bind-tests.yml

name: Test BIND plugin

on:
  pull_request:
    paths:
      - 'dns/bind/**'
      - '.github/ci/**'
      - '.resolver-plugins/target-pkg.json'
      - '.resolver-plugins/target-pkg-content.json'
      - '.github/workflows/bind-tests.yml'
      - '.resolver-plugins/bind920.json'
  workflow_call:
    inputs:
      pull_request_base:
        required: true
        type: string
      pull_request_sha:
        required: true
        type: string

permissions:
  contents: read

jobs:
  changes:
    runs-on: ubuntu-24.04
    outputs:
      bind_source: ${{ steps.paths.outputs.bind_source }}
      ci_helpers: ${{ steps.paths.outputs.ci_helpers }}
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          fetch-depth: 0
          ref: ${{ inputs.pull_request_sha || github.sha }}
          persist-credentials: false
      - id: paths
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ inputs.pull_request_sha || github.event.pull_request.head.sha }}
        run: |
          set -euo pipefail
          if [ "$EVENT_NAME" = workflow_call ]; then
            printf 'bind_source=true\nci_helpers=true\n' >> "$GITHUB_OUTPUT"
            exit 0
          fi
          bind_source=false
          ci_helpers=false
          git diff --name-only "$BASE_SHA" "$HEAD_SHA" > "$RUNNER_TEMP/changed-paths"
          while IFS= read -r path; do
            case "$path" in
              dns/bind/*|.github/ci/*|.github/workflows/bind-tests.yml)
                bind_source=true
                ci_helpers=true
                ;;
              .resolver-plugins/bind920.json|.resolver-plugins/target-pkg.json|.resolver-plugins/target-pkg-content.json)
                ci_helpers=true
                ;;
            esac
          done < "$RUNNER_TEMP/changed-paths"
          printf 'bind_source=%s\nci_helpers=%s\n' "$bind_source" "$ci_helpers" >> "$GITHUB_OUTPUT"
      - name: Check BIND package description freshness
        shell: bash
        env:
          CALLER_SHA: ${{ inputs.pull_request_sha }}
          PR_BASE: ${{ inputs.pull_request_base || github.event.pull_request.base.ref }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ inputs.pull_request_sha || github.event.pull_request.head.sha }}
        run: |
          set -euo pipefail
          guard=.github/ci/check-bind-pkg-descr.sh
          if [ -n "$CALLER_SHA" ]; then
            git fetch --no-tags origin \
              "refs/heads/$PR_BASE:refs/remotes/origin/pr-base" \
              'refs/heads/master:refs/remotes/origin/control-plane'
            BASE_SHA=$(git rev-parse refs/remotes/origin/pr-base)
            guard="$RUNNER_TEMP/check-bind-pkg-descr.sh"
            git show refs/remotes/origin/control-plane:.github/ci/check-bind-pkg-descr.sh > "$guard"
            chmod +x "$guard"
          fi
          "$guard" "$BASE_SHA" "$HEAD_SHA"

  ci-helpers:
    needs: changes
    if: needs.changes.outputs.ci_helpers == 'true'
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          ref: ${{ inputs.pull_request_sha || github.sha }}
          persist-credentials: false
      - name: Materialize CI control plane
        shell: bash
        env:
          PR_BASE: ${{ inputs.pull_request_base || github.event.pull_request.base.ref }}
        run: |
          set -euo pipefail
          if [[ "$PR_BASE" == release/bind-rp/* ]]; then
            git fetch --no-tags origin \
              'refs/heads/master:refs/remotes/origin/control-plane'
            git checkout refs/remotes/origin/control-plane -- \
              .github/ci \
              .github/workflows/bind-tests.yml \
              .github/workflows/bind920-candidate.yml \
              .resolver-plugins/bind920.json
          fi
          test -d .github/ci
          test -f .resolver-plugins/bind920.json
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
        with:
          python-version: '3.12.13'
      - name: Run stdlib CI helper tests
        run: |
          python -m py_compile .github/ci/*.py
          python .github/ci/bind920_profile.py .resolver-plugins/bind920.json package_version
          python .github/ci/ci-tests/test_bind920_candidate.py
          python .github/ci/ci-tests/test_bind920_reuse.py
          python .github/ci/ci-tests/test_release_channel_provenance.py

  discover:
    needs: changes
    if: needs.changes.outputs.bind_source == 'true'
    runs-on: ubuntu-24.04
    outputs:
      series: ${{ steps.releases.outputs.series }}
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          persist-credentials: false
      - id: releases
        name: Discover supported release branches
        shell: bash
        run: |
          set -euo pipefail
          git ls-remote --heads origin 'refs/heads/release/bind-rp/*' > "$RUNNER_TEMP/release-refs"
          python3 - "$RUNNER_TEMP/release-refs" "$GITHUB_OUTPUT" <<'PY'
          import json
          import pathlib
          import re
          import sys

          refs_path, output_path = map(pathlib.Path, sys.argv[1:])
          prefix = 'refs/heads/release/bind-rp/'
          series = []
          for line in refs_path.read_text(encoding='utf-8').splitlines():
              _commit, ref = line.split('\t', maxsplit=1)
              candidate = ref.removeprefix(prefix)
              if not re.fullmatch(r'\d+\.\d+', candidate):
                  raise SystemExit(f'invalid release branch name: {ref}')
              series.append(candidate)
          with output_path.open('a', encoding='utf-8') as output:
              print(f'series={json.dumps(sorted(set(series)))}', file=output)
          PY

  test:
    needs: [changes, discover]
    if: needs.changes.outputs.bind_source == 'true' && needs.discover.outputs.series != '[]'
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        series: ${{ fromJSON(needs.discover.outputs.series) }}
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          ref: ${{ inputs.pull_request_sha || github.sha }}
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
        with:
          python-version: '3.12.13'
      - name: Install CI test dependencies
        run: python -m pip install --disable-pip-version-check 'pytest==8.3.5'
      - name: Materialize canonical tests and release BIND source
        shell: bash
        env:
          PR_BASE: ${{ inputs.pull_request_base || github.event.pull_request.base.ref }}
          SERIES: ${{ matrix.series }}
        run: |
          set -euo pipefail
          if [[ "$PR_BASE" == release/bind-rp/* ]]; then
            git fetch --no-tags origin \
              'refs/heads/master:refs/remotes/origin/canonical-tests'
            git checkout refs/remotes/origin/canonical-tests -- \
              .github/ci/metadata_profile.py dns/bind/tests
          fi
          test -d dns/bind/tests
          test -f .github/ci/metadata_profile.py
          source_commit=$(git rev-parse HEAD)
          if [[ "$PR_BASE" != "release/bind-rp/$SERIES" ]]; then
            source_ref="refs/heads/release/bind-rp/$SERIES"
            git fetch --no-tags origin "$source_ref:refs/remotes/origin/bind-under-test"
            source_commit=$(git rev-parse refs/remotes/origin/bind-under-test)
            git checkout "$source_commit" -- .resolver-plugins/upstream.json dns/bind/Makefile dns/bind/src
            for fragment in +POST_INSTALL.pre +POST_INSTALL.post; do
              if git cat-file -e "$source_commit:dns/bind/$fragment"; then
                git show "$source_commit:dns/bind/$fragment" > "dns/bind/$fragment"
              else
                rm -f "dns/bind/$fragment"
              fi
            done
          fi
          git show "$source_commit:.resolver-plugins/upstream.json" > "$RUNNER_TEMP/upstream.json"
          python3 .github/ci/metadata_profile.py "$RUNNER_TEMP/upstream.json" "$SERIES" freebsd_release > /dev/null
      - name: Run canonical BIND tests
        run: python3 -m pytest -q dns/bind/tests