|
1 | | -name: Security test workflow for Anomaly Detection |
| 1 | +name: Security test workflow |
| 2 | +# This workflow is triggered on pull requests to main |
2 | 3 | on: |
3 | | - push: |
4 | | - branches: |
5 | | - - "*" |
6 | 4 | pull_request: |
7 | 5 | branches: |
8 | | - - "*" |
9 | | - |
10 | | -env: |
11 | | - ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true |
| 6 | + - "**" |
| 7 | + push: |
| 8 | + branches: |
| 9 | + - "**" |
12 | 10 |
|
13 | 11 | jobs: |
14 | | - Build-ad: |
15 | | - strategy: |
16 | | - matrix: |
17 | | - java: [21] |
18 | | - fail-fast: false |
19 | | - |
20 | | - name: Security test workflow for Anomaly Detection |
| 12 | + Get-CI-Image-Tag: |
| 13 | + uses: opensearch-project/opensearch-build/.github/workflows/get-ci-image-tag.yml@main |
| 14 | + with: |
| 15 | + product: opensearch |
| 16 | + |
| 17 | + security-test: |
| 18 | + needs: Get-CI-Image-Tag |
| 19 | + # This job runs on Linux |
21 | 20 | runs-on: ubuntu-latest |
| 21 | + container: |
| 22 | + # using the same image which is used by opensearch-build team to build the OpenSearch Distribution |
| 23 | + # this image tag is subject to change as more dependencies and updates will arrive over time |
| 24 | + image: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-version-linux }} |
| 25 | + options: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-options }} |
22 | 26 |
|
23 | 27 | steps: |
24 | | - - name: Setup Java ${{ matrix.java }} |
25 | | - uses: actions/setup-java@v3 |
| 28 | + - name: Run start commands |
| 29 | + run: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-command }} |
| 30 | + # This step uses the setup-java Github action: https://github.com/actions/setup-java |
| 31 | + - name: Set Up JDK |
| 32 | + uses: actions/setup-java@v4 |
26 | 33 | with: |
27 | | - distribution: 'temurin' |
28 | | - java-version: ${{ matrix.java }} |
29 | | - |
30 | | - # time-series-analytics |
31 | | - - name: Checkout AD |
| 34 | + distribution: temurin # Temurin is a distribution of adoptium |
| 35 | + java-version: 21 |
| 36 | + # index-management |
| 37 | + - name: Checkout Branch |
32 | 38 | uses: actions/checkout@v4 |
33 | | - |
34 | | - - name: Build Anomaly Detection |
35 | | - run: | |
36 | | - ./gradlew assemble |
37 | | - # example of variables: |
38 | | - # plugin = opensearch-time-series-analytics-2.10.0.0-SNAPSHOT.zip |
39 | | - # version = 2.10.0, plugin_version = 2.10.0.0, qualifier = SNAPSHOT |
40 | | - - name: Pull and Run Docker |
| 39 | + - name: Run integration tests |
41 | 40 | run: | |
42 | | - plugin=`basename $(ls build/distributions/*.zip)` |
43 | | - version=`echo $plugin|awk -F- '{print $4}'| cut -d. -f 1-3` |
44 | | - plugin_version=`echo $plugin|awk -F- '{print $4}'| cut -d. -f 1-4` |
45 | | - qualifier=`echo $plugin|awk -F- '{print $5}'| cut -d. -f 1-1` |
46 | | -
|
47 | | - if $qualifier!=SNAPSHOT |
48 | | - then |
49 | | - docker_version=$version-$qualifier |
50 | | - else |
51 | | - docker_version=$version |
52 | | - fi |
53 | | - echo plugin version plugin_version qualifier docker_version |
54 | | - echo "($plugin) ($version) ($plugin_version) ($qualifier) ($docker_version)" |
55 | | -
|
56 | | - cd .. |
57 | | - if docker pull opensearchstaging/opensearch:$docker_version |
58 | | - then |
59 | | - echo "FROM opensearchstaging/opensearch:$docker_version" >> Dockerfile |
60 | | - echo "RUN if [ -d /usr/share/opensearch/plugins/opensearch-anomaly-detection ]; then /usr/share/opensearch/bin/opensearch-plugin remove opensearch-anomaly-detection; fi" >> Dockerfile |
61 | | - echo "RUN if [ -d /usr/share/opensearch/plugins/opensearch-time-series-analytics ]; then /usr/share/opensearch/bin/opensearch-plugin remove opensearch-time-series-analytics; fi" >> Dockerfile |
62 | | - echo "ADD anomaly-detection/build/distributions/$plugin /tmp/" >> Dockerfile |
63 | | - echo "RUN /usr/share/opensearch/bin/opensearch-plugin install --batch file:/tmp/$plugin" >> Dockerfile |
64 | | - docker build -t opensearch-ad:test . |
65 | | - echo "imagePresent=true" >> $GITHUB_ENV |
66 | | - else |
67 | | - echo "imagePresent=false" >> $GITHUB_ENV |
68 | | - fi |
69 | | - - name: Run Docker Image |
70 | | - if: env.imagePresent == 'true' |
71 | | - run: | |
72 | | - cd .. |
73 | | - docker run -p 9200:9200 -d -p 9600:9600 -e "OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!" -e "discovery.type=single-node" opensearch-ad:test |
74 | | - sleep 90 |
75 | | - - name: Run AD Test |
76 | | - if: env.imagePresent == 'true' |
77 | | - run: | |
78 | | - security=`curl -XGET https://localhost:9200/_cat/plugins?v -u admin:myStrongPassword123! --insecure |grep opensearch-security|wc -l` |
79 | | - if [ $security -gt 0 ] |
80 | | - then |
81 | | - echo "Security plugin is available" |
82 | | - ./gradlew integTest -Dtests.rest.cluster=localhost:9200 -Dtests.cluster=localhost:9200 -Dtests.clustername="docker-cluster" -Dhttps=true -Duser=admin -Dpassword=myStrongPassword123! |
83 | | - else |
84 | | - echo "Security plugin is NOT available, skipping integration tests" |
85 | | - fi |
| 41 | + chown -R 1000:1000 `pwd` |
| 42 | + su `id -un 1000` -c "./gradlew integTest -Dsecurity=true -Dhttps=true --tests '*IT'" |
| 43 | + - name: Upload failed logs |
| 44 | + uses: actions/upload-artifact@v4 |
| 45 | + if: failure() |
| 46 | + with: |
| 47 | + name: logs |
| 48 | + overwrite: 'true' |
| 49 | + path: build/testclusters/integTest-*/logs/* |
0 commit comments