generic-plugins.yml

name: Generic Plugins

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

on:
  workflow_dispatch:
  pull_request:
    paths:
      - 'rust-plugins/**'
      - 'packaging/centreon-plugin-*-snmp-rs/**'
      - 'tests/resources/**'
      - 'tests/os/linux/snmp/**'
      - 'tests/os/windows/snmp/**'
  push:
    branches:
      - develop
      - master
    tags:
      - 'plugins-*'
    paths:
      - 'rust-plugins/**'
      - 'packaging/centreon-plugin-*-snmp-rs/**'
      - 'tests/resources/**'
      - 'tests/os/linux/snmp/**'
      - 'tests/os/windows/snmp/**'

jobs:
  dependency-scan:
    uses: centreon/security-tools/.github/workflows/dependency-analysis.yml@main

  get-environment:
    needs: [dependency-scan]
    uses: ./.github/workflows/get-environment.yml
    with:
      version_file: rust-plugins/Cargo.toml

  build:
    needs: [get-environment]
    if: |
      needs.get-environment.outputs.skip_workflow == 'false' &&
      needs.get-environment.outputs.stability != 'stable' &&
      ! cancelled()
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            arch: amd64
            target: x86_64-unknown-linux-musl
          - runner: ubuntu-24.04-arm
            arch: arm64
            target: aarch64-unknown-linux-musl
    runs-on: ${{ matrix.runner }}

    name: "Build the generic plugins ${{ matrix.arch }}"

    steps:
      - name: Checkout sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Unit tests
        run: |
          cd rust-plugins
          cargo test
        shell: bash

      # The binary is built once per architecture and packaged for every supported distribution,
      # so it must not depend on the glibc of the runner: the oldest distribution we ship to (el8)
      # provides glibc 2.28 while ubuntu-24.04 provides 2.39, and glibc offers no forward
      # compatibility. Linking statically against musl removes the dependency on the system libc
      # entirely.
      # Each architecture is built natively rather than cross-compiled, because the default linker
      # of the musl targets is the host cc, which cannot link objects of a foreign architecture.
      - name: Build optimized binary
        run: |
          cd rust-plugins
          rustup target add ${{ matrix.target }}
          cargo build --release --target ${{ matrix.target }}
          # Keep the artifact where the cache, the nfpm configuration and the test job expect it.
          mkdir -p target/release
          cp target/${{ matrix.target }}/release/centreon-plugin-rust-snmp target/release/
        shell: bash

      - name: Check the binary has no dynamic dependency
        run: |
          cd rust-plugins
          # A statically linked binary has no NEEDED entry. Do not rely on `file`, which reports
          # "static-pie linked" rather than "statically linked" for this target.
          if objdump -p target/release/centreon-plugin-rust-snmp | grep NEEDED; then
            echo "::error::Binary links against shared libraries and will not run on every supported distribution"
            exit 1
          fi
          echo "Binary is statically linked, it does not depend on the system libc"
        shell: bash

      - name: Save binary to cache
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: rust-plugins/target/release/
          key: ${{ github.sha }}-${{ github.run_id }}-build-generic-plugins-${{ matrix.arch }}

      # Add to your PR the label upload-artifacts to get the binaries as artifacts
      - if: ${{ contains(github.event.pull_request.labels.*.name, 'upload-artifacts') }}
        name: Upload binary artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: binaries-${{ matrix.arch }}
          path: rust-plugins/target/release/centreon-plugin-rust-snmp
          retention-days: 1

  package:
    needs: [get-environment, build]
    if: |
      needs.get-environment.outputs.skip_workflow == 'false' &&
      needs.get-environment.outputs.stability != 'stable' &&
      ! cancelled()
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        # `arch` is the architecture name stamped into the package metadata, which differs
        # between packagers (x86_64/aarch64 for rpm, amd64/arm64 for deb), while `binary_arch`
        # selects which build cache the binary is restored from.
        # The container always runs on amd64: nfpm only writes metadata and does not need to run
        # on the target architecture.
        include:
          - package_extension: rpm
            image: packaging-plugins-alma8
            distrib: el8
            arch: x86_64
            binary_arch: amd64
          - package_extension: rpm
            image: packaging-plugins-alma9
            distrib: el9
            arch: x86_64
            binary_arch: amd64
          - package_extension: rpm
            image: packaging-plugins-alma10
            distrib: el10
            arch: x86_64
            binary_arch: amd64
          - package_extension: deb
            image: packaging-plugins-bookworm
            distrib: bookworm
            arch: amd64
            binary_arch: amd64
          - package_extension: deb
            image: packaging-plugins-bookworm
            distrib: bookworm
            arch: arm64
            binary_arch: arm64
          - package_extension: deb
            image: packaging-plugins-trixie
            distrib: trixie
            arch: amd64
            binary_arch: amd64
          - package_extension: deb
            image: packaging-plugins-trixie
            distrib: trixie
            arch: arm64
            binary_arch: arm64
          - package_extension: deb
            image: packaging-plugins-jammy
            distrib: jammy
            arch: amd64
            binary_arch: amd64
          - package_extension: deb
            image: packaging-plugins-jammy
            distrib: jammy
            arch: arm64
            binary_arch: arm64
          - package_extension: deb
            image: packaging-plugins-noble
            distrib: noble
            arch: amd64
            binary_arch: amd64
          - package_extension: deb
            image: packaging-plugins-noble
            distrib: noble
            arch: arm64
            binary_arch: arm64

    container:
      image: ${{ vars.DOCKER_INTERNAL_REGISTRY_URL }}/${{ matrix.image }}
      credentials:
        username: ${{ secrets.HARBOR_CENTREON_PULL_USERNAME }}
        password: ${{ secrets.HARBOR_CENTREON_PULL_TOKEN }}

    name: Package ${{ matrix.distrib }} ${{ matrix.arch }}

    steps:
      - name: Checkout sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Restore binary from cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: rust-plugins/target/release/
          key: ${{ github.sha }}-${{ github.run_id }}-build-generic-plugins-${{ matrix.binary_arch }}
          fail-on-cache-miss: true

      - name: Build package
        uses: ./.github/actions/package-nfpm
        with:
          nfpm_file_pattern: "rust-plugins/packaging/centreon-generic-plugins.yaml"
          distrib: ${{ matrix.distrib }}
          package_extension: ${{ matrix.package_extension }}
          version: ${{ needs.get-environment.outputs.version }}
          release: 1
          arch: ${{ matrix.arch }}
          commit_hash: ${{ github.sha }}
          cache_key: ${{ github.sha }}-${{ github.run_id }}-${{ matrix.package_extension }}-generic-plugins-${{ matrix.distrib }}-${{ matrix.arch }}
          rpm_gpg_key: ${{ secrets.RPM_GPG_SIGNING_KEY }}
          rpm_gpg_signing_key_id: ${{ secrets.RPM_GPG_SIGNING_KEY_ID }}
          rpm_gpg_signing_passphrase: ${{ secrets.RPM_GPG_SIGNING_PASSPHRASE }}
          stability: ${{ needs.get-environment.outputs.stability }}

      # The architecture must be part of the key: two rows of the matrix share the same
      # distribution, and the cache silently keeps the first write on an existing key, which
      # would deliver the wrong architecture.
      - name: Save to cache
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ./*.${{ matrix.package_extension }}
          key: ${{ github.sha }}-${{ github.run_id }}-${{ matrix.package_extension }}-${{ matrix.distrib }}-${{ matrix.arch }}

  test-generic-plugins:
    needs: [get-environment, build]
    if: |
      needs.get-environment.outputs.skip_workflow == 'false' &&
      needs.get-environment.outputs.stability != 'stable' &&
      ! cancelled()
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            arch: amd64
          - runner: ubuntu-24.04-arm
            arch: arm64
    runs-on: ${{ matrix.runner }}

    container:
      # Multi-platform manifest built by docker-builder-testing-plugins.yml: the architecture
      # of the runner selects the matching variant.
      image: ghcr.io/${{ github.repository }}/testing:bookworm

    name: Run robot tests ${{ matrix.arch }}

    steps:
      - name: Checkout sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Restore binary from cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: rust-plugins/target/release/
          key: ${{ github.sha }}-${{ github.run_id }}-build-generic-plugins-${{ matrix.arch }}
          fail-on-cache-miss: true

      - name: Start SNMP simulator and run robot tests
        run: |
          mkdir -p /var/lib/snmp/cert_indexes/
          useradd snmp || true
          snmpsim-command-responder --logging-method=null --agent-udpv4-endpoint=127.0.0.1:2024 --process-user=snmp --process-group=snmp --data-dir='./tests' &
          # waiting till localhost is listening on UDP port 2024
          timeout 60  bash -c 'while : ; do
              # 0100007F:07E8 is 127.0.0.1:2024 in HEX
              grep " 0100007F:07E8 " /proc/net/udp >/dev/null && break
              sleep 0.5
          done ; echo "snmpsim is listening"' || exit 1
          # Test all tests that use the rust plugin
          robot --include centreon-plugin-rust-snmp --exclude notauto --outputdir /tmp/robot-tests ./tests
        shell: bash

      - name: Upload logs as artifacts if tests failed
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: test-generic-plugins-log-${{ matrix.arch }}
          path: /tmp/robot-tests
          retention-days: 1

  deliver-packages:
    needs: [get-environment, build, package, test-generic-plugins]
    if: |
      needs.get-environment.outputs.skip_workflow == 'false' &&
      (contains(fromJson('["testing", "unstable"]'), needs.get-environment.outputs.stability) || ( needs.get-environment.outputs.stability == 'stable' && github.event_name != 'workflow_dispatch')) &&
      ! cancelled() &&
      ! contains(needs.*.result, 'failure') &&
      ! contains(needs.*.result, 'cancelled')
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - distrib: el8
            package_extension: rpm
            arch: x86_64
          - distrib: el9
            package_extension: rpm
            arch: x86_64
          - distrib: el10
            package_extension: rpm
            arch: x86_64
          - distrib: bookworm
            package_extension: deb
            arch: amd64
          - distrib: bookworm
            package_extension: deb
            arch: arm64
          - distrib: trixie
            package_extension: deb
            arch: amd64
          - distrib: trixie
            package_extension: deb
            arch: arm64
          - distrib: jammy
            package_extension: deb
            arch: amd64
          - distrib: jammy
            package_extension: deb
            arch: arm64
          - distrib: noble
            package_extension: deb
            arch: amd64
          - distrib: noble
            package_extension: deb
            arch: arm64

    name: deliver ${{ matrix.distrib }} ${{ matrix.arch }}
    steps:
      - name: Checkout sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Delivery
        uses: ./.github/actions/package-delivery
        with:
          module_name: generic-plugins
          distrib: ${{ matrix.distrib }}
          arch: ${{ matrix.arch }}
          cache_key: ${{ github.sha }}-${{ github.run_id }}-${{ matrix.package_extension }}-${{ matrix.distrib }}-${{ matrix.arch }}
          stability: ${{ needs.get-environment.outputs.stability }}
          release_type: ${{ needs.get-environment.outputs.release_type }}
          artifactory_token: ${{ secrets.ARTIFACTORY_ACCESS_TOKEN }}

  deliver-packages-pulp:
    needs: [get-environment, build, package, test-generic-plugins]
    if: |
      needs.get-environment.outputs.skip_workflow == 'false' &&
      (contains(fromJson('["testing", "unstable"]'), needs.get-environment.outputs.stability) || ( needs.get-environment.outputs.stability == 'stable' && github.event_name != 'workflow_dispatch')) &&
      ! cancelled() &&
      ! contains(needs.*.result, 'failure') &&
      ! contains(needs.*.result, 'cancelled')
    runs-on: centreon-ubuntu-26.04-small
    permissions:
      contents: read
      id-token: write
      pull-requests: read
    strategy:
      fail-fast: false
      matrix:
        # package-delivery-pulp takes no arch input: each row simply restores the cache holding
        # its own architecture and uploads it.
        include:
          - distrib: el8
            package_extension: rpm
            arch: x86_64
          - distrib: el9
            package_extension: rpm
            arch: x86_64
          - distrib: el10
            package_extension: rpm
            arch: x86_64
          - distrib: bookworm
            package_extension: deb
            arch: amd64
          - distrib: bookworm
            package_extension: deb
            arch: arm64
          - distrib: trixie
            package_extension: deb
            arch: amd64
          - distrib: trixie
            package_extension: deb
            arch: arm64
          - distrib: jammy
            package_extension: deb
            arch: amd64
          - distrib: jammy
            package_extension: deb
            arch: arm64
          - distrib: noble
            package_extension: deb
            arch: amd64
          - distrib: noble
            package_extension: deb
            arch: arm64

    name: deliver ${{ matrix.distrib }} ${{ matrix.arch }} on pulp
    steps:
      - name: Checkout sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Deliver packages on Pulp
        if: ${{ contains(fromJson('["testing", "unstable"]'), needs.get-environment.outputs.stability) }}
        id: deliver_pulp
        uses: ./.github/actions/package-delivery-pulp
        with:
          module_name: generic-plugins
          repository_name: plugins
          distrib: ${{ matrix.distrib }}
          version: ""
          cache_key: ${{ github.sha }}-${{ github.run_id }}-${{ matrix.package_extension }}-${{ matrix.distrib }}-${{ matrix.arch }}
          stability: ${{ needs.get-environment.outputs.stability }}
          release_type: ${{ needs.get-environment.outputs.release_type }}
          is_cloud: "false"
          pulp_url: ${{ vars.PULP_API_URL }}
          pulp_content_url: ${{ vars.PULP_CONTENT_URL }}
          audience: ${{ vars.PULP_OIDC_AUDIENCE }}

      - name: Promote packages on Pulp
        if: ${{ needs.get-environment.outputs.stability == 'stable' && needs.get-environment.outputs.release_type != '' }}
        id: promote_pulp
        uses: ./.github/actions/promote-to-stable-pulp
        with:
          module_name: generic-plugins
          repository_name: plugins
          distrib: ${{ matrix.distrib }}
          major_version: ""
          stability: stable
          release_type: ${{ needs.get-environment.outputs.release_type }}
          is_cloud: "false"
          pulp_url: ${{ vars.PULP_API_URL }}
          pulp_content_url: ${{ vars.PULP_CONTENT_URL }}
          audience: ${{ vars.PULP_OIDC_AUDIENCE }}

  set-skip-label:
    needs: [get-environment, deliver-packages]
    if: |
      needs.get-environment.outputs.skip_workflow == 'false' &&
      ! cancelled() &&
      ! contains(needs.*.result, 'failure') &&
      ! contains(needs.*.result, 'cancelled')
    uses: ./.github/workflows/set-pull-request-skip-label.yml