pathrs 0.2.5

# SPDX-License-Identifier: MPL-2.0
#
# libpathrs: safe path resolution on Linux
# Copyright (C) 2019-2025 SUSE LLC
# Copyright (C) 2026 Aleksa Sarai <cyphar@cyphar.com>
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at https://mozilla.org/MPL/2.0/.

on:
  push:
    branches: [ main ]
    tags:
      - 'v*'
  pull_request:
    branches: [ main ]
  release:
    types: [ published ]
  schedule:
    - cron: '0 0 * * *'

name: e2e-tests

env:
  BATS_VERSION: "1.11.1"
  CI_IMAGE: cyphar/libpathrs:ci-latest

jobs:
  e2e-test:
    strategy:
      fail-fast: false
      matrix:
        lang:
          - go
          - rust
          - python
        run-as:
          - ""
          - "root"
        lang-desc: [""]
        include:
          # Test minimum python version.
          # TODO: Switch to python 3.9 (pathrs bindings version).
          #       typing.Self: python >= 3.11
          #       match: python >= 3.10
          - lang: python
            lang-desc: python3.11
            python-version: "3.11"
          # Test minimum Go version.
          # TODO: Switch to Go 1.18 (go-pathrs bindings version).
          #       strings.FieldsFuncSeq: go >= 1.24
          #       urfave/cli/v3: go >= 1.22
          - lang: go
            lang-desc: go1.24
            go-version: "1.24"

    # FIXME: This is horrific.
    name: >-
      run e2e-tests
      ${{
        format('({0}{1})',
          matrix.lang-desc || matrix.lang,
          matrix.run-as && format(', {0}', matrix.run-as) || '',
        )
      }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: install package
        run: |-
          sudo apt-get update -y
          sudo apt-get install -y moreutils

      # Build and install libpathrs.so.
      - if: ${{ matrix.lang != 'rust' }}
        uses: dtolnay/rust-toolchain@stable
      - if: ${{ matrix.lang != 'rust' }}
        name: build libpathrs
        run: make release
      - if: ${{ matrix.lang != 'rust' }}
        name: install libpathrs
        run: sudo ./install.sh --prefix=/usr --libdir=/usr/lib

      # Setup go.
      - if: ${{ matrix.lang == 'go' }}
        name: install go
        uses: actions/setup-go@v6
        with:
          go-version: ${{ matrix.go-version || 'stable' }}
          check-latest: true

      # Setup python.
      - if: ${{ matrix.lang == 'python' }}
        uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
      - if: ${{ matrix.lang == 'python' }}
        name: install pypa/build
        run: >-
          python3 -m pip install --user build twine

      # Install bats.
      - name: install bats
        uses: bats-core/bats-action@4.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          bats-version: ${{ env.BATS_VERSION }}
          support-install: false
          assert-install: false
          detik-install: false
          file-install: false

      # Run tests.
      - name: make -C e2e-tests test-${{ matrix.lang }}
        run: |-
          export BATS=$(which bats)
          make -C e2e-tests RUN_AS=${{ matrix.run-as }} test-${{ matrix.lang }}

  ctr-ci-image:
    runs-on: ubuntu-latest
    name: build ci docker image
    steps:
      - uses: actions/checkout@v6
      - name: setup docker buildx
        uses: docker/setup-buildx-action@v4
      - name: build and cache ci image
        uses: docker/build-push-action@v7
        with:
          context: .
          tags: ${{ env.CI_IMAGE }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  ctr-e2e-test:
    runs-on: ubuntu-latest
    needs:
      - ctr-ci-image
    strategy:
      fail-fast: false
      matrix:
        lang:
          - python
          - go
          - rust
        runtime:
          - docker
        run-as:
          - unpriv
          - CAP_SYS_ADMIN
    env:
      CONTAINER_RUNTIME: ${{ matrix.runtime }}
      # NOTE: For the root tests we need to disable AppArmor because it blocks
      # mount operations, even in child mount namespaces.
      CONTAINER_RUN_ARGS: >-
        ${{ matrix.run-as == 'CAP_SYS_ADMIN' && '--cap-add sys_admin --security-opt=apparmor=unconfined' || '' }}
        ${{ matrix.run-as == 'unpriv' && '--user 1000:1000' || '' }}
      E2E_LANG: ${{ matrix.lang }}
    name: >-
      (${{ matrix.runtime }})
      run e2e-tests
      (${{ matrix.lang }}, ${{ matrix.run-as }})
    steps:
      - uses: actions/checkout@v6
      # Pull the image from the cache by triggering a "new build".
      - name: setup docker buildx
        uses: docker/setup-buildx-action@v4
      # TODO: Ideally we would be able to pull the image from the cache without
      # needing to trigger another build. In the worst case we could just
      # upload the CI image in the ctr-ci-image job and load it here.
      - name: build and cache ci image
        uses: docker/build-push-action@v7
        with:
          context: .
          tags: ${{ env.CI_IMAGE }}
          load: true
          cache-from: type=gha
          cache-to: type=gha,mode=max
      # Run the tests.
      - run: >-
          mkdir -p ./target && chmod a+rwx ./target
      - name: ${{ matrix.runtime }} run ${{ matrix.lang }} e2e-tests (run as ${{ matrix.run-as }})
        run: >-
          "$CONTAINER_RUNTIME" run --rm $CONTAINER_RUN_ARGS \
            -v $PWD/target:/usr/src/libpathrs/target \
            "$CI_IMAGE" \
              make -C e2e-tests "test-$E2E_LANG"

  e2e-complete:
    needs:
      - e2e-test
      - ctr-e2e-test
    runs-on: ubuntu-latest
    steps:
      - run: echo "End-to-end test CI jobs completed successfully."