unit-tests.yaml

# SPDX-License-Identifier: Apache-2.0

name: "Run unit tests via Tox::pytest"
# This tests should run only those tests that are marked as 'fast.'
# The opposite are those that would require the mark 'slow,' which would
# include longer-running integration and smoke tests.
#
# Essentially, this workflow should be used frequently for cheap tests,
# and a 'slow' marked workflow will be used later in review, manually triggered,
# to verify integration correctness.

on:
  # run against every merge commit to 'main' and release branches
  push:
    branches:
      - main
      - release-*
  # only run on PRs that touch certain regex paths
  pull_request_target:
    branches:
      - main
      - release-*
    paths:
      # note this should match the merging criteria in 'mergify.yml'
      - "**.py"
      - "pyproject.toml"
      - "requirements**.txt"
      - ".github/workflows/unit-tests.yaml" # This workflow

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

defaults:
  run:
    shell: bash

env:
  pytest_mark: "fast"
  ec2_runner_variant: "m7i.xlarge" # 4 Xeon CPU, 16GB RAM

jobs:
  start-ec2-runner:
    runs-on: ubuntu-latest
    outputs:
      label: ${{ steps.start-ec2-runner.outputs.label }}
      ec2-instance-id: ${{ steps.start-ec2-runner.outputs.ec2-instance-id}}

    steps:
      - name: "Harden runner"
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.1
        with:
          egress-policy: audit

      - name: "Configure AWS credentials"
        uses: "aws-actions/configure-aws-credentials@4fc4975a852c8cd99761e2de1f4ba73402e44dd9" # v4.0.3
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ vars.AWS_REGION }}

      - name: "Start EC2 runner"
        id: start-ec2-runner
        uses: machulav/ec2-github-runner@28fbe1c4d7d9ba74134ca5ebc559d5b0a989a856 # v2.3.8
        with:
          mode: start
          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
          ec2-image-id: ${{ vars.AWS_EC2_AMI }}
          ec2-instance-type: ${{ env.ec2_runner_variant }}
          subnet-id: subnet-024298cefa3bedd61
          security-group-id: sg-06300447c4a5fbef3
          iam-role-name: instructlab-ci-runner
          aws-resource-tags: >
            [
            {"Key": "Name", "Value": "instructlab-ci-github-unittest-runner"},
            {"Key": "GitHubRepository", "Value": "${{ github.repository }}"},
            {"Key": "GitHubRef", "Value": "${{ github.ref }}"},
            {"Key": "GitHubPR", "Value": "${{ github.event.number }}"}
            ]

  run-unit-tests:
    needs:
      - start-ec2-runner
    runs-on: ${{needs.start-ec2-runner.outputs.label}}
    # It is important that this job has no write permissions and has
    # no access to any secrets. This part is where we are running
    # untrusted code from PRs.
    permissions: {}
    steps:
      - name: "Harden runner"
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.1
        with:
          egress-policy: audit

      - name: "Install packages"
        run: |
          cat /etc/os-release
          sudo dnf install -y gcc gcc-c++ make git python3.11 python3.11-devel

      - name: "Checkout code"
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      # installs in $GITHUB_WORKSPACE/venv.
      # only has to install Tox because Tox will do the other virtual environment management.
      - name: "Setup Python virtual environment"
        run: |
          python3.11 -m venv --upgrade-deps venv
          . venv/bin/activate
          pip install tox

      - name: "Show disk utilization BEFORE tests"
        run: |
          df -h

      - name: "Run unit tests with Tox and Pytest"
        run: |
          source venv/bin/activate
          tox -e py3-unit -- -m ${{env.pytest_mark}}

      - name: "Show disk utilization AFTER tests"
        run: |
          df -h

  stop-ec2-runner:
    needs:
      - start-ec2-runner
      - run-unit-tests
    runs-on: ubuntu-latest
    if: ${{ always() }}
    steps:
      - name: "Harden runner"
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.1
        with:
          egress-policy: audit

      - name: "Configure AWS credentials"
        uses: "aws-actions/configure-aws-credentials@4fc4975a852c8cd99761e2de1f4ba73402e44dd9" # v4.0.3
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ vars.AWS_REGION }}

      - name: "Stop EC2 runner"
        uses: machulav/ec2-github-runner@28fbe1c4d7d9ba74134ca5ebc559d5b0a989a856 # v2.3.8
        with:
          mode: stop
          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
          label: ${{ needs.start-ec2-runner.outputs.label }}
          ec2-instance-id: ${{ needs.start-ec2-runner.outputs.ec2-instance-id }}