Merge pull request #4914 from kumvijaya/current

T8100: Refactor smoke test workflows for GitHub's pull_request_target policy change`

2 files changed, 204 insertions, 68 deletions

diff --git a/.github/config/smoketest-branches.json b/.github/config/smoketest-branches.json
new file mode 100644
index 000000000..79b519221
--- /dev/null
+++ b/.github/config/smoketest-branches.json
@@ -0,0 +1,42 @@
+{
+  "branches": {
+    "current": {
+      "vyos_mirror": "https://packages.vyos.net/repositories/current/",
+      "container_image": "vyos/vyos-build:current",
+      "vyos_build_repo": "vyos/vyos-build",
+      "use_pat": false,
+      "build_runner": ["ubuntu-24.04"],
+      "build_version_format": "%Y.%m.%d-%H%M-integration",
+      "install_build_deps": false,
+      "test_cli_command": "test-no-interfaces-no-vpp",
+      "test_tpm_tests": true,
+      "test_vpp": true,
+      "test_vpp_runner": ["ubuntu-24.04"]
+    },
+    "circinus": {
+      "vyos_mirror": "https://packages.vyos.net/repositories/circinus/",
+      "container_image": "vyos/vyos-build:circinus",
+      "vyos_build_repo": "VyOS-Networks/vyos-build",
+      "use_pat": true,
+      "build_runner": ["self-hosted", "azure"],
+      "build_version_format": "1.5-integration-%Y%m%d%H%M",
+      "install_build_deps": true,
+      "test_cli_command": "test-no-interfaces-no-vpp",
+      "test_tpm_tests": true,
+      "test_vpp": true,
+      "test_vpp_runner": ["self-hosted", "vpp"]
+    },
+    "sagitta": {
+      "vyos_mirror": "https://packages.vyos.net/repositories/sagitta/",
+      "container_image": "vyos/vyos-build:sagitta",
+      "vyos_build_repo": "VyOS-Networks/vyos-build",
+      "use_pat": true,
+      "build_runner": ["self-hosted", "azure"],
+      "build_version_format": "1.4-integration-%Y%m%d%H%M",
+      "install_build_deps": true,
+      "test_cli_command": "test-no-interfaces",
+      "test_tpm_tests": false,
+      "test_vpp": false
+    }
+  }
+}
diff --git a/.github/workflows/package-smoketest.yml b/.github/workflows/package-smoketest.yml
index a0e3156d1..9e3c2ede1 100644
--- a/.github/workflows/package-smoketest.yml
+++ b/.github/workflows/package-smoketest.yml
@@ -1,9 +1,21 @@
-name: VyOS ISO integration Test
+name: VyOS ISO Integration Test
 
 on:
+  workflow_dispatch:
+  push:
+    branches:
+      - current
+      - circinus
+      - sagitta
+    paths:
+      - '**'
+      - '!.github/**'
+      - '!**/*.md'
   pull_request_target:
     branches:
       - current
+      - circinus
+      - sagitta
     paths:
       - '**'
       - '!.github/**'
@@ -14,19 +26,67 @@ permissions:
   contents: read
 
 env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed for PR comments
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   BUILD_BY: autobuild@vyos.net
   DEBIAN_MIRROR: http://deb.debian.org/debian/
   DEBIAN_SECURITY_MIRROR: http://deb.debian.org/debian-security
-  VYOS_MIRROR: https://packages.vyos.net/repositories/current/
 
 jobs:
+  set_config:
+    runs-on: ubuntu-latest
+    outputs:
+      branch: ${{ steps.config.outputs.branch }}
+      vyos_mirror: ${{ steps.config.outputs.vyos_mirror }}
+      container_image: ${{ steps.config.outputs.container_image }}
+      vyos_build_repo: ${{ steps.config.outputs.vyos_build_repo }}
+      build_version_format: ${{ steps.config.outputs.build_version_format }}
+      build_runner: ${{ steps.config.outputs.build_runner }}
+      use_pat: ${{ steps.config.outputs.use_pat }}
+      test_cli_command: ${{ steps.config.outputs.test_cli_command }}
+      test_tpm_tests: ${{ steps.config.outputs.test_tpm_tests }}
+      test_vpp: ${{ steps.config.outputs.test_vpp }}
+      test_vpp_runner: ${{ steps.config.outputs.test_vpp_runner }}
+      install_build_deps: ${{ steps.config.outputs.install_build_deps }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set branch-specific configuration
+        id: config
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
+            BRANCH="${{ github.event.pull_request.base.ref }}"
+          else
+            BRANCH="${{ github.ref_name }}"
+          fi
+
+          CONFIG=$(jq ".branches[\"${BRANCH}\"]" .github/config/smoketest-branches.json)
+
+          if [ "$CONFIG" = "null" ] || [ -z "$CONFIG" ]; then
+            echo "::error::No smoketest configuration found for branch '${BRANCH}' in .github/config/smoketest-branches.json"
+            exit 1
+          fi
+
+          echo "branch=${BRANCH}" >> $GITHUB_OUTPUT
+          echo "vyos_mirror=$(echo $CONFIG | jq -r .vyos_mirror)" >> $GITHUB_OUTPUT
+          echo "container_image=$(echo $CONFIG | jq -r .container_image)" >> $GITHUB_OUTPUT
+          echo "vyos_build_repo=$(echo $CONFIG | jq -r .vyos_build_repo)" >> $GITHUB_OUTPUT
+          echo "build_version_format=$(echo $CONFIG | jq -r .build_version_format)" >> $GITHUB_OUTPUT
+          echo "build_runner=$(echo $CONFIG | jq -r .build_runner)" >> $GITHUB_OUTPUT
+          echo "use_pat=$(echo $CONFIG | jq -r .use_pat)" >> $GITHUB_OUTPUT
+          echo "test_cli_command=$(echo $CONFIG | jq -r .test_cli_command)" >> $GITHUB_OUTPUT
+          echo "test_tpm_tests=$(echo $CONFIG | jq -r .test_tpm_tests)" >> $GITHUB_OUTPUT
+          echo "test_vpp=$(echo $CONFIG | jq -r .test_vpp)" >> $GITHUB_OUTPUT
+          echo "test_vpp_runner=$(echo $CONFIG | jq -r .test_vpp_runner)" >> $GITHUB_OUTPUT
+          echo "install_build_deps=$(echo $CONFIG | jq -r .install_build_deps)" >> $GITHUB_OUTPUT
+
   build_iso:
-    runs-on: ubuntu-24.04
+    needs: set_config
+    runs-on: ${{ fromJson(needs.set_config.outputs.build_runner) }}
     timeout-minutes: 45
     if: github.repository == 'vyos/vyos-1x'
     container:
-      image: vyos/vyos-build:current
+      image: ${{ needs.set_config.outputs.container_image }}
       options: --sysctl net.ipv6.conf.lo.disable_ipv6=0 --privileged
     outputs:
       build_version: ${{ steps.version.outputs.build_version }}
@@ -34,22 +94,34 @@ jobs:
       - name: Clone vyos-build source code
         uses: actions/checkout@v4
         with:
-          repository: vyos/vyos-build
+          repository: ${{ needs.set_config.outputs.vyos_build_repo }}
+          token: ${{ needs.set_config.outputs.use_pat == 'true' && secrets.PAT || secrets.GITHUB_TOKEN }}
+          ref: ${{ needs.set_config.outputs.branch }}
+
       - name: Clone vyos-1x source code
         uses: actions/checkout@v4
         with:
           path: packages/vyos-1x
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.sha }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+          token: ${{ needs.set_config.outputs.use_pat == 'true' && secrets.PAT || secrets.GITHUB_TOKEN }}
           submodules: true
+
       - name: Build vyos-1x package
         run: |
-          cd packages/vyos-1x; dpkg-buildpackage -uc -us -tc -b
+          cd packages/vyos-1x
+          if [[ "${{ needs.set_config.outputs.install_build_deps }}" == "true" ]]; then
+            sudo apt-get update
+            sudo apt-get build-dep -y .
+          fi
+          dpkg-buildpackage -uc -us -tc -b
+
       - name: Generate ISO version string
         id: version
         run: |
-          echo "build_version=$(date -u +%Y.%m.%d-%H%M-integration)" >> $GITHUB_OUTPUT
+          echo "build_version=$(date -u +'${{ needs.set_config.outputs.build_version_format }}')" >> $GITHUB_OUTPUT
+
       - name: Build custom ISO image
         shell: bash
         run: |
@@ -61,8 +133,9 @@ jobs:
           --debian-mirror $DEBIAN_MIRROR \
           --debian-security-mirror $DEBIAN_SECURITY_MIRROR \
           --version ${{ steps.version.outputs.build_version }} \
-          --vyos-mirror $VYOS_MIRROR \
+          --vyos-mirror ${{ needs.set_config.outputs.vyos_mirror }} \
           generic
+
       - uses: actions/upload-artifact@v4
         with:
           retention-days: 2
@@ -71,218 +144,238 @@ jobs:
             build/live-image-amd64.hybrid.iso
             build/manifest.json
 
+      - uses: atos-actions/clean-self-hosted-runner@v1.4.10
+        if: ${{ always() && contains(needs.set_config.outputs.build_runner, 'self-hosted') }}
+
   test_smoketest_cli:
-    needs: build_iso
+    needs: [build_iso, set_config]
     runs-on: ubuntu-24.04
     timeout-minutes: 180
     container:
-      image: vyos/vyos-build:current
+      image: ${{ needs.set_config.outputs.container_image }}
       options: --sysctl net.ipv6.conf.lo.disable_ipv6=0 --privileged
     outputs:
       exit_code: ${{ steps.test.outputs.exit_code }}
     steps:
-      # We need the test script from vyos-build repo
       - name: Clone vyos-build source code
         uses: actions/checkout@v4
         with:
-          repository: vyos/vyos-build
+          repository: ${{ needs.set_config.outputs.vyos_build_repo }}
+          token: ${{ needs.set_config.outputs.use_pat == 'true' && secrets.PAT || secrets.GITHUB_TOKEN }}
+          ref: ${{ needs.set_config.outputs.branch }}
+
       - uses: actions/download-artifact@v4
         with:
           name: vyos-${{ needs.build_iso.outputs.build_version }}
           path: build
+
       - name: VyOS CLI smoketests (no interfaces)
         id: test
         shell: bash
         run: |
-          set -e
-          sudo make test-no-interfaces-no-vpp
-          if [[ $? == 0 ]]; then
+          sudo make ${{ needs.set_config.outputs.test_cli_command }} && EXIT_CODE=0 || EXIT_CODE=$?
+          if [[ $EXIT_CODE == 0 ]]; then
             echo "exit_code=success" >> $GITHUB_OUTPUT
           else
             echo "exit_code=fail" >> $GITHUB_OUTPUT
           fi
 
   test_smoketest_cli_vpp:
-    needs: build_iso
-    runs-on: ubuntu-24.04
+    needs: [build_iso, set_config]
+    if: needs.set_config.outputs.test_vpp == 'true'
+    runs-on: ${{ fromJson(needs.set_config.outputs.test_vpp_runner) }}
     timeout-minutes: 90
     container:
-      image: vyos/vyos-build:current
+      image: ${{ needs.set_config.outputs.container_image }}
       options: --sysctl net.ipv6.conf.lo.disable_ipv6=0 --privileged
     outputs:
       exit_code: ${{ steps.test.outputs.exit_code }}
     steps:
-      # We need the test script from vyos-build repo
       - name: Clone vyos-build source code
         uses: actions/checkout@v4
         with:
-          repository: vyos/vyos-build
+          repository: ${{ needs.set_config.outputs.vyos_build_repo }}
+          token: ${{ needs.set_config.outputs.use_pat == 'true' && secrets.PAT || secrets.GITHUB_TOKEN }}
+          ref: ${{ needs.set_config.outputs.branch }}
+
       - uses: actions/download-artifact@v4
         with:
           name: vyos-${{ needs.build_iso.outputs.build_version }}
           path: build
+
       - name: VyOS CLI smoketests VPP
         id: test
         shell: bash
         run: |
-          set -e
-          sudo make test-vpp
-          if [[ $? == 0 ]]; then
+          sudo make test-vpp && EXIT_CODE=0 || EXIT_CODE=$?
+          if [[ $EXIT_CODE == 0 ]]; then
             echo "exit_code=success" >> $GITHUB_OUTPUT
           else
             echo "exit_code=fail" >> $GITHUB_OUTPUT
           fi
 
   test_interfaces_cli:
-    needs: build_iso
+    needs: [build_iso, set_config]
     runs-on: ubuntu-24.04
     timeout-minutes: 180
     container:
-      image: vyos/vyos-build:current
+      image: ${{ needs.set_config.outputs.container_image }}
       options: --sysctl net.ipv6.conf.lo.disable_ipv6=0 --privileged
     outputs:
       exit_code: ${{ steps.test.outputs.exit_code }}
     steps:
-      # We need the test script from vyos-build repo
       - name: Clone vyos-build source code
         uses: actions/checkout@v4
         with:
-          repository: vyos/vyos-build
+          repository: ${{ needs.set_config.outputs.vyos_build_repo }}
+          token: ${{ needs.set_config.outputs.use_pat == 'true' && secrets.PAT || secrets.GITHUB_TOKEN }}
+          ref: ${{ needs.set_config.outputs.branch }}
+
       - uses: actions/download-artifact@v4
         with:
           name: vyos-${{ needs.build_iso.outputs.build_version }}
           path: build
+
       - name: VyOS CLI smoketests (interfaces only)
         id: test
         shell: bash
         run: |
-          set -e
-          sudo make test-interfaces
-          if [[ $? == 0 ]]; then
+          sudo make test-interfaces && EXIT_CODE=0 || EXIT_CODE=$?
+          if [[ $EXIT_CODE == 0 ]]; then
             echo "exit_code=success" >> $GITHUB_OUTPUT
           else
             echo "exit_code=fail" >> $GITHUB_OUTPUT
           fi
 
   test_config_load:
-    needs: build_iso
+    needs: [build_iso, set_config]
     runs-on: ubuntu-24.04
     timeout-minutes: 90
     container:
-      image: vyos/vyos-build:current
+      image: ${{ needs.set_config.outputs.container_image }}
       options: --sysctl net.ipv6.conf.lo.disable_ipv6=0 --privileged
     outputs:
       exit_code: ${{ steps.test.outputs.exit_code }}
     steps:
-      # We need the test script from vyos-build repo
       - name: Clone vyos-build source code
         uses: actions/checkout@v4
         with:
-          repository: vyos/vyos-build
+          repository: ${{ needs.set_config.outputs.vyos_build_repo }}
+          token: ${{ needs.set_config.outputs.use_pat == 'true' && secrets.PAT || secrets.GITHUB_TOKEN }}
+          ref: ${{ needs.set_config.outputs.branch }}
+
       - uses: actions/download-artifact@v4
         with:
           name: vyos-${{ needs.build_iso.outputs.build_version }}
           path: build
+
       - name: VyOS config load tests
         id: test
         shell: bash
         run: |
-          set -e
-          sudo make testc
-          if [[ $? == 0 ]]; then
+          sudo make testc && EXIT_CODE=0 || EXIT_CODE=$?
+          if [[ $EXIT_CODE == 0 ]]; then
             echo "exit_code=success" >> $GITHUB_OUTPUT
           else
             echo "exit_code=fail" >> $GITHUB_OUTPUT
           fi
 
   test_config_load_vpp:
-    needs: build_iso
-    runs-on: ubuntu-24.04
+    needs: [build_iso, set_config]
+    if: needs.set_config.outputs.test_vpp == 'true'
+    runs-on: ${{ fromJson(needs.set_config.outputs.test_vpp_runner) }}
     timeout-minutes: 90
     container:
-      image: vyos/vyos-build:current
+      image: ${{ needs.set_config.outputs.container_image }}
       options: --sysctl net.ipv6.conf.lo.disable_ipv6=0 --privileged
     outputs:
       exit_code: ${{ steps.test.outputs.exit_code }}
     steps:
-      # We need the test script from vyos-build repo
       - name: Clone vyos-build source code
         uses: actions/checkout@v4
         with:
-          repository: vyos/vyos-build
+          repository: ${{ needs.set_config.outputs.vyos_build_repo }}
+          token: ${{ needs.set_config.outputs.use_pat == 'true' && secrets.PAT || secrets.GITHUB_TOKEN }}
+          ref: ${{ needs.set_config.outputs.branch }}
+
       - uses: actions/download-artifact@v4
         with:
           name: vyos-${{ needs.build_iso.outputs.build_version }}
           path: build
+
       - name: VyOS config load tests VPP
         id: test
         shell: bash
         run: |
-          set -e
-          sudo make testcvpp
-          if [[ $? == 0 ]]; then
+          sudo make testcvpp && EXIT_CODE=0 || EXIT_CODE=$?
+          if [[ $EXIT_CODE == 0 ]]; then
             echo "exit_code=success" >> $GITHUB_OUTPUT
           else
             echo "exit_code=fail" >> $GITHUB_OUTPUT
           fi
 
   test_raid1_install:
-    needs: build_iso
+    needs: [build_iso, set_config]
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     container:
-      image: vyos/vyos-build:current
+      image: ${{ needs.set_config.outputs.container_image }}
       options: --sysctl net.ipv6.conf.lo.disable_ipv6=0 --privileged
     outputs:
       exit_code: ${{ steps.test.outputs.exit_code }}
     steps:
-      # We need the test script from vyos-build repo
       - name: Clone vyos-build source code
         uses: actions/checkout@v4
         with:
-          repository: vyos/vyos-build
+          repository: ${{ needs.set_config.outputs.vyos_build_repo }}
+          token: ${{ needs.set_config.outputs.use_pat == 'true' && secrets.PAT || secrets.GITHUB_TOKEN }}
+          ref: ${{ needs.set_config.outputs.branch }}
+
       - uses: actions/download-artifact@v4
         with:
           name: vyos-${{ needs.build_iso.outputs.build_version }}
           path: build
+
       - name: VyOS RAID1 installation tests
         id: test
         shell: bash
         run: |
-          set -e
-          sudo make testraid
-          if [[ $? == 0 ]]; then
+          sudo make testraid && EXIT_CODE=0 || EXIT_CODE=$?
+          if [[ $EXIT_CODE == 0 ]]; then
             echo "exit_code=success" >> $GITHUB_OUTPUT
           else
             echo "exit_code=fail" >> $GITHUB_OUTPUT
           fi
 
   test_encrypted_config_tpm:
-    needs: build_iso
+    needs: [build_iso, set_config]
+    if: needs.set_config.outputs.test_tpm_tests == 'true'
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     container:
-      image: vyos/vyos-build:current
+      image: ${{ needs.set_config.outputs.container_image }}
       options: --sysctl net.ipv6.conf.lo.disable_ipv6=0 --privileged
     outputs:
       exit_code: ${{ steps.test.outputs.exit_code }}
     steps:
-      # We need the test script from vyos-build repo
       - name: Clone vyos-build source code
         uses: actions/checkout@v4
         with:
-          repository: vyos/vyos-build
+          repository: ${{ needs.set_config.outputs.vyos_build_repo }}
+          token: ${{ needs.set_config.outputs.use_pat == 'true' && secrets.PAT || secrets.GITHUB_TOKEN }}
+          ref: ${{ needs.set_config.outputs.branch }}
+
       - uses: actions/download-artifact@v4
         with:
           name: vyos-${{ needs.build_iso.outputs.build_version }}
           path: build
+
       - name: VyOS TPM encryption tests
         id: test
         shell: bash
         run: |
-          set -e
-          sudo make testtpm
-          if [[ $? == 0 ]]; then
+          sudo make testtpm && EXIT_CODE=0 || EXIT_CODE=$?
+          if [[ $EXIT_CODE == 0 ]]; then
             echo "exit_code=success" >> $GITHUB_OUTPUT
           else
             echo "exit_code=fail" >> $GITHUB_OUTPUT
@@ -290,6 +383,7 @@ jobs:
 
   result:
     needs:
+      - set_config
       - test_smoketest_cli
       - test_smoketest_cli_vpp
       - test_interfaces_cli
@@ -302,23 +396,23 @@ jobs:
     if: always()
     steps:
       - name: Add PR comment
-        if: always()
+        if: always() && github.event_name == 'pull_request_target'
         uses: mshick/add-pr-comment@v2
         with:
           message: |
-            CI integration ${{ needs.test_smoketest_cli.outputs.exit_code == 'success' && needs.test_interfaces_cli.outputs.exit_code == 'success' && needs.test_config_load.outputs.exit_code == 'success' && needs.test_raid1_install.outputs.exit_code == 'success' && '👍 passed!' || '❌ failed!' }}
+            CI integration ${{ (needs.test_smoketest_cli.outputs.exit_code == 'success' && needs.test_interfaces_cli.outputs.exit_code == 'success' && needs.test_config_load.outputs.exit_code == 'success' && needs.test_raid1_install.outputs.exit_code == 'success' && (needs.test_smoketest_cli_vpp.result != 'failure') && (needs.test_config_load_vpp.result != 'failure') && (needs.test_encrypted_config_tpm.result != 'failure')) && '👍 passed!' || '❌ failed!' }}
 
             ### Details
 
             [CI logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
 
-            * CLI Smoketests (no interfaces) ${{ needs.test_smoketest_cli.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
-            * CLI Smoketests VPP ${{ needs.test_smoketest_cli_vpp.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
+            * CLI Smoketests ${{ needs.test_smoketest_cli.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
             * CLI Smoketests (interfaces only) ${{ needs.test_interfaces_cli.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
             * Config tests ${{ needs.test_config_load.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
-            * Config tests VPP ${{ needs.test_config_load_vpp.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
             * RAID1 tests ${{ needs.test_raid1_install.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
-            * TPM tests ${{ needs.test_encrypted_config_tpm.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
+            * CLI Smoketests VPP ${{ needs.test_smoketest_cli_vpp.result == 'success' && '👍 passed' || needs.test_smoketest_cli_vpp.result == 'failure' && '❌ failed' || needs.test_smoketest_cli_vpp.result == 'skipped' && '⏭️ skipped' || '⏭️ skipped' }}
+            * Config tests VPP ${{ needs.test_config_load_vpp.result == 'success' && '👍 passed' || needs.test_config_load_vpp.result == 'failure' && '❌ failed' || needs.test_config_load_vpp.result == 'skipped' && '⏭️ skipped' || '⏭️ skipped' }}
+            * TPM tests ${{ needs.test_encrypted_config_tpm.result == 'success' && '👍 passed' || needs.test_encrypted_config_tpm.result == 'failure' && '❌ failed' || needs.test_encrypted_config_tpm.result == 'skipped' && '⏭️ skipped' || '⏭️ skipped' }}
 
           message-id: "SMOKETEST_RESULTS"
           allow-repeats: false