pr-operator.yml

name: pr-operator
on:
  workflow_call:
    inputs:
      OPERATOR_SDK_VERSION:
        description: "Version of Operator SDK Binary for installation"
        # renovate: datasource=github-releases depName=operator-framework/operator-sdk
        default: "v1.42.2"
        required: false
        type: string
      BUILD_PLATFORMS:
        description: 'Comma separated list of targets for builds e.g. "linux/amd64,linux/arm64,linux/ppc64le,linux/s390x"'
        default: "linux/amd64,linux/arm64,linux/ppc64le,linux/s390x"
        required: false
        type: string
      GO_VERSION:
        description: "Go version to use"
        # renovate: datasource=golang-version depName=go
        default: "1.21"
        required: false
        type: string
      RUN_UNIT_TESTS:
        description: "Run unit tests will run the test target in the Makefile"
        default: false
        required: false
        type: boolean
      RUN_INTEGRATION_TESTS:
        description: "Run integration tests will run the integration target in the Makefile"
        default: false
        required: false
        type: boolean
      RUN_HELMCHART_TEST:
        description: "Run helmchart test will run the helmchart-test target in the Makefile"
        default: false
        required: false
        type: boolean
      CHECKOUT_CODE:
        description: "Repository to checkout"
        default: "${{ github.repository }}"
        required: false
        type: string
      KUBECTL_WAIT_TIMEOUT:
        description: "kubectl wait timeout used for integration and helmchart-test targets in the Makefile (e.g. 5m)"
        default: "5m"
        required: false
        type: string
env:
  DEFAULT_BUNDLE_VERSION: "0.0.1"
  DEFAULT_BUNDLE_CHANNEL: "alpha"
  DEFAULT_OPERATOR_VERSION: "latest"
  DEFAULT_HELMCHART_VERSION: "v0.0.1"
  HELM_REPO_DIR: "./tmp/gh-pages"

jobs:
  setup:
    runs-on: ubuntu-latest
    name: setup
    steps:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: ${{ inputs.CHECKOUT_CODE }}

      - name: Setting Workflow Variables
        id: set-variables
        env:
          BUILD_PLATFORMS: ${{ inputs.BUILD_PLATFORMS }}
          CHECKOUT_CODE: ${{ inputs.CHECKOUT_CODE }}
        run: |
          echo "repository_name=$(basename ${{ env.CHECKOUT_CODE }})" >> $GITHUB_OUTPUT
          echo "bin_dir=$(pwd)/bin" >> $GITHUB_OUTPUT

          # Create Distribution Matrix
          echo "dist_matrix=$(echo -n "${{ env.BUILD_PLATFORMS }}" | jq -csR '. | split(",")')" >> $GITHUB_OUTPUT
          # Create Image Tags
          echo "image_platform_tags=$(echo $BUILD_PLATFORMS | sed  -e 's/,/ /g' -e 's/\//-/g')" >> $GITHUB_OUTPUT

          echo "$(cat ${GITHUB_OUTPUT})"

      - name: Setting Image Variables
        id: set-variables-image
        run: |
          if [ "${{ secrets.OPERATOR_IMAGE_REPOSITORY }}" == "" ]; then
            echo "operator_image_repository_name=${{ steps.set-variables.outputs.repository_name }}" >> $GITHUB_OUTPUT
            echo "operator_image_registry=quay.io/$(dirname $GITHUB_REPOSITORY)" >> $GITHUB_OUTPUT
          else
            OPERATOR_IMAGE_REPOSITORY="${{ secrets.OPERATOR_IMAGE_REPOSITORY }}"
            echo "operator_image_repository_name=${OPERATOR_IMAGE_REPOSITORY##*/}" >> $GITHUB_OUTPUT
            echo "operator_image_registry=${OPERATOR_IMAGE_REPOSITORY%/*}" >> $GITHUB_OUTPUT
          fi

          if [ "${{ secrets.BUNDLE_IMAGE_REPOSITORY }}" == "" ]; then
            echo "bundle_image_repository_name=${{ steps.set-variables.outputs.repository_name }}-bundle" >> $GITHUB_OUTPUT
            echo "bundle_image_registry=quay.io/$(dirname $GITHUB_REPOSITORY)" >> $GITHUB_OUTPUT

          else
            BUNDLE_IMAGE_REPOSITORY="${{ secrets.BUNDLE_IMAGE_REPOSITORY }}"
            echo "bundle_image_repository_name=${BUNDLE_IMAGE_REPOSITORY##*/}" >> $GITHUB_OUTPUT
            echo "bundle_image_registry=${BUNDLE_IMAGE_REPOSITORY%/*}" >> $GITHUB_OUTPUT
          fi

          # Set versions based on presence of tag
          if [[ "${{ github.ref }}" =~ ^refs/tags/ ]]; then
            TAG="${GITHUB_REF/refs\/tags\//}"
            echo "tag_event=true" >> $GITHUB_OUTPUT
            echo "operator_version=$TAG" >> $GITHUB_OUTPUT
            echo "bundle_version=${TAG:1}" >> $GITHUB_OUTPUT
            echo "helmchart_version=$TAG" >> $GITHUB_OUTPUT
          else
            echo "tag_event=false" >> $GITHUB_OUTPUT
            echo "operator_version=$DEFAULT_OPERATOR_VERSION" >> $GITHUB_OUTPUT
            echo "bundle_version=$DEFAULT_BUNDLE_VERSION" >> $GITHUB_OUTPUT
            echo "helmchart_version=$DEFAULT_HELMCHART_VERSION" >> $GITHUB_OUTPUT
          fi

          echo "$(cat ${GITHUB_OUTPUT})"

      - name: Verify Semver Bundle Version
        uses: rubenesp87/semver-validation-action@8f4b9f2835a4826fbbdfe8f5dbb6ad8996cf5831 # 0.1.0
        with:
          version: "${{ steps.set-variables-image.outputs.bundle_version }}"

      - name: Verify Semver Helm Chart Version
        uses: rubenesp87/semver-validation-action@8f4b9f2835a4826fbbdfe8f5dbb6ad8996cf5831 # 0.1.0
        with:
          version: "${{ steps.set-variables-image.outputs.helmchart_version }}"

      - name: Build Go Cache Paths
        id: go-cache-paths
        run: |
          echo "go-build=$(go env GOCACHE)" >> $GITHUB_OUTPUT
          echo "go-mod=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version: ${{ inputs.GO_VERSION }}
          cache: false

      - name: Go Build Cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ steps.go-cache-paths.outputs.go-build }}
          key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}

      - name: Go Mod Cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ steps.go-cache-paths.outputs.go-mod }}
          key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}

      - name: Go Dependencies
        run: go mod download

      - name: Download Binaries
        env:
          OPERATOR_SDK_VERSION: ${{ inputs.OPERATOR_SDK_VERSION }}
        run: |
          # Create Binary Directory
          mkdir -p ${{ steps.set-variables.outputs.bin_dir }}

          # Operator SDK
          curl -L -o ${{ steps.set-variables.outputs.bin_dir }}/operator-sdk https://github.com/operator-framework/operator-sdk/releases/download/${{ env.OPERATOR_SDK_VERSION }}/operator-sdk_linux_amd64

          # Controller-gen
          make controller-gen

      - name: Upload Support Binaries
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: support-binaries
          path: ${{ steps.set-variables.outputs.bin_dir }}
          retention-days: 1

    outputs:
      repository_name: ${{ steps.set-variables.outputs.repository_name }}
      bin_dir: ${{ steps.set-variables.outputs.bin_dir }}
      operator_image_repository_name: ${{ steps.set-variables-image.outputs.operator_image_repository_name}}
      operator_image_registry: ${{ steps.set-variables-image.outputs.operator_image_registry }}
      bundle_image_repository_name: ${{ steps.set-variables-image.outputs.bundle_image_repository_name }}
      bundle_image_registry: ${{ steps.set-variables-image.outputs.bundle_image_registry }}
      go_build: ${{ steps.go-cache-paths.outputs.go-build }}
      go_mod: ${{ steps.go-cache-paths.outputs.go-mod }}
      operator_version: ${{ steps.set-variables-image.outputs.operator_version }}
      bundle_version: ${{ steps.set-variables-image.outputs.bundle_version }}
      helmchart_version: ${{ steps.set-variables-image.outputs.helmchart_version }}
      tag_event: ${{ steps.set-variables-image.outputs.tag_event }}
      dist_matrix: ${{ steps.set-variables.outputs.dist_matrix }}
      image_platform_tags: ${{ steps.set-variables.outputs.image_platform_tags }}

  build-operator:
    runs-on: ubuntu-latest
    name: build-operator
    needs: ["setup"]
    strategy:
      matrix:
        platform: ${{ fromJson(needs.setup.outputs.dist_matrix) }}
    env:
      REPOSITORY_NAME: ${{ needs.setup.outputs.repository_name }}
      OPERATOR_VERSION: ${{ needs.setup.outputs.operator_version }}
      BUNDLE_VERSION: ${{ needs.setup.outputs.bundle_version }}
      OPERATOR_IMAGE_REPOSITORY: "${{ needs.setup.outputs.operator_image_registry }}/${{ needs.setup.outputs.operator_image_repository_name }}"
      OPERATOR_IMAGE_REGISTRY: ${{ needs.setup.outputs.operator_image_registry }}
      BUNDLE_IMAGE_REPOSITORY: "${{ needs.setup.outputs.bundle_image_registry }}/${{ needs.setup.outputs.bundle_image_repository_name }}"
      BUNDLE_IMAGE_REGISTRY: ${{ needs.setup.outputs.bundle_image_registry }}

    steps:
      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version: ${{ inputs.GO_VERSION }}
          cache: false

      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: ${{ inputs.CHECKOUT_CODE }}

      - name: Go Build Cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ needs.setup.outputs.go_build }}
          key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}

      - name: Go Mod Cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ needs.setup.outputs.go_mod }}
          key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}

      - name: Download Support Binaries
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: support-binaries
          path: ${{ needs.setup.outputs.bin_dir }}

      - name: Prepare Build Step
        id: setup-build-step
        run: |
          # Setup Path
          echo "${{ needs.setup.outputs.bin_dir }}" >> $GITHUB_PATH

          # Make Binaries Executable
          chmod +x ${{ needs.setup.outputs.bin_dir }}/*

          # Configure Platform Variables
          echo "platform_os=$(echo ${{ matrix.platform }} |  cut -d/ -f1)" >> $GITHUB_OUTPUT
          echo "platform_arch=$(echo ${{ matrix.platform }} |  cut -d/ -f2)" >> $GITHUB_OUTPUT

      - name: Download Dependencies
        shell: bash
        run: |
          make generate
          make fmt
          make vet

      - name: build code
        shell: bash
        env:
          VERSION: latest
          GOOS: ${{ steps.setup-build-step.outputs.platform_os }}
          GOARCH: ${{ steps.setup-build-step.outputs.platform_arch }}
        run: make

      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
        with:
          buildkitd-flags: --debug

      - name: "Build Operator Image"
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
        with:
          context: .
          file: "./ci.Dockerfile"
          provenance: false
          platforms: ${{ matrix.platform }}
          push: false
          tags: "${{ env.OPERATOR_IMAGE_REPOSITORY }}:latest-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }},${{ env.OPERATOR_IMAGE_REPOSITORY }}:${{ env.OPERATOR_VERSION }}-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}"
          load: true

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
        with:
          scan-type: image
          image-ref: ${{ env.OPERATOR_IMAGE_REPOSITORY }}:latest-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}
          format: "cosign-vuln"
          output: "operator-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}-cosignvuln.json"

      - name: Run Trivy SBOM generator
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
        with:
          scan-type: image
          image-ref: ${{ env.OPERATOR_IMAGE_REPOSITORY }}:latest-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}
          format: "spdx-json"
          output: "operator-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}-spdxjson.json"

      - name: Prepare Distribution Artifacts
        shell: bash
        run: |
          # Create Distribution Directory
          mkdir dist

          # Move and Rename Manager Binary
          mv bin/manager dist/${{ env.REPOSITORY_NAME }}-manager-${{ env.OPERATOR_VERSION }}-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}

          mkdir attestation
          mv operator-*.json attestation

      - name: Upload Dist
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: dist-manager-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}
          path: dist
          retention-days: 1

      - name: Upload attestation
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: attestation-manager-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}
          path: attestation
          retention-days: 1

  build-bundle:
    runs-on: ubuntu-latest
    name: build-bundle
    needs: ["setup", "build-operator"]
    strategy:
      matrix:
        platform: ${{ fromJson(needs.setup.outputs.dist_matrix) }}
    env:
      REPOSITORY_NAME: ${{ needs.setup.outputs.repository_name }}
      OPERATOR_VERSION: ${{ needs.setup.outputs.operator_version }}
      BUNDLE_VERSION: ${{ needs.setup.outputs.bundle_version }}
      OPERATOR_IMAGE_REPOSITORY: "${{ needs.setup.outputs.operator_image_registry }}/${{ needs.setup.outputs.operator_image_repository_name }}"
      OPERATOR_IMAGE_REGISTRY: ${{ needs.setup.outputs.operator_image_registry }}
      BUNDLE_IMAGE_REPOSITORY: "${{ needs.setup.outputs.bundle_image_registry }}/${{ needs.setup.outputs.bundle_image_repository_name }}"
      BUNDLE_IMAGE_REGISTRY: ${{ needs.setup.outputs.bundle_image_registry }}
    steps:
      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version: ${{ inputs.GO_VERSION }}
          cache: false

      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: ${{ inputs.CHECKOUT_CODE }}

      - name: Go Build Cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ needs.setup.outputs.go_build }}
          key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}

      - name: Go Mod Cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ needs.setup.outputs.go_mod }}
          key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}

      - name: Download Binaries
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: support-binaries
          path: ${{ needs.setup.outputs.bin_dir }}

      - name: Prepare Build Step
        id: setup-build-step
        run: |
          # Setup Path
          echo "${{ needs.setup.outputs.bin_dir }}" >> $GITHUB_PATH

          # Make Binaries Executable
          chmod +x ${{ needs.setup.outputs.bin_dir }}/*

          # Configure Platform Variables
          echo "platform_os=$(echo ${{ matrix.platform }} |  cut -d/ -f1)" >> $GITHUB_OUTPUT
          echo "platform_arch=$(echo ${{ matrix.platform }} |  cut -d/ -f2)" >> $GITHUB_OUTPUT

      - name: build bundle
        shell: bash
        run: make bundle IMG=${{ env.OPERATOR_IMAGE_REPOSITORY }}:${{ env.OPERATOR_VERSION }} VERSION=${{ env.BUNDLE_VERSION }} DEFAULT_CHANNEL=${{ env.DEFAULT_BUNDLE_CHANNEL }}

      - name: "Copy bundle dockerfile"
        shell: bash
        run: sed  's/bundle\///g' bundle.Dockerfile > bundle/Dockerfile

      - name: verify bundle
        shell: bash
        run: operator-sdk bundle validate ./bundle --select-optional name=operatorhub

      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4

      - name: "Build Bundle Image"
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
        with:
          context: .
          file: ./bundle.Dockerfile
          provenance: false
          platforms: ${{ matrix.platform }}
          push: false
          tags: "${{ env.BUNDLE_IMAGE_REPOSITORY }}:latest-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }},${{ env.BUNDLE_IMAGE_REPOSITORY }}:${{ env.BUNDLE_VERSION }}-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}"
          load: true

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
        with:
          scan-type: image
          image-ref: ${{ env.BUNDLE_IMAGE_REPOSITORY }}:latest-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}
          format: "cosign-vuln"
          output: "bundle-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}-cosignvuln.json"

      - name: Run Trivy SBOM generator
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
        with:
          scan-type: image
          image-ref: ${{ env.BUNDLE_IMAGE_REPOSITORY }}:latest-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}
          format: "spdx-json"
          output: "bundle-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}-spdxjson.json"

      - name: Prepare Distribution Artifacts
        shell: bash
        run: |
          # Create Distribution Directory
          mkdir dist

          # Prepare Bundle
          cp -R bundle ${{ env.REPOSITORY_NAME }}-bundle-${{ env.OPERATOR_VERSION }}-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}
          tar -czvf ${{ env.REPOSITORY_NAME }}-bundle-${{ env.OPERATOR_VERSION }}-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}.tar.gz ${{ env.REPOSITORY_NAME }}-bundle-${{ env.OPERATOR_VERSION }}-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}
          mv ${{ env.REPOSITORY_NAME }}-bundle-${{ env.OPERATOR_VERSION }}-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}.tar.gz dist
          rm -Rf ${{ env.REPOSITORY_NAME }}-bundle-${{ env.OPERATOR_VERSION }}-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}

          mkdir attestation
          mv bundle-*.json attestation

      - name: Upload Dist
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: dist-bundle-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}
          path: dist
          retention-days: 1

      - name: Upload attestation
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: attestation-bundle-${{ steps.setup-build-step.outputs.platform_os }}-${{ steps.setup-build-step.outputs.platform_arch }}
          path: attestation
          retention-days: 1

  package-helm:
    runs-on: ubuntu-latest
    name: package-helm
    needs: ["setup"]
    env:
      REPOSITORY_NAME: ${{ needs.setup.outputs.repository_name }}
      OPERATOR_VERSION: ${{ needs.setup.outputs.operator_version }}
      HELM_RELEASE_VERSION: ${{ needs.setup.outputs.helmchart_version }}
      OPERATOR_IMAGE_REPOSITORY: "${{ needs.setup.outputs.operator_image_registry }}/${{ needs.setup.outputs.operator_image_repository_name }}"
    steps:
      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version: ${{ inputs.GO_VERSION }}
          cache: false

      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: ${{ inputs.CHECKOUT_CODE }}

      - name: Go Build Cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ needs.setup.outputs.go_build }}
          key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}

      - name: Go Mod Cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ needs.setup.outputs.go_mod }}
          key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}

      - name: Download Binaries
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: support-binaries
          path: ${{ needs.setup.outputs.bin_dir }}

      - name: Prepare Build Step
        id: setup-build-step
        run: |
          # Setup Path
          echo "${{ needs.setup.outputs.bin_dir }}" >> $GITHUB_PATH

          # Make Binaries Executable
          chmod +x ${{ needs.setup.outputs.bin_dir }}/*

      - name: Build and Package Helm Chart
        shell: bash
        run: |
          # Render Helm Chart
          make helmchart OPERATOR_NAME=${{ env.REPOSITORY_NAME }} VERSION=${{ env.HELM_RELEASE_VERSION }} IMG=${{ env.OPERATOR_IMAGE_REPOSITORY }}:${{ env.OPERATOR_VERSION }}

          # Package Helm Chart
          mkdir dist
          helm package -d dist ./charts/${{ env.REPOSITORY_NAME }}

      - name: Upload Dist
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: dist-charts
          path: dist
          retention-days: 1

  test-operator:
    runs-on: ubuntu-latest
    name: test-operator
    if: ${{ inputs.RUN_UNIT_TESTS || inputs.RUN_INTEGRATION_TESTS }}
    needs: ["setup"]
    env:
      REPOSITORY_NAME: ${{ needs.setup.outputs.repository_name }}
    steps:
      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version: ${{ inputs.GO_VERSION }}
          cache: false

      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: ${{ inputs.CHECKOUT_CODE }}

      - name: Go Build Cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ needs.setup.outputs.go_build }}
          key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}

      - name: Go Mod Cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ needs.setup.outputs.go_mod }}
          key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}

      - name: Download Binaries
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: support-binaries
          path: ${{ needs.setup.outputs.bin_dir }}

      - name: Prepare Build Step
        id: setup-build-step
        run: |
          # Setup Path
          echo "${{ needs.setup.outputs.bin_dir }}" >> $GITHUB_PATH

          # Make Binaries Executable
          chmod +x ${{ needs.setup.outputs.bin_dir }}/*

      - name: Run unit tests
        shell: bash
        if: ${{ inputs.RUN_UNIT_TESTS }}
        run: make test

      - name: Run integration tests
        shell: bash
        if: ${{ inputs.RUN_INTEGRATION_TESTS }}
        run: make integration KUBECTL_WAIT_TIMEOUT=${{ inputs.KUBECTL_WAIT_TIMEOUT }}

  test-helmchart:
    runs-on: ubuntu-latest
    name: test-helmchart
    if: ${{ inputs.RUN_HELMCHART_TEST }}
    needs: ["setup"]
    env:
      REPOSITORY_NAME: ${{ needs.setup.outputs.repository_name }}
      OPERATOR_VERSION: ${{ needs.setup.outputs.operator_version }}
      HELM_RELEASE_VERSION: ${{ needs.setup.outputs.helmchart_version }}
      OPERATOR_IMAGE_REPOSITORY: "${{ needs.setup.outputs.operator_image_registry }}/${{ needs.setup.outputs.operator_image_repository_name }}"
    steps:
      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version: ${{ inputs.GO_VERSION }}
          cache: false

      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: ${{ inputs.CHECKOUT_CODE }}

      - name: Go Build Cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ needs.setup.outputs.go_build }}
          key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}

      - name: Go Mod Cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ needs.setup.outputs.go_mod }}
          key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}

      - name: Download Binaries
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: support-binaries
          path: ${{ needs.setup.outputs.bin_dir }}

      - name: Prepare Build Step
        id: setup-build-step
        run: |
          # Setup Path
          echo "${{ needs.setup.outputs.bin_dir }}" >> $GITHUB_PATH

          # Make Binaries Executable
          chmod +x ${{ needs.setup.outputs.bin_dir }}/*

      - name: Test Helm Chart Deployment
        shell: bash
        run: make helmchart-test OPERATOR_NAME=${{ env.REPOSITORY_NAME }} KUBECTL_WAIT_TIMEOUT=${{ inputs.KUBECTL_WAIT_TIMEOUT }}

  recombine-dist:
    runs-on: ubuntu-latest
    name: recombine-dist
    needs: ["setup", "build-operator", "build-bundle", "package-helm" ]
    steps:
      - name: Prepare download
        run: |
          mkdir -p dist
          mkdir -p attestation

      - name: Download all dist artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: dist-*
          merge-multiple: true
          path: dist

      - name: Download all attestation artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: attestation-*
          merge-multiple: true
          path: attestation

      - name: Upload Dist
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: dist
          path: dist

      - name: Upload Attestation
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: attestation
          path: attestation