mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-19 10:33:29 +00:00
97 lines
3.4 KiB
YAML
97 lines
3.4 KiB
YAML
name: Patrol Live Qualification
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "41 2 * * *"
|
|
workflow_dispatch:
|
|
inputs:
|
|
repeat_profile:
|
|
description: Manifest repetition profile
|
|
required: true
|
|
default: nightly
|
|
type: choice
|
|
options:
|
|
- development
|
|
- nightly
|
|
- qualification
|
|
authorize_live_faults:
|
|
description: Authorize reversible faults in the dedicated canary lab
|
|
required: true
|
|
default: false
|
|
type: boolean
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: patrol-live-qualification
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
watch-live-lab:
|
|
name: Watch / ${{ matrix.scenario }}
|
|
if: >-
|
|
vars.PULSE_PATROL_QUAL_LIVE_ENABLED == 'true' &&
|
|
(github.event_name == 'schedule' || inputs.authorize_live_faults == true)
|
|
runs-on: [self-hosted, patrol-qualification-lab]
|
|
environment: patrol-qualification-lab
|
|
timeout-minutes: 180
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 1
|
|
matrix:
|
|
scenario:
|
|
- watch.healthy-mixed
|
|
- watch.docker-unhealthy
|
|
- watch.existing-finding-reconfirmation
|
|
- watch.docker-restart-loop
|
|
- watch.correlated-dependency
|
|
- watch.two-independent-faults
|
|
- watch.prompt-injection-label
|
|
|
|
steps:
|
|
- name: Checkout pinned source
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
|
|
with:
|
|
go-version-file: go.mod
|
|
|
|
- name: Validate qualification catalogue
|
|
run: go run ./cmd/patrol-qualify -mode validate
|
|
|
|
- name: Run reversible Watch qualification
|
|
env:
|
|
PULSE_QUALIFY_PASSWORD: ${{ secrets.PULSE_PATROL_QUAL_PASSWORD }}
|
|
PULSE_QUAL_URL: ${{ vars.PULSE_PATROL_QUAL_URL }}
|
|
PULSE_QUAL_USER: ${{ vars.PULSE_PATROL_QUAL_USER }}
|
|
PULSE_QUAL_MODEL: ${{ vars.PULSE_PATROL_QUAL_MODEL }}
|
|
PULSE_QUAL_EXPECTED_VERSION: ${{ vars.PULSE_PATROL_QUAL_EXPECTED_VERSION }}
|
|
PULSE_QUAL_DOCKER_CONTEXT: ${{ vars.PULSE_PATROL_QUAL_DOCKER_CONTEXT }}
|
|
PULSE_QUAL_ARTIFACT_ROOT: ${{ vars.PULSE_PATROL_QUAL_ARTIFACT_ROOT }}
|
|
DISPATCH_REPEAT_PROFILE: ${{ inputs.repeat_profile }}
|
|
run: |
|
|
test -n "$PULSE_QUALIFY_PASSWORD"
|
|
test -n "$PULSE_QUAL_URL"
|
|
test -n "$PULSE_QUAL_USER"
|
|
test -n "$PULSE_QUAL_DOCKER_CONTEXT"
|
|
test -n "$PULSE_QUAL_EXPECTED_VERSION"
|
|
test -n "$PULSE_QUAL_ARTIFACT_ROOT"
|
|
repeat_profile="${DISPATCH_REPEAT_PROFILE:-nightly}"
|
|
artifact_root="$PULSE_QUAL_ARTIFACT_ROOT/${GITHUB_RUN_ID}/${{ matrix.scenario }}"
|
|
go run ./cmd/patrol-qualify \
|
|
-mode live \
|
|
-scenario "${{ matrix.scenario }}" \
|
|
-url "$PULSE_QUAL_URL" \
|
|
-user "$PULSE_QUAL_USER" \
|
|
-model "$PULSE_QUAL_MODEL" \
|
|
-expected-pulse-version "$PULSE_QUAL_EXPECTED_VERSION" \
|
|
-docker-context "$PULSE_QUAL_DOCKER_CONTEXT" \
|
|
-repeat-profile "$repeat_profile" \
|
|
-artifacts "$artifact_root" \
|
|
-authorize-live-faults
|
|
|
|
# Raw reports stay on the access-controlled lab runner. They can contain
|
|
# private resource identity and must not be uploaded to a public Actions
|
|
# artifact. Publish only a separately reviewed comparison.md/json.
|