build.yml

name: Build
on: [push, pull_request]
env:
  DOCKER_REPOSITORY: ghcr.io/google/grr
jobs:
  test-ubuntu:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: '18'
      - name: Setup Chrome
        uses: browser-actions/setup-chrome@v1
        with:
          chrome-version: stable
      - name: Install server
        run: |
          free -hmw
          lscpu
          sudo apt install -y python3-dev python3-pip python3-venv python3-mysqldb
          python3 -m venv --system-site-packages "${HOME}/INSTALL"
          travis/install.sh
      - name: Run server tests
        run: |
          source "${HOME}/INSTALL/bin/activate"
          pip install pytest-xdist==2.2.1 pytest==6.2.5
          # We have 4 vCPUs available, but only use 3 here to avoid timeouts like
          # https://ci.appveyor.com/project/grr/grr-ia94e/builds/20483467/messages ,
          # which happen when tests stall.
          pytest --verbose -n 3 grr/ --ignore grr/server/grr_response_server/gui/selenium_tests/ --ignore grr/client/grr_response_client/client_actions/windows/
      - name: Install UI dependencies
        run: cd grr/server/grr_response_server/gui/ui && npm ci && cd -
      - name: Run UI tests
        run: cd  grr/server/grr_response_server/gui/ui && npm test && cd -

  build-openapi:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v6
      - name: Install
        run: |
          sudo apt install -y python3-dev python3-pip python3-venv python3-mysqldb
          python3 -m venv --system-site-packages "${HOME}/INSTALL"
          travis/install.sh
      - name: Build
        run: |
          source "${HOME}/INSTALL/bin/activate"
          mkdir -p _openapi_artifacts/openapi_description
          mkdir -p _openapi_artifacts/documentation
          travis/build_api_documentation.sh "_openapi_artifacts/openapi_description/openapi_description.json" "_openapi_artifacts/documentation/openapi_documentation.html"
          ls -la _openapi_artifacts/*
      - name: Upload OpenAPI to GitHub artifacts
        uses: actions/upload-artifact@v6
        with:
          name: openapi
          path: _openapi_artifacts/
          retention-days: 1

  build-ubuntu:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: '3.9'
      - name: Set up
        run: |
          sudo apt install fakeroot debhelper libffi-dev libssl-dev
          pip install virtualenv
          virtualenv "${HOME}/INSTALL"
      - name: Build
        run: |
          travis/install_client_builder.sh
          travis/build_templates.sh
          ls -la installers_dir
      - name: Upload installers to GitHub artifacts
        uses: actions/upload-artifact@v6
        with:
          name: ubuntu-installers
          path: installers_dir/
          retention-days: 1

  build-centos:
    runs-on: ubuntu-22.04
    env:
      DOCKER_IMG: grrdocker/centos7-python39
      DOCKER_CONTAINER: centos_64bit_container
      DOCKER_USER: grrbot
    steps:
      - uses: actions/checkout@v6
      - name: Build installers
        run: |
          docker run -dit \
            --volume "${PWD}:/mnt/grr" \
            --workdir /mnt/grr \
            --env DOCKER_USER="${DOCKER_USER}" \
            --env TRAVIS_OS_NAME="linux" \
            --name "${DOCKER_CONTAINER}" \
            "${DOCKER_IMG}"
          # Using `bash -l` here and below to make sure devtools
          # (including the C++ 14 compatible compiler) are properly
          # registered in the environment variables.
          docker exec "${DOCKER_CONTAINER}" bash -l travis/set_up_test_user.sh
          docker exec --user "${DOCKER_USER}" "${DOCKER_CONTAINER}" bash -l -c '/usr/local/bin/python3.9 -m venv "/home/${DOCKER_USER}/INSTALL"'
          docker exec --user "${DOCKER_USER}" "${DOCKER_CONTAINER}" bash -l travis/install_client_builder.sh
          docker exec --user "${DOCKER_USER}" "${DOCKER_CONTAINER}" bash -l travis/build_templates.sh
          docker exec "${DOCKER_CONTAINER}" rpm -vih installers_dir/*.rpm
          ls -la installers_dir
      - name: Upload installers to GitHub artifacts
        uses: actions/upload-artifact@v6
        with:
          name: centos-installers
          path: installers_dir/
          retention-days: 1

  build-windows:
    runs-on: windows-2022
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: '3.9'
      - name: Build installers
        shell: bash
        run: |
          set -ex
          pip install virtualenv wheel
          python -u appveyor/windows_templates/build_windows_templates.py --grr_src=$GITHUB_WORKSPACE --output_dir=$GITHUB_WORKSPACE/output --test_repack_install
          mkdir -p installers_dir
          mv -v output*/* installers_dir
          ls -la installers_dir
      - name: Upload installers to GitHub artifacts
        uses: actions/upload-artifact@v6
        with:
          name: windows-installers
          path: installers_dir/
          retention-days: 1

  build-docker-image:
    runs-on: ubuntu-22.04
    permissions:
      contents: 'read'
    needs:
      - build-centos
      - build-ubuntu
      - build-windows
    steps:
      - uses: actions/checkout@v6
      - name: Download installers from GitHub artifacts
        id: download
        uses: actions/download-artifact@v7
        with:
          pattern: '*installer*'
          path: _installers
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.DOCKER_REPOSITORY }}
      - name: Build and export
        uses: docker/build-push-action@v5
        with:
          context: .
          file: Dockerfile
          # Temporarily add a `testing`-tag to identify this image
          # for testing, tag is removed again before uploading to
          # github container registry.
          tags: |
            ${{ env.DOCKER_REPOSITORY }}:testing
            ${{ steps.meta.outputs.tags }}
          outputs: type=docker,dest=/tmp/grr_base_image.tar
      - name: Upload docker image
        uses: actions/upload-artifact@v6
        with:
          name: grr_base_image
          path: /tmp/grr_base_image.tar
          retention-days: 3

  docker-compose-e2e-test:
    permissions:
      contents: 'read'
    runs-on: ubuntu-22.04
    needs:
      - build-docker-image
    steps:
      - uses: actions/checkout@v6
      - name: Download artifact
        uses: actions/download-artifact@v7
        with:
          name: grr_base_image
          path: /tmp
      - name: Load image
        run: |
          docker load --input /tmp/grr_base_image.tar
      - name: Start docker compose stack
        shell: bash
        run: |
          docker_config_files/init_certs.sh
          docker compose \
            -f compose.yaml \
            -f compose.testing.yaml \
            up -d --wait
      - name: Test
        shell: bash
        run: |
          docker compose exec grr-client bash /configs/client/create_fake_user.sh
          docker run \
            --add-host=host.docker.internal:host-gateway \
            -v $(pwd):/github_workspace \
            -v ./docker_config_files:/configs \
            -w /github_workspace \
            --entrypoint appveyor/e2e_tests/run_docker_compose_e2e_test.sh \
            ${{ env.DOCKER_REPOSITORY }}:testing \
            $(docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' grr-client)
      - name: Dump docker compose log output
        if: always()
        shell: bash
        run: |
          docker compose logs > /tmp/docker_compose_test.log
      - name: Upload docker compose logs
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: docker_commpose_test_logs
          path: /tmp/docker_compose_test.log
          retention-days: 3
      - name: Stop the docker compose stack
        if: always()
        shell: bash
        run: |
          docker compose down --volumes

  push-docker-image:
    if: ${{ github.event_name == 'push' }}
    env:
      REGISTRY: ghcr.io
    permissions:
      packages: write
      contents: write
    runs-on: ubuntu-22.04
    needs:
      - test-ubuntu
      - docker-compose-e2e-test
    steps:
      - uses: actions/checkout@v6
      - name: Download artifact
        uses: actions/download-artifact@v7
        with:
          name: grr_base_image
          path: /tmp
      - name: Load image
        run: |
          docker load --input /tmp/grr_base_image.tar
      - name: Login to GitHub Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Push Docker image
        run: |
          # Remove the tag used to identify the image for testing again.
          docker rmi ${{ env.DOCKER_REPOSITORY }}:testing
          docker push --all-tags ${{ env.DOCKER_REPOSITORY }}