ROX-29003: Add Operator-index upgrade test

.github/workflows/auto-operator-index-upgrade-test.yml

@@ -0,0 +1,84 @@
+name: "Auto Operator Index Upgrade Test"
+
+on:
+  workflow_dispatch:
+    inputs:
+      version-stream-override:
+        description: 'Override ACS stream version, skips bundles.yaml diff (e.g. "4.10")'
+        required: false
+        type: string
+      operator-index-image-override:
+        description: 'Override operator-index image (e.g. quay.io/rhacs-eng/stackrox-operator-index:ocp-v4-22-...)'
+        required: false
+        type: string
+  push:
+    branches: [master]
+    paths: ['bundles.yaml']
+  pull_request:
+    paths: ['bundles.yaml']
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  derive-inputs:
+    name: Derive operator-index-upgrade test inputs
+    runs-on: ubuntu-latest
+    outputs:
+      version-streams: ${{ steps.derive.outputs.version-streams }}
+      ocp-targets: ${{ steps.derive.outputs.ocp-targets }}
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Derive upgrade test inputs
+        id: derive
+        env:
+          VERSION_STREAM_OVERRIDE: ${{ inputs.version-stream-override }}
+          OPERATOR_INDEX_IMAGE_OVERRIDE: ${{ inputs.operator-index-image-override }}
+          BASE_REF: ${{ github.base_ref }}
+          EVENT_NAME: ${{ github.event_name }}
+          SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: go run ./cmd/derive-inputs >> "$GITHUB_OUTPUT"
+
+      - name: Wait for oldest-OCP operator-index image
+        if: steps.derive.outputs.version-streams != ''
+        uses: stackrox/actions/release/wait-for-image@v1
+        with:
+          image: ${{ fromJson(steps.derive.outputs.ocp-targets)[0].operator-index-image }}
+          interval: "60"
+          limit: "7200"
+
+      - name: Wait for newest-OCP operator-index image
+        if: steps.derive.outputs.version-streams != '' && fromJson(steps.derive.outputs.ocp-targets)[1] != null
+        uses: stackrox/actions/release/wait-for-image@v1
+        with:
+          image: ${{ fromJson(steps.derive.outputs.ocp-targets)[1].operator-index-image }}
+          interval: "60"
+          limit: "7200"
+
+  run-upgrade-tests:
+    name: Run operator-index upgrade tests
+    needs: derive-inputs
+    if: needs.derive-inputs.outputs.version-streams != ''
+    strategy:
+      matrix:
+        version-stream: ${{ fromJson(needs.derive-inputs.outputs.version-streams) }}
+        ocp-target: ${{ fromJson(needs.derive-inputs.outputs.ocp-targets) }}
+      # if any matrix job fails, continue to run the rest of the jobs
+      fail-fast: false
+    uses: ./.github/workflows/operator-index-upgrade-test.yml
+    with:
+      operator-index-image: ${{ matrix.ocp-target.operator-index-image }}
+      version-stream: ${{ matrix.version-stream }}
+      ocp-version: ${{ matrix.ocp-target.ocp-version }}
+      cluster-lifespan: 3h
+    secrets:
+      INFRA_TOKEN: ${{ secrets.INFRA_TOKEN }}

.github/workflows/operator-index-upgrade-test.yml

@@ -0,0 +1,158 @@
+name: "Operator Index Upgrade Test"
+
+on:
+  workflow_dispatch:
+    inputs:
+      operator-index-image:
+        description: 'ACS Operator index image (e.g., quay.io/rhacs-eng/stackrox-operator-index:ocp-v4-22-...)'
+        required: true
+        type: string
+      version-stream:
+        description: 'ACS version stream under test (e.g. 4.10). Determines channel and Y-2 oldest.'
+        required: true
+        type: string
+      ocp-version:
+        description: 'OCP version for the infra cluster (e.g. 4.22). Derived from operator-index-image tag if not set.'
+        required: false
+        default: ''
+        type: string
+      cluster-lifespan:
+        description: 'Cluster lifespan (e.g., 2h, 4h, 8h)'
+        required: false
+        default: '2h'
+        type: string
+  workflow_call:
+    inputs:
+      operator-index-image:
+        description: 'ACS Operator index image'
+        required: true
+        type: string
+      version-stream:
+        description: 'ACS minor version under test (e.g. 4.10). Determines channel and Y-2 oldest.'
+        required: true
+        type: string
+      ocp-version:
+        description: 'OCP version for the infra cluster (e.g. 4.22). Derived from operator-index-image tag if not set.'
+        required: false
+        default: ''
+        type: string
+      cluster-lifespan:
+        description: 'Cluster lifespan (e.g., 2h, 4h, 8h)'
+        required: false
+        default: '2h'
+        type: string
+    secrets:
+      INFRA_TOKEN:
+        required: true
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  CLUSTER_NAME: upgrade-test-${{ github.run_id }}-${{ github.run_attempt }}
+
+run-name: >-
+  ${{ format('Operator Index Upgrade Test v{0}', inputs.version-stream) }}
+
+jobs:
+  create-cluster:
+    name: Create OpenShift cluster
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set cluster args
+        id: ocp
+        env:
+          OCP_VERSION: ${{ inputs.ocp-version }}
+        run: |
+          if [[ -n "$OCP_VERSION" ]]; then
+            echo "infra-args=openshift-version=ocp/stable-${OCP_VERSION}" >> "$GITHUB_OUTPUT"
+          else
+            echo "infra-args=" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create OpenShift cluster
+        uses: stackrox/actions/infra/create-cluster@v1
+        with:
+          token: ${{ secrets.INFRA_TOKEN }}
+          flavor: openshift-4
+          name: ${{ env.CLUSTER_NAME }}
+          lifespan: ${{ inputs.cluster-lifespan }}
+          wait: true
+          args: ${{ steps.ocp.outputs.infra-args }}
+
+  run-upgrade-tests:
+    name: Run operator-index upgrade tests
+    needs: create-cluster
+    runs-on: ubuntu-latest
+    container:
+      image: quay.io/stackrox-io/apollo-ci:stackrox-test-stable
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Install infractl
+        uses: stackrox/actions/infra/install-infractl@v1
+
+      - name: Download cluster kubeconfig
+        env:
+          INFRA_TOKEN: ${{ secrets.INFRA_TOKEN }}
+        run: |
+          infractl artifacts --download-dir=./artifacts "$CLUSTER_NAME"
+          echo "KUBECONFIG=${{ github.workspace }}/artifacts/kubeconfig" >> "$GITHUB_ENV"
+
+      - name: "Test 1: upgrade oldest-supported → provided"
+        env:
+          OPERATOR_INDEX_IMAGE: ${{ inputs.operator-index-image }}
+          VERSION_STREAM: ${{ inputs.version-stream }}
+        run: make upgrade-test-oldest
+
+      - name: "Test 2: install provided → optionally upgrade to latest GA"
+        env:
+          OPERATOR_INDEX_IMAGE: ${{ inputs.operator-index-image }}
+          VERSION_STREAM: ${{ inputs.version-stream }}
+        run: make upgrade-test-latest
+
+  delete-test-cluster:
+    name: Delete infra test cluster
+    needs: [create-cluster, run-upgrade-tests]
+    runs-on: ubuntu-latest
+    if: always() && needs.create-cluster.result != 'cancelled'
+    env:
+      INFRA_TOKEN: ${{ secrets.INFRA_TOKEN }}
+    steps:
+      - name: Install infractl
+        uses: stackrox/actions/infra/install-infractl@v1
+
+      - name: Delete cluster
+        run: infractl delete "${CLUSTER_NAME}"
+
+  report-status:
+    name: Report test status
+    needs: [create-cluster, run-upgrade-tests, delete-test-cluster]
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - name: Write summary
+        run: |
+          cat <<'EOF' >> "$GITHUB_STEP_SUMMARY"
+          # Operator Index Upgrade Test Results
+
+          | Field | Value |
+          |-------|-------|
+          | **Operator image** | `${{ inputs.operator-index-image }}` |
+          | **ACS version** | `${{ inputs.version-stream }}` |
+          | **Cluster** | `${{ env.CLUSTER_NAME }}` |
+          | **Create cluster** | ${{ needs.create-cluster.result }} |
+          | **Upgrade tests** | ${{ needs.run-upgrade-tests.result }} |
+          | **Delete cluster** | ${{ needs.delete-test-cluster.result }} |
+
+          ## Tests run:
+          1. **Test 1** — install oldest supported ACS version, upgrade to the provided operator-index image
+          2. **Test 2** — install provided operator-index image, upgrade to latest GA if provided ACS version is behind
+          EOF

Makefile

@@ -36,6 +36,18 @@ catalog-template.yaml: bundles.yaml $(wildcard $(GENERATE_SCRIPT_FOLDER)/*.go)
 go-test:
 	@$(GO) test -cover -v ./cmd/...
 
+# Operator index upgrade tests — require OPERATOR_INDEX_IMAGE and ACS_VERSION env vars.
+# Example: make upgrade-test-oldest OPERATOR_INDEX_IMAGE=quay.io/rhacs-eng/stackrox-operator-index:... ACS_VERSION=4.11
+.PHONY: upgrade-test-oldest upgrade-test-latest upgrade-test
+
+upgrade-test-oldest:
+	$(GO) test -v -count=1 -run 'TestUpgradeSuite/TestUpgradeOldest' -timeout 45m ./operator-index-upgrade-test/
+
+upgrade-test-latest:
+	$(GO) test -v -count=1 -run 'TestUpgradeSuite/TestUpgradeLatest' -timeout 30m ./operator-index-upgrade-test/
+
+upgrade-test: upgrade-test-oldest upgrade-test-latest
+
 $(OPM):
 	mkdir -p "$$(dirname $@)"
 	os_name="$$(uname | tr '[:upper:]' '[:lower:]')"; \