alerting/.github/workflows/security-test-workflow.yml at main · opensearch-project/alerting · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
name: Security Test Workflow
# This workflow is triggered on pull requests and pushes to main or an OpenSearch release branch
on:
  pull_request:
    branches:
      - "*"
  push:
    branches:
      - "*"

jobs:
  Get-CI-Image-Tag:
    uses: opensearch-project/opensearch-build/.github/workflows/get-ci-image-tag.yml@main
    with:
      product: opensearch

  build-linux:
    strategy:
      matrix:
        # Resource-sharing disabled: run the full security IT suite (backend-role / filterBy model).
        # Resource-sharing enabled: run ONLY the resource-sharing-specific suites; the backend-role
        # secure suites and general functional ITs assume the pre-RSC access model and are covered by
        # the disabled variant, so they are not re-run under RSC.
        include:
          - java: 21
            resource_sharing_flag: ""
            test_filter: "--tests '*IT'"
          - java: 21
            resource_sharing_flag: "-Dresource_sharing.enabled=true"
            test_filter: "--tests '*SecureResourceSharingMonitorRestApiIT' --tests '*RscMigrateE2ERestApiIT'"
    needs: Get-CI-Image-Tag
    # This job runs on Linux
    runs-on: ubuntu-latest
    container:
      # using the same image which is used by opensearch-build team to build the OpenSearch Distribution
      # this image tag is subject to change as more dependencies and updates will arrive over time
      image: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-version-linux }}
      options: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-options }}

    name: Build and test Alerting with security-enabled
    steps:
      - name: Run start commands
        run: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-command }}

      # This step uses the setup-java Github action: https://github.com/actions/setup-java
      - name: Set Up JDK ${{ matrix.java }}
        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
        with:
          distribution: temurin # Temurin is a distribution of adoptium
          java-version: ${{ matrix.java }}

      # This step uses the checkout Github action: https://github.com/actions/checkout
      - name: Checkout Branch
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Run integration tests
        run: |
          chown -R 1000:1000 `pwd`
          su `id -un 1000` -c "./gradlew integTest -Dsecurity=true -Dhttps=true ${{ matrix.resource_sharing_flag }} ${{ matrix.test_filter }}"

      - name: Upload failed logs
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: failure()
        with:
          name: logs-${{ matrix.resource_sharing_flag != '' && 'resource-sharing' || 'no-resource-sharing' }}
          overwrite: 'true'
          path: build/testclusters/integTest-*/logs/*