name: CRI-O
on:
  push:
    tags:
      - "*"
    branches:
      - master
  pull_request:
jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        suite:
          - e2e
          - critest
        oci-runtime:
          - crun
          # TODO: Re-enable runc integration tests when mitigation is found
          # Disabled due to AppArmor issue in nested environments
          # See: https://github.com/cri-o/cri-o/issues/9573
          # See: https://github.com/opencontainers/runc/issues/4968
          # - runc
        monitor:
          - conmon
          - conmon-rs
    name: ${{matrix.suite}} / ${{matrix.oci-runtime}} / ${{matrix.monitor}}
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout cri-tools
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install go
        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version-file: go.mod

      - name: Setup system
        run: |
          # enable necessary kernel modules
          sudo modprobe br_netfilter
          sudo sysctl -p /etc/sysctl.conf

          # enable necessary sysctls
          sudo sysctl -w net.ipv4.conf.all.route_localnet=1
          sudo sysctl -w net.bridge.bridge-nf-call-iptables=1
          sudo sysctl -w net.ipv4.ip_forward=1
          sudo iptables -t nat -I POSTROUTING -s 127.0.0.0/8 ! -d 127.0.0.0/8 -j MASQUERADE

      - name: Install ginkgo
        run: |
          go install github.com/onsi/ginkgo/v2/ginkgo@latest
          ginkgo version
          sudo cp $(command -v ginkgo) /usr/local/bin

      - name: Install CRI-O
        run: |
          curl https://raw.githubusercontent.com/cri-o/packaging/main/get | sudo bash

      - name: Configure CRI-O
        run: |
          sudo mkdir -p /etc/crio/crio.conf.d
          printf '[crio.runtime]\nlog_level = "debug"\n[crio.image]\nshort_name_mode = "disabled"\n' | sudo tee /etc/crio/crio.conf.d/01-log-level.conf

      - name: Configure CRI-O to use conmon-rs intead of the default conmon
        if: ${{matrix.monitor == 'conmon-rs'}}
        run: |
          sudo sed -i -E 's;(monitor_path = ).*;\1"/usr/libexec/crio/conmonrs"\nruntime_type = "pod";g' /etc/crio/crio.conf.d/10-crio.conf

      - name: Configure CRI-O to use runc instead of the default crun
        if: ${{matrix.oci-runtime == 'runc'}}
        run: |
          sudo sed -i -E 's;(default_runtime = ).*;\1"runc";g' /etc/crio/crio.conf.d/10-crio.conf

      - name: Show the CRI-O config drop-in
        run: cat /etc/crio/crio.conf.d/10-crio.conf

      - name: Start CRI-O
        run: |
          sudo systemctl daemon-reload
          sudo systemctl start crio
          sudo crio status config

      - name: Build cri-tools
        run: |
          make
          sudo -E PATH=$PATH make install

      - name: Run critest
        if: ${{matrix.suite == 'critest'}}
        shell: bash
        run: |
          set -euox pipefail

          set +o errexit
          sudo -E PATH=$PATH critest \
            --runtime-endpoint=unix:///var/run/crio/crio.sock \
            --parallel=$(nproc) \
            --ginkgo.flake-attempts=3 \
            --ginkgo.randomize-all \
            --ginkgo.timeout=2m \
            --ginkgo.trace \
            --ginkgo.vv
          TEST_RC=$?
          set -o errexit

          sudo journalctl --no-pager > journal.log
          test $TEST_RC -ne 0 && cat journal.log
          exit $TEST_RC

      - name: Run crictl e2e tests
        if: ${{matrix.suite == 'e2e'}}
        shell: bash
        run: |
          set -euox pipefail

          set +o errexit
          sudo -E PATH=$PATH make test-e2e \
            TESTFLAGS="-crictl-runtime-endpoint=unix://var/run/crio/crio.sock"
          TEST_RC=$?
          set -o errexit

          sudo journalctl --no-pager > journal.log
          test $TEST_RC -ne 0 && cat journal.log
          exit $TEST_RC

      - name: Upload logs
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: ${{matrix.suite}}-${{matrix.oci-runtime}}-${{matrix.monitor}}-${{github.sha}}.log
          path: journal.log
