Integration test for pull requests

.github/workflows/build-push-artifacts.yaml

@@ -1,6 +1,20 @@
 name: Publish artifacts
-# Run the tasks on every push
-on: push
+
+on:
+  # Publish artifacts on every push to main and every tag
+  push:
+    branches:
+      - main
+    tags:
+      - "*"
+  # Also allow publication to be done via a workflow call
+  # In this case, the chart version is returned as an output
+  workflow_call:
+    outputs:
+      chart-version:
+        description: The chart version that was published
+        value: ${{ jobs.build_push_chart.outputs.chart-version }}
+
 jobs:
   build_push_images:
     name: Build and push images

.github/workflows/test-pr.yaml

@@ -0,0 +1,65 @@
+name: Integration tests
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - ready_for_review
+      - reopened
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.head_ref }}
+  cancel-in-progress: true
+
+jobs:
+  # This job exists so that PRs from outside the main repo are rejected
+  fail_on_remote:
+    runs-on: ubuntu-latest
+    steps:
+      - name: PR must be from a branch in the stackhpc/azimuth-capi-operator repo
+        run: exit ${{ github.repository == 'stackhpc/azimuth-capi-operator' && '0' || '1' }}
+
+  # Use a job that does nothing but is protected by an environment as a guard
+  # This allows us to control access to test infrastructure
+  wait_for_approval:
+    needs: [fail_on_remote]
+    runs-on: ubuntu-latest
+    environment: ci-approval
+    steps:
+      - run: exit 0
+
+  publish_artifacts:
+    needs: [wait_for_approval]
+    uses: ./.github/workflows/build-push-artifacts.yaml
+
+  run_azimuth_tests:
+    needs: [publish_artifacts]
+    runs-on: ubuntu-latest
+    steps:
+      # Check out the configuration repository
+      - name: Set up Azimuth environment
+        uses: stackhpc/azimuth-config/.github/actions/setup@main
+        with:
+          os-clouds: ${{ secrets.OS_CLOUDS }}
+          environment-prefix: capi-ci
+          # Use the version of the chart that we just built
+          # We run the Kubernetes tests and the Kubernetes app tests, but not the CaaS tests
+          extra-vars: |
+            azimuth_capi_operator_chart_version: ${{ needs.publish_artifacts.outputs.chart-version }}
+            generate_tests_caas_suite_enabled: false
+
+      # Provision Azimuth using the azimuth-ops version under test
+      - name: Provision Azimuth
+        uses: stackhpc/azimuth-config/.github/actions/provision@main
+
+      # # Run the tests
+      - name: Run Azimuth tests
+        uses: stackhpc/azimuth-config/.github/actions/test@main
+
+      # Tear down the environment
+      - name: Destroy Azimuth
+        uses: stackhpc/azimuth-config/.github/actions/destroy@main
+        if: ${{ always() }}