ci.yaml

name: CI

on:
  pull_request:
  merge_group:
    types: [checks_requested]
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  changes:
    name: Detect changed paths
    runs-on: depot-ubuntu-24.04
    permissions:
      contents: read
      pull-requests: read
    outputs:
      go: ${{ steps.merge_group_defaults.outputs.go || steps.filter.outputs.go }}
      workflows: ${{ steps.merge_group_defaults.outputs.workflows || steps.filter.outputs.workflows }}
      publish: ${{ steps.merge_group_defaults.outputs.publish || steps.filter.outputs.publish }}
      terraform: ${{ steps.merge_group_defaults.outputs.terraform || steps.filter.outputs.terraform }}
      e2e: ${{ steps.merge_group_defaults.outputs.e2e || steps.filter.outputs.e2e }}
      installer: ${{ steps.merge_group_defaults.outputs.installer || steps.filter.outputs.installer }}
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          # Required so paths-filter can diff push events using github.event.before without fetching.
          fetch-depth: 0
          persist-credentials: false

      - name: Set merge-group defaults
        if: github.event_name == 'merge_group'
        id: merge_group_defaults
        run: |
          {
            echo "go=true"
            echo "workflows=true"
            echo "publish=false"
            echo "terraform=true"
            echo "e2e=true"
            echo "installer=true"
          } >> "$GITHUB_OUTPUT"

      - name: Detect changed paths
        if: github.event_name != 'merge_group'
        id: filter
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        with:
          filters: |
            go:
              - '**/*.go'
              - 'go.mod'
              - 'go.sum'
              - 'vendor/**'
              - 'Makefile'
              - '.golangci.yml'
              - '.golangci.yaml'
              - 'hack/update-reference-docs.sh'
              - 'hack/crd-ref-docs/**'
              - 'docs/reference/api/**'
            workflows:
              - '.github/workflows/**'
              - '.github/actionlint.yaml'
              - '.github/actionlint.yml'
            publish:
              - '**/*.go'
              - 'go.mod'
              - 'go.sum'
              - 'vendor/**'
              - '.goreleaser.yaml'
              - 'Dockerfile*'
              - 'Dockerfile.goreleaser'
            terraform:
              - 'terraform/**'
              - '.github/workflows/ci.yaml'
            # Pre-queue route for the full Kind E2E (#113; trigger choice is a maintainer-desk decision).
            e2e:
              - 'api/aggregation/**'
              - 'internal/aggregated/**'
              - 'internal/app/apiserverapp/**'
              - 'config/e2e/**'
              - 'deploy/**'
              - 'examples/cloudnativepg/**'
              - 'hack/e2e-workspace-lifecycle*.sh'
              - '.github/workflows/ci.yaml'
            installer:
              - 'api/**/*.go'
              - 'config/crd/bases/**'
              - 'config/rbac/**'
              - 'config/default/**'
              - 'deploy/deployment.yaml'
              - 'hack/update-manifests.sh'
              - 'Makefile'
              - 'dist/install.yaml'
              - '.github/workflows/ci.yaml'

  lint:
    needs: changes
    if: github.event_name == 'merge_group' || ((needs.changes.outputs.go == 'true' || needs.changes.outputs.installer == 'true') && (github.event_name != 'push' || github.actor != 'github-merge-queue[bot]'))
    runs-on: depot-ubuntu-24.04-8
    timeout-minutes: 20
    env:
      GOFLAGS: -mod=vendor
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Verify vendor is up to date
        run: |
          go mod tidy
          go mod vendor
          git diff --exit-code -- go.mod go.sum vendor/

      - name: Verify API reference docs are up to date
        run: |
          bash ./hack/update-reference-docs.sh
          git diff --exit-code -- docs/reference/api/

      - name: Verify installer manifests are up to date
        run: |
          make build-installer
          git diff --exit-code -- dist/install.yaml config/default/ config/crd/bases/ config/rbac/

          UNTRACKED_GENERATED="$(git ls-files --others --exclude-standard -- dist/ config/default/ config/crd/bases/ config/rbac/)"
          if [[ -n "${UNTRACKED_GENERATED}" ]]; then
            echo "assertion failed: generated installer artifacts must be tracked" >&2
            printf '%s\n' "${UNTRACKED_GENERATED}" >&2
            exit 1
          fi

      - name: Run golangci-lint
        run: go tool golangci-lint run --timeout=5m ./...

      - name: Run golangci-lint formatter checks
        run: go tool golangci-lint fmt --diff

      - name: Run govulncheck
        run: go tool govulncheck ./...

  scan-fs:
    name: Trivy filesystem scan
    needs: changes
    if: github.event_name == 'merge_group' || ((needs.changes.outputs.go == 'true' || needs.changes.outputs.workflows == 'true') && (github.event_name != 'push' || github.actor != 'github-merge-queue[bot]'))
    runs-on: depot-ubuntu-24.04-8
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          persist-credentials: false

      - name: Trivy filesystem scan
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
        with:
          version: v0.74.0
          scan-type: fs
          scan-ref: .
          skip-dirs: vendor
          severity: HIGH,CRITICAL
          exit-code: '1'

  test:
    needs: changes
    if: github.event_name == 'merge_group' || (needs.changes.outputs.go == 'true' && (github.event_name != 'push' || github.actor != 'github-merge-queue[bot]'))
    runs-on: depot-ubuntu-24.04-8
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Verify vendor is up to date
        run: |
          go mod tidy
          go mod vendor
          git diff --exit-code -- go.mod go.sum vendor/

      - name: Setup envtest assets
        env:
          GOFLAGS: -mod=vendor
        run: |
          KUBEBUILDER_ASSETS_PATH="$(go run ./vendor/sigs.k8s.io/controller-runtime/tools/setup-envtest use 1.35.x --bin-dir "${{ github.workspace }}/bin/envtest" -p path)"
          echo "KUBEBUILDER_ASSETS=${KUBEBUILDER_ASSETS_PATH}" >> "$GITHUB_ENV"

      - name: Run tests
        env:
          GOFLAGS: -mod=vendor
          KUBEBUILDER_ASSETS: ${{ env.KUBEBUILDER_ASSETS }}
        run: go test ./... -count=1

      - name: Build
        env:
          GOFLAGS: -mod=vendor
        run: go build ./...

  e2e-kind:
    name: E2E (Kind + CNPG + Templates)
    needs: [changes, test]
    # test may be skipped when only E2E paths changed; it must never have failed or been cancelled.
    if: |
      !cancelled() &&
      needs.changes.result == 'success' &&
      (needs.test.result == 'success' || needs.test.result == 'skipped') &&
      (needs.changes.outputs.go == 'true' || needs.changes.outputs.e2e == 'true') &&
      (github.event_name != 'push' || github.actor != 'github-merge-queue[bot]')
    runs-on: depot-ubuntu-24.04-8
    timeout-minutes: 60
    env:
      # Full E2E runs in the merge queue, on push to main, and on pull requests that touch
      # aggregated-API/E2E paths (pre-queue route, #113). It uses no secrets and publishes nothing.
      E2E_FULL: ${{ github.event_name != 'pull_request' || needs.changes.outputs.e2e == 'true' }}
      # Chosen E2E backend fixture, independent of the vendored codersdk version; the lifecycle driver
      # fails before any mutation unless Coder reports E2E_EXPECT_CODER_VERSION.
      CODER_E2E_IMAGE: ghcr.io/coder/coder:v2.37.2@sha256:6ea19b670111ff133fa214e2cb974e7b4e32fc4c65738ac5a918703d12d70f77
      E2E_EXPECT_CODER_VERSION: v2.37.2
    steps:
      # ---- PR fast-path: skip heavy E2E on pull requests without E2E-relevant changes ----
      - name: Skip full E2E on pull requests
        if: env.E2E_FULL != 'true'
        run: |
          echo "::notice::Skipping full E2E on ${GITHUB_EVENT_NAME}; no aggregated-API/E2E paths changed. Runs in merge queue and on push to main."

      # ---- Full CNPG + Templates E2E (merge queue + push + E2E-relevant pull requests) ----
      - name: Checkout
        if: env.E2E_FULL == 'true'
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          # Pull requests test the exact PR head, not the synthetic merge commit; other events keep the default ref.
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || '' }}
          persist-credentials: false

      - name: Record source SHA
        id: source
        if: env.E2E_FULL == 'true'
        run: |
          source_sha="$(git rev-parse HEAD)"
          echo "Source SHA: ${source_sha}"
          echo "sha=${source_sha}" >> "$GITHUB_OUTPUT"

      - name: Offline workspace lifecycle driver tests
        if: env.E2E_FULL == 'true'
        run: bash ./hack/e2e-workspace-lifecycle_test.sh

      - name: Setup Go
        if: env.E2E_FULL == 'true'
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Create Kind cluster
        if: env.E2E_FULL == 'true'
        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
        with:
          cluster_name: e2e

      - name: Build binary
        if: env.E2E_FULL == 'true'
        env:
          GOFLAGS: -mod=vendor
          CGO_ENABLED: "0"
          GOOS: linux
          GOARCH: amd64
        run: |
          mkdir -p linux/amd64
          go build -o linux/amd64/coder-k8s ./

      - name: Build and load image
        id: build_image
        if: env.E2E_FULL == 'true'
        run: |
          docker build -f Dockerfile.goreleaser -t ghcr.io/coder/coder-k8s:e2e .
          image_id="$(docker image inspect --format '{{.Id}}' ghcr.io/coder/coder-k8s:e2e)"
          echo "Built image ID: ${image_id}"
          echo "image_id=${image_id}" >> "$GITHUB_OUTPUT"
          kind load docker-image ghcr.io/coder/coder-k8s:e2e --name e2e

      - name: Apply namespace, CRDs, and RBAC
        if: env.E2E_FULL == 'true'
        run: |
          kubectl apply -f config/e2e/namespace.yaml
          kubectl apply -f config/crd/bases/
          kubectl apply -f config/rbac/

      - name: Enable aggregated API server
        if: env.E2E_FULL == 'true'
        run: |
          kubectl apply -f deploy/apiserver-service.yaml
          kubectl apply -f deploy/apiserver-apiservice.yaml

      - name: Deploy coder-k8s (controller + aggregated API server)
        if: env.E2E_FULL == 'true'
        run: kubectl apply -f config/e2e/deployment.yaml

      - name: Wait for operator and APIService
        if: env.E2E_FULL == 'true'
        run: |
          kubectl wait --for=condition=Available deploy/coder-k8s -n coder-system --timeout=120s
          kubectl wait --for=condition=Available apiservice/v1alpha1.aggregation.coder.com --timeout=180s

      # The aggregated API server sets the APIService caBundle from its CA Secret and turns
      # insecureSkipTLSVerify off shortly after it starts. kube-apiserver's Available check does
      # not verify the serving certificate, so the proof is a request proxied with verification on.
      - name: Verify the APIService trusts the serving CA
        if: env.E2E_FULL == 'true'
        run: |
          set -euo pipefail
          apisvc=apiservice/v1alpha1.aggregation.coder.com
          want="" have="" insecure=""
          for _ in $(seq 1 60); do
            want=$(kubectl -n coder-system get secret coder-k8s-apiserver-tls -o jsonpath='{.data.ca\.crt}' 2>/dev/null || true)
            have=$(kubectl get "$apisvc" -o jsonpath='{.spec.caBundle}')
            insecure=$(kubectl get "$apisvc" -o jsonpath='{.spec.insecureSkipTLSVerify}')
            if [[ -n $want && $have == "$want" && -z $insecure ]]; then
              break
            fi
            sleep 2
          done
          if [[ -z $want || $have != "$want" || -n $insecure ]]; then
            echo "assertion failed: APIService caBundle does not match the serving CA Secret (insecureSkipTLSVerify='$insecure')" >&2
            kubectl get "$apisvc" -o yaml >&2
            exit 1
          fi
          kubectl wait --for=condition=Available "$apisvc" --timeout=180s
          for _ in $(seq 1 30); do
            kubectl get --raw /apis/aggregation.coder.com/v1alpha1 >/dev/null && break
            sleep 2
          done
          kubectl get --raw /apis/aggregation.coder.com/v1alpha1 >/dev/null

      - name: Install CloudNativePG operator
        if: env.E2E_FULL == 'true'
        run: |
          kubectl apply --server-side -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/v1.25.0/releases/cnpg-1.25.0.yaml
          kubectl wait --for=condition=Available deploy/cnpg-controller-manager -n cnpg-system --timeout=180s

      - name: Provision PostgreSQL and CoderControlPlane
        if: env.E2E_FULL == 'true'
        run: |
          kubectl apply -f examples/cloudnativepg/00-namespace.yaml -f examples/cloudnativepg/cnpg-cluster.yaml
          # E2E backend fixture: pin the Coder image and allow the out-of-band rename used by the lifecycle driver.
          kubectl create --dry-run=client -o json -f examples/cloudnativepg/codercontrolplane.yaml |
            jq --arg image "$CODER_E2E_IMAGE" \
              '.spec.image = $image | .spec.extraEnv += [{name: "CODER_ALLOW_WORKSPACE_RENAMES", value: "true"}]' |
            kubectl apply -f -

      - name: Wait for PostgreSQL
        if: env.E2E_FULL == 'true'
        run: kubectl -n coder wait --for=condition=Ready cluster/coder-db --timeout=600s

      - name: Wait for Coder deployment
        if: env.E2E_FULL == 'true'
        run: kubectl -n coder rollout status deployment/coder --timeout=600s

      - name: Wait for CoderControlPlane readiness
        if: env.E2E_FULL == 'true'
        run: |
          kubectl -n coder wait --for=jsonpath='{.status.phase}'=Ready codercontrolplane/coder --timeout=600s
          kubectl -n coder wait --for=jsonpath='{.status.operatorAccessReady}'=true codercontrolplane/coder --timeout=600s

      # The example is applied before CloudNativePG creates coder-db-app, so this
      # also covers the control-plane-before-Secret path.
      - name: Verify database Secret reference
        if: env.E2E_FULL == 'true'
        run: |
          kubectl -n coder wait --for=condition=DatabaseSecretResolved codercontrolplane/coder --timeout=120s
          REASON=$(kubectl -n coder get codercontrolplane coder -o jsonpath='{.status.conditions[?(@.type=="DatabaseSecretResolved")].reason}')
          test "$REASON" = "Resolved"
          # Exactly one CODER_PG_CONNECTION_URL, injected by Secret reference with no literal value.
          kubectl -n coder get deployment coder -o json |
            jq -e '[.spec.template.spec.containers[] | select(.name == "coder") | .env[]? | select(.name == "CODER_PG_CONNECTION_URL")] as $pg
              | ($pg | length) == 1
              and ($pg[0] | has("value") | not)
              and $pg[0].valueFrom.secretKeyRef == {"name": "coder-db-app", "key": "uri"}'

      - name: Verify operator token secret
        if: env.E2E_FULL == 'true'
        run: |
          TOKEN_SECRET=$(kubectl -n coder get codercontrolplane coder -o jsonpath='{.status.operatorTokenSecretRef.name}')
          test -n "$TOKEN_SECRET"
          kubectl -n coder get secret "$TOKEN_SECRET"

      # Delegated authentication/authorization of the aggregated API server:
      # RBAC via kube-apiserver for a non-admin identity, and direct requests to
      # port 6443 from another pod (anonymous, forged front-proxy headers, and a
      # ServiceAccount token without RBAC) are rejected. MCP is not served in --app=all.
      - name: Verify aggregated API authentication and authorization
        if: env.E2E_FULL == 'true'
        env:
          PROBE_IMAGE: curlimages/curl:8.16.0@sha256:463eaf6072688fe96ac64fa623fe73e1dbe25d8ad6c34404a669ad3ce1f104b6
        run: |
          set -euo pipefail
          kubectl -n coder create serviceaccount e2e-reader
          kubectl -n coder create role e2e-template-reader --verb=get,list --resource=codertemplates.aggregation.coder.com
          kubectl -n coder create rolebinding e2e-template-reader --role=e2e-template-reader --serviceaccount=coder:e2e-reader
          reader=(--as=system:serviceaccount:coder:e2e-reader)
          kubectl "${reader[@]}" -n coder get codertemplates.aggregation.coder.com
          expect_forbidden() {
            local out
            if out=$("$@" 2>&1); then
              echo "expected Forbidden, command succeeded: $*" >&2
              return 1
            fi
            grep -q Forbidden <<<"$out" || { echo "expected Forbidden, got: $out" >&2; return 1; }
          }
          expect_forbidden kubectl "${reader[@]}" -n default get codertemplates.aggregation.coder.com
          expect_forbidden kubectl "${reader[@]}" -n coder get coderworkspaces.aggregation.coder.com
          expect_forbidden kubectl "${reader[@]}" -n coder delete codertemplates.aggregation.coder.com coder.e2e-authz-probe --dry-run=server

          kubectl -n default run e2e-authn-probe --image="$PROBE_IMAGE" --restart=Never --command -- sleep 600
          kubectl -n default wait --for=condition=Ready pod/e2e-authn-probe --timeout=180s
          probe() { kubectl -n default exec e2e-authn-probe -- sh -c "$1"; }
          api=https://coder-k8s-apiserver.coder-system.svc
          list="$api/apis/aggregation.coder.com/v1alpha1/namespaces/coder/codertemplates"
          code() { probe "curl -sk -o /dev/null -w '%{http_code}' $1"; }
          test "$(code "$list")" = 401
          test "$(code "-H 'X-Remote-User: kubernetes-admin' -H 'X-Remote-Group: system:masters' $list")" = 401
          test "$(code "-H \"Authorization: Bearer \$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)\" $list")" = 403
          test "$(code "$api/healthz")" = 200
          pod_ip=$(kubectl -n coder-system get pod -l app=coder-k8s -o jsonpath='{.items[0].status.podIP}')
          test -n "$pod_ip" || { echo "could not read the coder-k8s pod IP" >&2; exit 1; }
          # MCP must not listen on the pod network: only "connection refused" (curl exit 7) passes.
          # Any other result, including success or a timeout (28), fails.
          mcp_rc=0
          probe "curl -s --max-time 5 http://$pod_ip:8090/healthz" || mcp_rc=$?
          if [ "$mcp_rc" -ne 7 ]; then
            echo "MCP port check: want connection refused (curl exit 7) from $pod_ip:8090, got exit $mcp_rc" >&2
            exit 1
          fi
          kubectl -n default delete pod e2e-authn-probe --wait=false

      # The driver creates the CoderTemplate itself (kubectl apply of config/e2e/codertemplate.yaml) after its setup checks.
      - name: Template and workspace lifecycle (apply, re-apply, watch, rename, delete, recreate)
        if: env.E2E_FULL == 'true'
        env:
          BUILT_IMAGE_ID: ${{ steps.build_image.outputs.image_id }}
          E2E_SOURCE_SHA: ${{ steps.source.outputs.sha }}
          E2E_WORKDIR: ${{ runner.temp }}/workspace-lifecycle
        run: bash ./hack/e2e-workspace-lifecycle.sh

      # Last functional step: with the sync's permission revoked (so it cannot repair the value),
      # a wrong caBundle makes requests proxied by kube-apiserver fail, and kube-apiserver logs the
      # x509 error (its Available check does not verify certificates). Restoring the permission
      # lets the sync put the right CA back.
      - name: Verify the APIService rejects a wrong CA
        if: env.E2E_FULL == 'true'
        run: |
          set -euo pipefail
          apisvc=apiservice/v1alpha1.aggregation.coder.com
          can_patch() {
            kubectl auth can-i patch apiservices.apiregistration.k8s.io/v1alpha1.aggregation.coder.com \
              --as=system:serviceaccount:coder-system:coder-k8s 2>/dev/null || true
          }
          kubectl delete clusterrolebinding coder-k8s-apiservice-cabundle
          for _ in $(seq 1 30); do
            [[ $(can_patch) == no ]] && break
            sleep 1
          done
          test "$(can_patch)" = no
          wrong=$(openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -keyout /dev/null \
            -days 1 -subj /CN=e2e-wrong-ca 2>/dev/null | base64 -w0)
          since=$(date -u +%Y-%m-%dT%H:%M:%SZ)
          kubectl patch "$apisvc" --type=merge -p "{\"spec\":{\"caBundle\":\"$wrong\"}}"
          for _ in $(seq 1 30); do
            kubectl get --raw /apis/aggregation.coder.com/v1alpha1 >/dev/null 2>&1 || break
            sleep 1
          done
          if kubectl get --raw /apis/aggregation.coder.com/v1alpha1 >/dev/null; then
            echo "assertion failed: aggregated API still served with a wrong caBundle" >&2
            exit 1
          fi
          x509=""
          for _ in $(seq 1 30); do
            x509=$(kubectl -n kube-system logs -l component=kube-apiserver --since-time="$since" --tail=-1 |
              grep 'v1alpha1.aggregation.coder.com' | grep -m1 'x509: certificate signed by unknown authority' || true)
            [[ -n $x509 ]] && break
            sleep 2
          done
          echo "${x509:?assertion failed: kube-apiserver logged no x509 error for the wrong caBundle}"
          kubectl apply -f config/rbac/apiservice-cabundle-role.yaml
          want=$(kubectl -n coder-system get secret coder-k8s-apiserver-tls -o jsonpath='{.data.ca\.crt}')
          for _ in $(seq 1 90); do
            [[ $(kubectl get "$apisvc" -o jsonpath='{.spec.caBundle}') == "$want" ]] &&
              kubectl get --raw /apis/aggregation.coder.com/v1alpha1 >/dev/null 2>&1 && break
            sleep 2
          done
          test "$(kubectl get "$apisvc" -o jsonpath='{.spec.caBundle}')" = "$want"
          kubectl get --raw /apis/aggregation.coder.com/v1alpha1 >/dev/null

      # ---- Failure diagnostics ----
      - name: Dump cluster state on failure
        if: failure() && env.E2E_FULL == 'true'
        run: |
          echo "=== Pods (all namespaces) ==="
          kubectl get pods -A || true
          echo ""
          echo "=== APIService ==="
          kubectl describe apiservice v1alpha1.aggregation.coder.com || true
          echo ""
          echo "=== coder-k8s logs ==="
          kubectl -n coder-system logs deploy/coder-k8s --tail=200 || true
          echo ""
          echo "=== CoderControlPlane ==="
          kubectl -n coder describe codercontrolplane coder || true
          echo ""
          echo "=== Coder deployment logs ==="
          kubectl -n coder logs deploy/coder --tail=200 || true
          echo ""
          echo "=== CNPG controller logs ==="
          kubectl -n cnpg-system logs deploy/cnpg-controller-manager --tail=200 || true
          echo ""
          echo "=== Workspace lifecycle driver files ==="
          tail -n 50 "$RUNNER_TEMP"/workspace-lifecycle/*.err "$RUNNER_TEMP"/workspace-lifecycle/*.log || true

  image-scan:
    name: Trivy image scan
    needs: changes
    if: github.event_name == 'merge_group' || (needs.changes.outputs.publish == 'true' && (github.event_name != 'push' || github.actor != 'github-merge-queue[bot]'))
    runs-on: depot-ubuntu-24.04-8
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Build linux/amd64 binary for image
        env:
          GOFLAGS: -mod=vendor
          CGO_ENABLED: "0"
          GOOS: linux
          GOARCH: amd64
        run: |
          mkdir -p linux/amd64
          go build -o linux/amd64/coder-k8s ./

      - name: Build local image
        run: docker build -f Dockerfile.goreleaser -t coder-k8s:scan .

      - name: Trivy image scan
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
        with:
          version: v0.74.0
          scan-type: image
          image-ref: coder-k8s:scan
          severity: HIGH,CRITICAL
          exit-code: '1'

  terraform:
    name: Terraform (fmt/validate/tflint/trivy)
    needs: changes
    if: github.event_name == 'merge_group' || (needs.changes.outputs.terraform == 'true' && (github.event_name != 'push' || github.actor != 'github-merge-queue[bot]'))
    runs-on: depot-ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          persist-credentials: false

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
        with:
          terraform_version: 1.14.4

      - name: terraform fmt (check)
        working-directory: terraform
        run: terraform fmt -check -diff -recursive

      - name: terraform init (backend disabled)
        working-directory: terraform
        run: terraform init -backend=false -lockfile=readonly -input=false

      - name: terraform validate
        working-directory: terraform
        run: terraform validate -no-color

      - name: Setup TFLint
        uses: terraform-linters/setup-tflint@4cb9feea73331a35b422df102992a03a44a3bb33 # v6.2.1
        with:
          tflint_version: v0.61.0

      - name: tflint
        working-directory: terraform
        run: |
          tflint --init
          tflint --recursive

      - name: Trivy config scan (Terraform)
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
        with:
          version: v0.74.0
          scan-type: config
          scan-ref: terraform/
          trivyignores: terraform/.trivyignore
          severity: HIGH,CRITICAL
          exit-code: '1'

  lint-actions:
    name: Lint GitHub Actions
    needs: changes
    if: github.event_name == 'merge_group' || (needs.changes.outputs.workflows == 'true' && (github.event_name != 'push' || github.actor != 'github-merge-queue[bot]'))
    runs-on: depot-ubuntu-24.04
    permissions:
      contents: read
    env:
      GOFLAGS: -mod=vendor
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Run actionlint
        run: go tool actionlint

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
        with:
          advanced-security: false
          online-audits: false
          inputs: .github/workflows

  codex-comments:
    name: Codex Comments
    if: github.event_name == 'pull_request'
    runs-on: depot-ubuntu-24.04
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Run helper regression tests
        run: make test-scripts

      - name: Check unresolved Codex comments
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./scripts/check_codex_comments.sh ${{ github.event.pull_request.number }}

  publish-main:
    name: Publish GHCR :main
    needs: [changes, test, lint, scan-fs, lint-actions, e2e-kind, image-scan, terraform]
    if: |
      always() &&
      github.event_name == 'push' &&
      github.ref == 'refs/heads/main' &&
      needs.changes.outputs.publish == 'true' &&
      (needs.test.result == 'success' || needs.test.result == 'skipped') &&
      (needs.lint.result == 'success' || needs.lint.result == 'skipped') &&
      (needs.scan-fs.result == 'success' || needs.scan-fs.result == 'skipped') &&
      (needs.lint-actions.result == 'success' || needs.lint-actions.result == 'skipped') &&
      (needs.e2e-kind.result == 'success' || needs.e2e-kind.result == 'skipped') &&
      (needs.image-scan.result == 'success' || needs.image-scan.result == 'skipped') &&
      (needs.terraform.result == 'success' || needs.terraform.result == 'skipped')
    runs-on: depot-ubuntu-24.04-8
    timeout-minutes: 30
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: go.mod
          cache: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Prepare local main tag
        id: prepare-main-tag
        # GoReleaser validates that its current tag points at HEAD. Never push this tag.
        run: git tag --force v0.0.0-main HEAD

      - name: Run GoReleaser (:main)
        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
        with:
          distribution: goreleaser
          version: "~> v2"
          args: release --clean --skip=announce
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GORELEASER_CURRENT_TAG: v0.0.0-main
          GORELEASER_CHANNEL: main

      - name: Trivy image scan (:main)
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
        with:
          version: v0.74.0
          scan-type: image
          image-ref: ghcr.io/coder/coder-k8s:main
          severity: HIGH,CRITICAL
          exit-code: '1'