
      contents: read
      packages: read
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac #v4.0.0
        with:
          # in order to properly resolve the version from git
          fetch-depth: 0
          # we need submodules for the quality gate to work (requires vulnerability-match-labels repo)
          submodules: true

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          go: true

      - name: Run quality gate
        uses: ./.github/actions/quality-gate
        with:
          provider: ${{ matrix.provider }}
        env:
          # needed as a secret for the github provider
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # note: the name for this check is referenced in release.yaml, do not change here without changing there
  Nightly-Quality-Gate:
    runs-on: ubuntu-22.04
    needs: validate-provider
    if: ${{ always() && !cancelled() }}
    steps:
      - run: |
          echo "Validations Status: ${{ needs.run-provider-validation.result }}"
          if [ "${{ needs.run-provider-validation.result }}" == "failure" ]; then
            echo "Quality gate failed!"
            exit 1
          fi
          echo "Quality gate passed!"