go.yml

name: Go build

on:
  push:
    branches:
      - main
      - release-*
    paths-ignore:
      - "**.md"
      - .github/ISSUE_TEMPLATE/**
      - .github/workflows/*.yaml
      - .github/workflows/*.yml
        # Re-include all workflow files used by this workflow
      - "!.github/workflows/go.yml"
      - "!.github/workflows/build-image-bundle.yml"
      - "!.github/workflows/build-k0s.yml"
      - "!.github/workflows/smoketest.yaml"
      - .github/CODEOWNERS
      - .github/dependabot.yml
      - docs/**
      - hack/ostests/**
      - LICENSE
      - mkdocs.yml
      - renovate.json

  pull_request:
    branches:
      - main
      - release-*
    paths-ignore:
      - "**.md"
      - .github/ISSUE_TEMPLATE/**
      - .github/workflows/*.yaml
      - .github/workflows/*.yml
        # Re-include all workflow files used by this workflow
      - "!.github/workflows/go.yml"
      - "!.github/workflows/build-image-bundle.yml"
      - "!.github/workflows/build-k0s.yml"
      - "!.github/workflows/smoketest.yaml"
      - .github/CODEOWNERS
      - .github/dependabot.yml
      - docs/**
      - hack/ostests/**
      - LICENSE
      - mkdocs.yml
      - renovate.json

env:
  MAKEFLAGS: -j
  CURL_OPTS: --proto =https --tlsv1.2 --retry 5 --retry-all-errors --silent --show-error --location --fail

jobs:
  prepare:
    name: Prepare
    runs-on: ubuntu-24.04

    outputs:
      smoketest-matrix: ${{ steps.generate-smoketest-matrix.outputs.smoketests }}
      autopilot-matrix: ${{ steps.generate-autopilot-matrix.outputs.matrix }}

    steps:
      - name: "Workflow run :: Checkout"
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          persist-credentials: false

      - name: "Generate :: Smoke test matrix"
        id: generate-smoketest-matrix
        run: |
          ./vars.sh FROM=inttest smoketests | jq --raw-input --raw-output \
              'split(" ") | [ .[] | select(startswith("check-")) | .[6:] ] | "smoketests=" + tojson' >>$GITHUB_OUTPUT

      - name: "Generate :: Autopilot test matrix"
        id: generate-autopilot-matrix
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          k0sSortVersion=$(./vars.sh FROM=. k0s_sort_version)
          mkdir -p build/cache/bin
          curl $CURL_OPTS --output build/cache/bin/k0s_sort "https://github.com/k0sproject/version/releases/download/$k0sSortVersion/k0s_sort-linux-amd64"
          chmod +x build/cache/bin/k0s_sort
          export PATH="$(realpath build/cache/bin):$PATH"

          set -x
          k8sVersion="$(./vars.sh kubernetes_version)"
          majorVersion="${k8sVersion%%.*}"
          minorVersion=${k8sVersion#$majorVersion.}
          minorVersion="${minorVersion%%.*}"

          {
            printf matrix=
            hack/tools/gen-matrix.sh "$majorVersion.$(($minorVersion - 1))" "$majorVersion.$minorVersion"
          } >> "$GITHUB_OUTPUT"

  build-k0s:
    strategy:
      matrix:
        include:
          - target-os: linux
            target-arch: amd64
          - target-os: linux
            target-arch: arm64
          - target-os: windows
            target-arch: amd64

    name: "Build :: k0s :: ${{ matrix.target-os }}-${{ matrix.target-arch }}"
    uses: ./.github/workflows/build-k0s.yml
    with:
      target-os: ${{ matrix.target-os }}
      target-arch: ${{ matrix.target-arch }}

  build-airgap-image-bundle:
    strategy:
      fail-fast: false
      matrix:
        target-arch: [amd64, arm64]

    name: "Build :: Airgap image bundle"
    needs: [build-k0s]
    uses: ./.github/workflows/build-image-bundle.yml
    with:
      image-bundle-name: airgap
      image-bundle-platform: linux-${{ matrix.target-arch }}

  build-ipv6-test-image-bundle:
    name: "Build :: IPv6 test image bundle"
    needs: [build-k0s]
    uses: ./.github/workflows/build-image-bundle.yml
    with:
      image-bundle-name: ipv6-test
      image-bundle-platform: linux-amd64

  submit-sbom:
    name: "Submit :: SBOM"

    if: github.ref == 'refs/heads/main'
    needs: [build-k0s]
    runs-on: ubuntu-24.04

    permissions:
      id-token: write
      contents: write

    steps:
      - name: Download
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: sbom-linux-amd64

      - name: Submit
        uses: advanced-security/spdx-dependency-submission-action@169d22427d74f3faf93504e70b03eede8dab272a # v0.2.0
        with:
          filePath: spdx.json

  unittests-k0s:
    strategy:
      fail-fast: false
      matrix:
        include:
          - runs-on: ubuntu-24.04
          - runs-on: windows-2022
          - runs-on: macos-15

    name: "check-unit :: k0s :: ${{ matrix.runs-on }}"
    uses: ./.github/workflows/unittests-k0s.yml
    with:
      runs-on: ${{ matrix.runs-on }}

  smoketests:
    strategy:
      fail-fast: false
      matrix:
        smoke-suite: ${{ fromJson(needs.prepare.outputs.smoketest-matrix) }}

    name: "check-${{ matrix.smoke-suite }} :: amd64"
    needs:
      - prepare
      - build-k0s
      - build-airgap-image-bundle
      - build-ipv6-test-image-bundle

    uses: ./.github/workflows/smoketest.yaml
    with:
      arch: amd64
      name: ${{ matrix.smoke-suite }}

  smoketests-linux-arm64:
    strategy:
      fail-fast: false
      matrix:
        smoke-suite:
          - airgap
          - basic
          - network-conformance-calico
          - network-conformance-kuberouter

    name: "check-${{ matrix.smoke-suite }} :: arm64"
    needs: [build-k0s, build-airgap-image-bundle]

    uses: ./.github/workflows/smoketest.yaml
    with:
      arch: arm64
      name: ${{ matrix.smoke-suite }}

  autopilot-tests:
    strategy:
      fail-fast: false
      matrix:
        version: ${{fromJson(needs.prepare.outputs.autopilot-matrix)}}
        smoke-suite:
          - controllerworker
          - ha3x3

    name: "check-ap-${{ matrix.smoke-suite }} :: ${{ matrix.version }}"
    needs: [prepare, build-k0s]

    uses: ./.github/workflows/smoketest.yaml
    with:
      arch: amd64
      name: ap-${{ matrix.smoke-suite }}
      k0s-reference-version: ${{ matrix.version }}

  build-arm:
    name: "Build :: k0s :: arm"
    if: github.repository == 'k0sproject/k0s'
    runs-on:
      - self-hosted
      - linux
      - arm
    steps:
      # https://github.com/actions/checkout/issues/273#issuecomment-642908752 (see below)
      - name: "Pre: Fixup directories"
        run: find . -type d -not -perm /u+w -exec chmod u+w '{}' \;

      - name: Check out code into the Go module directory
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0 # for `git describe`
          persist-credentials: false

      - name: Prepare build environment
        run: .github/workflows/prepare-build-env.sh

      - name: Set up Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: false
      - name: Cache embedded binaries
        id: cache-embedded-bins
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          key: "build-k0s-linux-arm-embedded-bins-${{ hashFiles('embedded-bins/**/*') }}"
          path: embedded-bins/staging/linux/bin/

      - name: Cache Go cache
        id: cache-gocache
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          key: "build-k0s-linux-arm-gocache-go${{ env.GO_VERSION }}-${{ github.sha }}"
          restore-keys: "build-k0s-linux-arm-gocache-go${{ env.GO_VERSION }}-"
          path: build/cache/go/build

      - name: Prepare Go cache
        if: steps.cache-gocache.outputs.cache-hit
        run: |
          touch -t "$(TZ=UTC+24 date +%Y%m%d%H%M.%S)" build/cache/_cache_sentinel
          find build/cache/go/build -type f \( -name '*-a' -o -name '*-d' \) -exec touch -r build/cache/_cache_sentinel {} +

      - name: Build
        env:
          EMBEDDED_BINS_CACHED: "${{ steps.cache-embedded-bins.outputs.cache-hit }}"
        run: |
          gh --version || echo No gh installed
          make .k0sbuild.docker-image.k0s
          touch go.sum
          if [ "$EMBEDDED_BINS_CACHED" == true ]; then
            make --touch .bins.linux.stamp
          fi
          make --touch codegen
          make build
          echo "k0s binary size: **$(du -sh k0s | cut -f1)**" >>$GITHUB_STEP_SUMMARY

      - name: Upload compiled executable
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: k0s-arm
          path: k0s

      - name: Unit tests
        run: make check-unit

      - name: Create airgap image list
        run: make airgap-images-linux-arm.txt

      - name: Cache airgap image bundle
        id: cache-airgap-image-bundle
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          key: airgap-image-bundle-linux-arm-${{ hashFiles('Makefile', 'airgap-images-linux-arm.txt', 'cmd/airgap/*', 'pkg/airgap/*') }}
          path: |
            airgap-images-linux-arm.txt
            airgap-image-bundle-linux-arm.tar

      - name: Create airgap image bundle if not cached
        if: steps.cache-airgap-image-bundle.outputs.cache-hit != 'true'
        run: make airgap-image-bundle-linux-arm.tar

      - name: Upload airgap bundle
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: airgap-image-bundle-linux-arm.tar
          path: airgap-image-bundle-linux-arm.tar

      - name: Trim Go cache
        if: steps.cache-gocache.outputs.cache-hit
        run: |
          find build/cache/go/build -type f \( -name '*-a' -o -name '*-d' \) -not -newer build/cache/_cache_sentinel -delete

  # TODO We probably want to separate the smoketest into a separate callable workflow which we can call from the build step
  # This way we could actually fully parallelize the build and smoketest steps. Currently we are limited by the fact that
  # smoke-test step only start after both arm and armv7 builds have finished.
  smoketest-arm:
    name: "${{ matrix.test }} :: arm"
    if: github.repository == 'k0sproject/k0s'
    needs: [build-arm]
    strategy:
      fail-fast: false
      matrix:
        test:
          - check-basic
          - check-calico
          - check-airgap
    runs-on:
      - self-hosted
      - linux
      - arm

    steps:
      - name: Check out code into the Go module directory
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0 # for `git describe`
          persist-credentials: false

      - name: Prepare build environment
        run: .github/workflows/prepare-build-env.sh

      - name: Set up Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: false
      - name: Download compiled binary
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: k0s-arm

      - name: k0s sysinfo
        run: |
          chmod +x k0s
          ./k0s sysinfo

      - name: Download airgap bundle
        if: contains(matrix.test, 'airgap')
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: airgap-image-bundle-linux-arm.tar

      - name: Run smoketest
        run: make -C inttest ${{ matrix.test }}

      - name: Collect k0s logs and support bundle
        if: failure()
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: smoketest-arm-check-basic-files
          path: |
            /tmp/*.log
            /tmp/support-bundle.tar.gz

      # https://github.com/actions/checkout/issues/273#issuecomment-642908752
      # Golang mod cache tends to set directories to read-only, which breaks any
      # attempts to simply remove those directories. The `make clean-gocache`
      # target takes care of this, but the mod cache can't be deleted here,
      # since it shall be cached across builds, and caching takes place as a
      # post build action. So, as a workaround, ensure that all subdirectories
      # are writable.
      - name: "Post: Fixup directories"
        if: always()
        run: find . -type d -not -perm /u+w -exec chmod u+w '{}' \;

      - name: "Docker prune"
        if: always()
        run: docker system prune --force --filter "until=$((24*7))h"
  win-wsl-smoketest:
    name: "Windows WSL Smoketest"
    needs: [build-k0s]
    uses: ./.github/workflows/win-wsl.yaml