test-world.yaml

name: Wolfi OS Test World

on:
  push:
    branches: ["main"]
    paths-ignore:
      - "**.md"
      - "**.txt"

  workflow_dispatch:


# Only run one test at a time to curtail costs
concurrency:
  group: test-world-${{ github.ref }}

permissions:
  contents: read

jobs:
  test:
    name: Test packages
    if: github.repository == 'wolfi-dev/os'

    strategy:
      matrix:
        include:
          - arch: x86_64
            runner: ubuntu-intel-64-cores
          - arch: aarch64
            runner: ubuntu-arm-64-cores
      fail-fast: false

    runs-on: ${{matrix.runner}}

    permissions:
      contents: read
      id-token: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Setup Docker
        run: |
          # Add Docker's official GPG key:
          sudo apt-get update -y
          sudo apt-get install ca-certificates curl -y
          sudo install -m 0755 -d /etc/apt/keyrings
          sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
          sudo chmod a+r /etc/apt/keyrings/docker.asc
          # Add the repository to Apt sources:
          echo \
            "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
            $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
            sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
          sudo apt-get update -y
          sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
          sudo usermod -aG docker $USER
          sudo apt-get install acl
          sudo setfacl --modify user:$USER:rw /var/run/docker.sock

      # this need to point to main to always get the latest action
      - uses: wolfi-dev/actions/install-wolfictl@main # main

      - name: "Set up environment and test"
        run: |
          set -x
          set -e
          set -o pipefail

          mkdir -p ./packages/${{ matrix.arch }}

          # Don't use ./packages or a local key since we're not using any local packages
          wolfictl test \
            --runner docker \
            --repository-append https://packages.wolfi.dev/os \
            --keyring-append https://packages.wolfi.dev/os/wolfi-signing.rsa.pub \
            --arch ${{ matrix.arch }} \
            --trace ./packages/${{ matrix.arch }}/trace.json

      - name: Reset file permissions
        run: sudo chown -R $(id -u):$(id -g) .

      - name: Create an archive for uploading
        if: ${{ always() }}
        run: |
          # Move logs so we can upload them separately.
          mv ./packages/${{ matrix.arch }}/testlogs /tmp/testlogs

          # Move trace so we can upload it separately.
          mv ./packages/${{ matrix.arch }}/trace.json /tmp/trace.json

      # Always run these steps for https://github.com/wolfi-dev/os/issues/8698
      - if: ${{ always() }}
        name: "Upload logs archive to GitHub Artifacts"
        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
        with:
          name: logs-${{ matrix.arch }}
          path: /tmp/testlogs/
          if-no-files-found: warn
      - if: ${{ always() }}
        name: "Upload trace to GitHub Artifacts"
        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
        with:
          name: trace-${{ matrix.arch }}
          path: /tmp/trace.json
          if-no-files-found: warn