pr-quality-gate.yaml

name: "PR Quality Gate"
on:
  pull_request:
    types:
      # default types...
      - opened
      - synchronize
      - reopened
      # custom types...
      - labeled

jobs:

  select-providers:
    runs-on: ubuntu-22.04
    outputs:
      providers: ${{ steps.determine-providers.outputs.providers }}
    steps:
      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 #v4.1.0
        with:
          # in order to properly resolve the version from git
          fetch-depth: 0

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          tools: false

      - name: Determine providers
        id: determine-providers
        run: |
          # be nice to folks troubleshooting in CI...
          cd tests/quality
          poetry run make show-changes

          # determine which providers to run (to later populate the matrix)
          content=`poetry run make select-providers`
          echo $content
          echo "providers=$content" >> $GITHUB_OUTPUT

  validate-provider:
    runs-on: ubuntu-22.04
    needs: select-providers
    if: contains(github.event.pull_request.labels.*.name, 'run-pr-quality-gate')

    strategy:
      matrix:
        provider: ${{fromJson(needs.select-providers.outputs.providers)}}
      fail-fast: false

    permissions:
      contents: read
      packages: read

    steps:
      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 #v4.1.0
        with:
          # in order to properly resolve the version from git
          fetch-depth: 0
          # we need submodules for the quality gate to work (requires vulnerability-match-labels repo)
          submodules: true

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          go: true

      - name: Run quality gate
        uses: ./.github/actions/quality-gate
        with:
          provider: ${{ matrix.provider }}
        env:
          # needed as a secret for the github provider
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  evaluate-quality-gate:
    runs-on: ubuntu-22.04
    needs:
     - validate-provider
     - select-providers
    if: ${{ always() }}
    steps:
      - run: |
          echo "Validations Status: ${{ needs.validate-provider.result }}"
          echo "Providers that require testing: ${{ needs.select-providers.outputs.providers }}"
          echo
          if [ '${{ needs.select-providers.outputs.providers }}' == '[]' ]; then
            echo "🟢 Quality gate passed! (no providers changed)"
            exit 0
          fi
          if [ "${{ needs.validate-provider.result }}" != "success" ]; then
            echo "🔴 Quality gate FAILED! 😭"
            echo
            echo "This could happen for a couple of reasons:"
            echo "  - A provider test failed, in which case see the logs in previous jobs for more details"
            echo "  - A required provider test was skipped. You might need to add the 'run-pr-quality-gate' label to your PR to prevent skipping the test."
            exit 1
          fi
          echo "🟢 Quality gate passed! (all tests passed)"

      - uses: 8398a7/action-slack@fbd6aa58ba854a740e11a35d0df80cb5d12101d8 #v3.15.1
        if: ${{ failure() }}
        with:
          status: ${{ job.status }}
          fields: repo,workflow,action,eventName
          text: "Vunnel nightly quality gate has failed: https://github.com/anchore/vunnel/actions/workflows/nightly-quality-gate.yaml"
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}