versioned-security-agent.yml

# Daily workflow to run versioned tests with security agent enabled
# This also can be used to run versioned tests with a newer versioned of
# security agent since we pin it.

name: Versioned Tests w/ Security Agent

on:
  workflow_dispatch:
    inputs:
      mode:
        description: Versioned test mode
        type: choice
        options:
          - major
          - minor
        default: major
        required: false
      version:
        type: string
        description: Version of security agent to test
        required: false
  schedule:
    - cron:  '0 9 * * 1-5'
  pull_request:
    branches:
      - main

jobs:
  should_run:
    # Used to determine if the `@newrelic/security-agent` dependency has
    # been updated in any new pull requests. This job _must_ always run because
    # the `security-agent-tests` job depends on the outputs of this job. Thus,
    # we cannot put a conditional on this job to only run if the event name
    # is "pull_request".
    name: Should Run
    runs-on: ubuntu-latest
    outputs:
      previous_version: ${{steps.versions.outputs.PREVIOUS_VAL}}
      current_version: ${{steps.versions.outputs.CURRENT_VAL}}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2
      - uses: tj-actions/changed-files@v44
        id: changed_files
        with:
          files: package.json
      - name: Get dependency versions
        id: versions
        if: steps.changed_files.outputs.any_changed == 'true'
        run: |
          current_val=$(cat package.json | jq -r --arg pkg "@newrelic/security-agent" '.dependencies[$pkg]')
          echo "current_val=${current_val}" >> $GITHUB_OUTPUT
          
          git checkout origin/${{github.base_ref || 'main'}}
          previous_val=$(cat package.json | jq -r --arg pkg "@newrelic/security-agent" '.dependencies[$pkg]')
          echo "previous_val=${previous_val}" >> $GITHUB_OUTPUT
          
          git checkout ${{github.sha}}

  security-agent-tests:
    needs: [should_run]
    if: github.event_name == 'workflow_dispatch' ||
      github.event_name == 'schedule' ||
      needs.should_run.outputs.previous_version != needs.should_run.outputs.current_version

    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        node-version: [16.x, 18.x, 20.x]

    steps:
    - uses: actions/checkout@v3
    - name: Use Node.js ${{ matrix.node-version }}
      uses: actions/setup-node@v3
      with:
        node-version: ${{ matrix.node-version }}
    - name: Install Dependencies
      run: npm ci
    - name: Install Version ${{ inputs.version }} of security agent
      if: ${{ inputs.version }}
      run: npm install @newrelic/security-agent@${{ inputs.version }}
    - name: Run Docker Services
      run: npm run services
    - name: Versioned Tests w/ Security Agent
      run: TEST_CHILD_TIMEOUT=600000 npm run versioned:security
      env:
        VERSIONED_MODE: --${{ inputs.mode || 'major' }}
        JOBS: 4 # 2 per CPU seems to be the sweet spot in GHA (July 2022)
        SKIP_C8: true