kubearmor · AryanBakliwal · Jul 14, 2026
@@ -1,17 +1,7 @@
 name: ci-codespell
 
 on:
-  pull_request:
-    branches: [main]
-    paths:
-      - ".codespellrc"
-      - ".github/workflows/ci-codespell.yml"
-      - "**/*.go"
-      - "**/*.md"
-      - "**/*.yaml"
-      - "**/*.yml"
-      - "**/*.sh"
-      - "**/*.txt"
+  workflow_call:
 
 permissions: read-all
 

@@ -1,26 +1,7 @@
 name: ci-network-test-ginkgo
 
 on:
-  push:
-    branches: [main]
-    paths:
-      - "KubeArmor/**"
-      - "tests/**"
-      - "protobuf/**"
-      - ".github/workflows/ci-network-tests.yml"
-      - "pkg/KubeArmorOperator/**"
-      - "deployments/helm/**"
-      - "examples/multiubuntu/build/**"
-  pull_request:
-    branches: [main]
-    paths:
-      - "KubeArmor/**"
-      - "tests/**"
-      - "protobuf/**"
-      - ".github/workflows/ci-network-tests.yml"
-      - "examples/multiubuntu/build/**"
-      - "pkg/KubeArmorOperator/**"
-      - "deployments/helm/**"
+  workflow_call:
 
 # Declare default permissions as read only.
 permissions: read-all

@@ -1,12 +1,7 @@
 name: ci-test-controllers
 
 on:
-  pull_request:
-    branches:
-      - "main"
-    paths:
-      - "pkg/**"
-      - ".github/workflows/ci-test-controllers.yml"
+  workflow_call:
 
 # Declare default permissions as read only.
 permissions: read-all

@@ -0,0 +1,52 @@
+name: ci-test-ebpf
+
+on:
+  workflow_call:
+
+permissions: read-all
+
+jobs:
+  ebpf-tests:
+    name: Run eBPF Tests
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          submodules: true
+
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version-file: 'KubeArmor/go.mod'
+
+      - name: Install necessary dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get -y install build-essential libelf-dev pkg-config net-tools linux-headers-$(uname -r) linux-tools-$(uname -r) libbpf-dev unzip protobuf-compiler
+
+          go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
+          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
+
+          export arch=$(uname -m)
+          export bpftool_version=v7.2.0
+          if [[ "$arch" == "aarch64" ]]; then
+            arch=arm64;
+          elif [[ "$arch" == "x86_64" ]]; then
+            arch=amd64;
+          fi
+          curl -LO https://github.com/libbpf/bpftool/releases/download/$bpftool_version/bpftool-$bpftool_version-$arch.tar.gz && \
+              sudo tar -xzf bpftool-$bpftool_version-$arch.tar.gz -C /usr/local/bin && \
+              sudo chmod +x /usr/local/bin/bpftool
+
+      - name: Install the latest LLVM toolchain
+        run: ./.github/workflows/install-llvm.sh
+
+      - name: Compile libbpf
+        run: ./.github/workflows/install-libbpf.sh
+
+      - name: Compile eBPF Bytecode
+        working-directory: KubeArmor/BPF
+        run: make
+
+      - name: Load eBPF Bytecode
+        working-directory: KubeArmor/monitor
+        run: sudo -E go run ci_load.go
@@ -1,26 +1,7 @@
 name: ci-test-ginkgo
 
 on:
-  push:
-    branches: [main]
-    paths:
-      - "KubeArmor/**"
-      - "tests/**"
-      - "protobuf/**"
-      - ".github/workflows/ci-test-ginkgo.yml"
-      - "pkg/KubeArmorOperator/**"
-      - "deployments/helm/**"
-      - "examples/multiubuntu/build/**"
-  pull_request:
-    branches: [main]
-    paths:
-      - "KubeArmor/**"
-      - "tests/**"
-      - "protobuf/**"
-      - ".github/workflows/ci-test-ginkgo.yml"
-      - "examples/multiubuntu/build/**"
-      - "pkg/KubeArmorOperator/**"
-      - "deployments/helm/**"
+  workflow_call:
 
 # Declare default permissions as read only.
 permissions: read-all

@@ -1,22 +1,7 @@
 name: ci-test-go
 
 on:
-  push:
-    branches: [main]
-    paths:
-      - "KubeArmor/**"
-      - "tests/**"
-      - "protobuf/**"
-      - ".github/workflows/ci-test-go.yml"
-      - "pkg/KubeArmorOperator/**"
-  pull_request:
-    branches: [main]
-    paths:
-      - "KubeArmor/**"
-      - "tests/**"
-      - "protobuf/**"
-      - ".github/workflows/ci-test-go.yml"
-      - "pkg/KubeArmorOperator/**"
+  workflow_call:
 
 # Declare default permissions as read only.
 permissions: read-all
@@ -101,13 +86,3 @@ jobs:
       - name: Run go test on the KubeArmor/KubeArmor directory
         run: go test ./...
         working-directory: KubeArmor
-
-  license:
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
-      - name: Check License Header
-        uses: apache/skywalking-eyes@ed436a5593c63a25f394ea29da61b0ac3731a9fe
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -1,21 +1,7 @@
 name: ci-test-operator
 
 on:
-  push:
-    branches:
-      - "main"
-    paths:
-      - "pkg/**"
-      - "deployments/get/**"
-      - "KubeArmor/utils/**"
-  pull_request:
-    branches:
-      - "main"
-    paths:
-      # test on dep or helm changes
-      - "pkg/**"
-      - "deployments/**"
-      - "KubeArmor/utils/**"
+  workflow_call:
 
 # Declare default permissions as read only.
 permissions: read-all

@@ -0,0 +1,182 @@
+name: KubeArmor CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions: read-all
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+
+  detect-changes:
+    name: "Detect changed files"
+    runs-on: ubuntu-latest
+    outputs:
+      go: ${{ steps.filter.outputs.go_any_changed }}
+      ebpf: ${{ steps.filter.outputs.ebpf_any_changed }}
+      codespell: ${{ steps.filter.outputs.codespell_any_changed }}
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Filter Repository Paths
+        uses: tj-actions/changed-files@v44
+        id: filter
+        with:
+          files_yaml: |
+            go:
+              - 'KubeArmor/**'
+              - 'pkg/**'
+              - 'protobuf/**'
+              - 'deployments/helm/**'
+              - 'deployments/get/**'
+              - 'tests/**'
+              - 'examples/multiubuntu/build/**'
+              - '.github/workflows/ci-test-go.yml'
+              - '.github/workflows/ci-test-ubi-image.yml'
+              - '.github/workflows/ci-test-ginkgo.yml'
+              - '.github/workflows/ci-test-systemd.yml'
+              - '.github/workflows/ci-test-network-tests.yml'
+              - '.github/workflows/ci-test-controllers.yml'
+              - '.github/workflows/ci-test-operator.yaml'
+            ebpf:
+              - 'KubeArmor/BPF/**'
+              - '.github/workflows/ci-test-ebpf.yml'
+              - 'KubeArmor/enforcer/**/*.o'
+            codespell:
+              - '.codespellrc'
+              - '.github/workflows/ci-codespell.yml'
+              - '**/*.go'
+              - '**/*.md'
+              - '**/*.yaml'
+              - '**/*.yml'
+              - '**/*.sh'
+              - '**/*.txt'
+              - '**/*.c'
+              - '**/*.h'
+
+  license:
+    name: "License Header"
+    needs: [detect-changes]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Check License Header
+        uses: apache/skywalking-eyes@ed436a5593c63a25f394ea29da61b0ac3731a9fe
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  codespell:
+    name: "Spell Check"
+    needs: [detect-changes]
+    if: ${{ needs.detect-changes.outputs.codespell == 'true' }}
+    uses: ./.github/workflows/ci-codespell.yml
+
+  go-tests:
+    name: "Go Tests"
+    if: |
+      always() &&
+      (needs.codespell.result == 'success' || needs.codespell.result == 'skipped') &&
+      (needs.license.result == 'success') &&
+      needs.detect-changes.outputs.go == 'true'
+    needs: [detect-changes, license, codespell]
+    uses: ./.github/workflows/ci-test-go.yml
+
+  ebpf-tests:
+    name: "eBPF Tests"
+    if: |
+      always() &&
+      (needs.codespell.result == 'success' || needs.codespell.result == 'skipped') &&
+      (needs.license.result == 'success') &&
+      needs.detect-changes.outputs.ebpf == 'true'
+    needs: [detect-changes, license, codespell]
+    uses: ./.github/workflows/ci-test-ebpf.yml
+
+  matrix-tests:
+    name: "Ginkgo Tests - K8s"
+    needs: [detect-changes, go-tests, ebpf-tests]
+    if: |
+      always() &&
+      (needs.go-tests.result == 'success' || needs.go-tests.result == 'skipped') &&
+      (needs.ebpf-tests.result == 'success' || needs.ebpf-tests.result == 'skipped') &&
+      (needs.go-tests.result == 'success' || needs.ebpf-tests.result == 'success')
+    uses: ./.github/workflows/ci-test-ginkgo.yml
+
+  matrix-tests-ubi:
+    name: "Ginkgo Tests (UBI) - K8s"
+    needs: [detect-changes, go-tests, ebpf-tests]
+    if: |
+      always() &&
+      (needs.go-tests.result == 'success' || needs.go-tests.result == 'skipped') &&
+      (needs.ebpf-tests.result == 'success' || needs.ebpf-tests.result == 'skipped') &&
+      (needs.go-tests.result == 'success' || needs.ebpf-tests.result == 'success')
+    uses: ./.github/workflows/ci-test-ubi-image.yml
+
+  matrix-tests-systemd:
+    name: "Ginkgo Tests - Systemd"
+    needs: [detect-changes, go-tests, ebpf-tests]
+    if: |
+      always() &&
+      (needs.go-tests.result == 'success' || needs.go-tests.result == 'skipped') &&
+      (needs.ebpf-tests.result == 'success' || needs.ebpf-tests.result == 'skipped') &&
+      (needs.go-tests.result == 'success' || needs.ebpf-tests.result == 'success')
+    uses: ./.github/workflows/ci-test-systemd.yml
+
+  matrix-tests-network:
+    name: "Ginkgo Tests (Network) - K8s"
+    needs: [detect-changes, go-tests, ebpf-tests]
+    if: |
+      always() &&
+      (needs.go-tests.result == 'success' || needs.go-tests.result == 'skipped') &&
+      (needs.ebpf-tests.result == 'success' || needs.ebpf-tests.result == 'skipped') &&
+      (needs.go-tests.result == 'success' || needs.ebpf-tests.result == 'success')
+    uses: ./.github/workflows/ci-network-tests.yml
+
+  matrix-tests-controller:
+    name: "Ginkgo Tests (Controller) - K8s"
+    needs: [detect-changes, go-tests, ebpf-tests]
+    if: |
+      always() &&
+      (needs.go-tests.result == 'success' || needs.go-tests.result == 'skipped') &&
+      (needs.ebpf-tests.result == 'success' || needs.ebpf-tests.result == 'skipped') &&
+      (needs.go-tests.result == 'success' || needs.ebpf-tests.result == 'success')
+    uses: ./.github/workflows/ci-test-controllers.yml
+
+  build-test-operator:
+    name: "Build Test - Operator"
+    needs: [detect-changes, go-tests, ebpf-tests]
+    if: |
+      always() &&
+      (needs.go-tests.result == 'success' || needs.go-tests.result == 'skipped') &&
+      (needs.ebpf-tests.result == 'success' || needs.ebpf-tests.result == 'skipped') &&
+      (needs.go-tests.result == 'success' || needs.ebpf-tests.result == 'success')
+    uses: ./.github/workflows/ci-test-operator.yaml
+
+  matrix-composite-result:
+    name: Matrix Tests - Composite result
+    if: ${{ always() }}
+    needs: 
+      - matrix-tests
+      - matrix-tests-ubi
+      - matrix-tests-systemd
+      - matrix-tests-network
+      - matrix-tests-controller
+      - build-test-operator
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          # If any required matrix job failed, this job fails.
+          # If they were successfully executed or cleanly skipped, this job passes.
+          if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" || "${{ contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
+            echo "One or more matrix tests failed or were cancelled."
+            exit 1
+          else
+            echo "All matrix tests passed or were safely skipped."
+            exit 0
+          fi