substrate/.github/workflows/pr-workflow.yaml

# Copyright 2026 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: pr-workflow
on:
  pull_request:
  push:
    branches: [main]
  schedule:
    # Weekly run on the default branch keeps the micro-VM asset cache warm (GitHub
    # evicts caches idle for 7 days). The push-to-main run populates the cache that
    # PRs inherit; this refreshes it so PRs keep hitting it (no asset re-download).
    - cron: '37 4 * * 1'
# Nothing here writes to the repository: the jobs check the tree out, build it,
# and run it in a throwaway cluster.
permissions:
  contents: read
jobs:
  run-tests:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
    - name: Setup Go
      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
      with:
        go-version-file: 'go.mod'
    - run: go test -race -v ./...
    # Root-gated tests (overlay mounts, whiteout mknod, trusted.* xattrs, ...)
    # skip for the unprivileged runner user above; rerun the packages that
    # contain them (any test importing internal/roottest) under sudo.
    - name: root-gated tests
      run: hack/run-root-tests.sh -race -v
    - name: verify
      run: hack/verify-all.sh
  # One kind cluster exercises BOTH runtimes. Free x86-64 ubuntu-latest runners
  # expose /dev/kvm (with a udev rule), so create-kind-cluster.sh mounts it and the
  # micro-VM (kata + cloud-hypervisor) sandbox class works alongside gVisor.
  e2e-test:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
    - name: Setup Go
      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
      with:
        go-version-file: 'go.mod'
    - name: Cache micro-VM assets
      id: microvm-assets
      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
      with:
        # Assembling the assets (download kata-static + cloud-hypervisor + the
        # prebuilt virtiofsd — all downloads on amd64) is fully pinned by assemble.sh,
        # so key the cache on its hash. The push-to-main run populates the
        # default-branch cache PRs inherit; the weekly schedule refreshes it.
        # run-microvm-demo-kind.sh skips assembling when these are present.
        path: bin/microvm-assets/amd64
        key: microvm-assets-amd64-${{ hashFiles('hack/microvm-assets/assemble.sh') }}
    - name: Enable KVM
      # Grant the runner access to /dev/kvm so create-kind-cluster.sh mounts it into
      # the node and labels it for the micro-VM sandbox class.
      run: |
        echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
          | sudo tee /etc/udev/rules.d/99-kvm4all.rules
        sudo udevadm control --reload-rules
        sudo udevadm trigger --name-match=kvm
    - name: Create cluster
      run: hack/create-kind-cluster.sh
    - name: Install Agent Substrate
      run: hack/install-ate-kind.sh --deploy-ate-system --store-backend=postgres
    - name: Deploy micro-VM counter demo
      # Stages the (cached) assets into the cluster's rustfs and applies the
      # counter-microvm demo onto the control plane installed above.
      run: hack/run-microvm-demo-kind.sh
    - name: Deploy gVisor counter demo
      run: hack/install-ate-kind.sh --deploy-demo-counter
    - name: Deploy egress demos
      # TestActorEgress in the networking suite builds its Actor from the egress
      # ActorTemplate for the class under test, so both fixtures have to exist
      # before their respective lane runs.
      run: |
        hack/install-ate-kind.sh --deploy-demo-egress
        hack/install-ate-kind.sh --deploy-demo-egress-microvm
    - name: Wait for micro-VM golden snapshot
      run: |
        kubectl --context kind-kind wait --for=condition=Ready \
          actortemplate/counter-microvm -n ate-demo-counter-microvm --timeout=600s
    - name: Run E2E tests (gVisor)
      run: hack/run-e2e-kind.sh -v -args --no-color
    - name: Run E2E tests (micro-VM)
      # The same suites again, with every fixture repointed at its micro-VM
      # variant by the single E2E_SANDBOX_CLASS knob (see internal/e2e/sandbox.go).
      # Sequential with the gVisor lane above, not concurrent: a suite releases
      # its namespace — and with it its worker pods — as each test passes, so the
      # two runs do not contend for the one kind node.
      env:
        E2E_SANDBOX_CLASS: microvm
      run: hack/run-e2e-kind.sh -v -args --no-color
    - name: Deploy MITM egress (sdsmint)
      # Swap the passthrough egress gateway for the sdsmint variant, which
      # mints per-SNI leaves from the egress-mitm-ca-pool (created here if
      # missing). --deploy-atenet redeploys only the atenet components (the
      # rest of the control plane is unchanged), keeping this step cheap.
      # Cluster-wide, so it must come AFTER the standard lanes: once egress
      # TLS is intercepted, their passthrough assumptions
      # (TestActorEgressHTTPS's end-to-end TLS with the origin) no longer hold.
      run: hack/install-ate-kind.sh --deploy-atenet --experimental-use-sdsmint
    - name: Run E2E tests (egress MITM trust)
      # The consumption half of the trust-bundle chain: an actor does TLS with
      # the MITM gateway's minted leaf using ONLY the projected bundle, plus a
      # system-roots negative control proving interception is real (see
      # internal/e2e/suites/egressmitm).
      env:
        E2E_EGRESS_MITM: "1"
      run: hack/run-e2e-kind.sh ./internal/e2e/suites/egressmitm -v -args --no-color
    - name: Run E2E tests (egress MITM trust, micro-VM)
      # The same proof with the probe on the micro-VM runtime. Trust DELIVERY
      # differs per sandbox class (gVisor RO bind vs the micro-VM unified
      # virtio-fs share), so the handshake is proven on both. Uses the
      # micro-VM deps staged earlier in this job.
      env:
        E2E_EGRESS_MITM: "1"
        E2E_SANDBOX_CLASS: microvm
      run: hack/run-e2e-kind.sh ./internal/e2e/suites/egressmitm -v -args --no-color
    - name: Dump diagnostics on failure
      if: failure()
      run: |
        kubectl --context kind-kind get actortemplate,workerpool,pods -A -o wide || true
        dump() {
          echo "=== logs: $1/$2 ==="
          kubectl --context kind-kind logs -n "$1" "$2" --all-containers --tail=300 2>/dev/null || true
        }
        for p in $(kubectl --context kind-kind get pods -n ate-system -o name 2>/dev/null); do
          dump ate-system "$p"
        done
        # Every worker pod in any namespace: the demo pools plus the e2e suites'
        # randomly-named per-test namespaces, which the suites keep on failure.
        # The failing actor runs in one of these, so this is where its ateom logs
        # (and, for a micro-VM worker, the guest console tail) live.
        kubectl --context kind-kind get pods -A -l ate.dev/worker-pool \
          -o 'custom-columns=:.metadata.namespace,:.metadata.name' --no-headers 2>/dev/null \
          | while read -r ns name; do dump "$ns" "$name"; done