ROX-29003: Add ACS smoke test

.github/workflows/acs-smoke-test.yml

@@ -0,0 +1,152 @@
+name: "ACS Smoke Test"
+
+on:
+  # TODO: remove pull_request trigger before merging
+  pull_request:
+    branches: [master]
+  workflow_dispatch:
+    inputs:
+      operator-index-image:
+        description: 'ACS Operator index image (e.g., quay.io/rhacs-eng/stackrox-operator-index:ocp-v4-22-...)'
+        required: true
+        type: string
+      acs-version:
+        description: 'ACS minor version under test (e.g. 4.10). Determines channel and Y-2 oldest.'
+        required: true
+        type: string
+      cluster-lifespan:
+        description: 'Cluster lifespan (e.g., 2h, 4h, 8h)'
+        required: false
+        default: '2h'
+        type: string
+  workflow_call:
+    inputs:
+      operator-index-image:
+        description: 'ACS Operator index image'
+        required: true
+        type: string
+      acs-version:
+        description: 'ACS minor version under test (e.g. 4.10). Determines channel and Y-2 oldest.'
+        required: true
+        type: string
+      cluster-lifespan:
+        description: 'Cluster lifespan (e.g., 2h, 4h, 8h)'
+        required: false
+        default: '2h'
+        type: string
+
+env:
+  CLUSTER_NAME: smoke-${{ github.run_number }}
+  GH_TOKEN: ${{ github.token }}
+  GH_NO_UPDATE_NOTIFIER: 1
+
+run-name: >-
+  ${{ format('ACS Smoke Test - {0}', inputs.operator-index-image) }}
+
+jobs:
+  create-cluster:
+    name: Create OpenShift cluster
+    runs-on: ubuntu-latest
+    outputs:
+      cluster-name: ${{ steps.info.outputs.name }}
+    steps:
+      - name: Set cluster name
+        id: info
+        run: echo "name=${{ env.CLUSTER_NAME }}" >> "$GITHUB_OUTPUT"
+
+      - name: Create OpenShift cluster
+        uses: stackrox/actions/infra/create-cluster@v1
+        with:
+          token: ${{ secrets.INFRA_TOKEN }}
+          flavor: openshift-4
+          name: ${{ env.CLUSTER_NAME }}
+          lifespan: ${{ inputs.cluster-lifespan || '2h' }}
+          wait: true
+
+  run-smoke-tests:
+    name: Run ACS smoke tests
+    needs: create-cluster
+    runs-on: ubuntu-latest
+    container:
+      image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.11@sha256:df3459cf038e73775314b3a5d36d14dda41e6df438a0273c9efa8d23e0f2358a
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v7
+
+      - name: Install infractl
+        uses: stackrox/actions/infra/install-infractl@v1
+
+      - name: Download cluster kubeconfig
+        run: |
+          infractl artifacts \
+            --download-dir=./artifacts \
+            ${{ needs.create-cluster.outputs.cluster-name }}
+
+      - name: Set KUBECONFIG
+        run: echo "KUBECONFIG=${{ github.workspace }}/artifacts/kubeconfig" >> "$GITHUB_ENV"
+
+      - name: "Test 1: upgrade oldest-supported → provided"
+        working-directory: ./smoke-test
+        env:
+          # Add a || operator-index image and version for testing in the PR.
+          # TODO: remove before merging!
+          OPERATOR_INDEX_IMAGE: ${{ inputs.operator-index-image || 'quay.io/rhacs-eng/stackrox-operator-index:ocp-v4-22-7a9fcba929e5858cca91a84c3e5da8c829a3c990-fast' }}
+          ACS_VERSION: ${{ inputs.acs-version || '4.11' }}
+        run: bash upgrade-oldest-test.sh
+
+      - name: Reset operator state between tests
+        working-directory: ./smoke-test
+        run: |
+          source lib.sh
+          reset_operator
+        shell: bash
+
+      - name: "Test 2: install provided → optionally upgrade to latest GA"
+        working-directory: ./smoke-test
+        env:
+          # Add a || operator-index image and version for testing in the PR.
+          # TODO: remove before merging!
+          OPERATOR_INDEX_IMAGE: ${{ inputs.operator-index-image || 'quay.io/rhacs-eng/stackrox-operator-index:ocp-v4-22-7a9fcba929e5858cca91a84c3e5da8c829a3c990-fast' }}
+          ACS_VERSION: ${{ inputs.acs-version || '4.11' }}
+        run: bash upgrade-latest-test.sh
+
+  cleanup-cluster:
+    name: Cleanup cluster
+    needs: [create-cluster, run-smoke-tests]
+    runs-on: ubuntu-latest
+    if: always() && needs.create-cluster.result != 'cancelled'
+    steps:
+      - name: Install infractl
+        uses: stackrox/actions/infra/install-infractl@v1
+
+      - name: Authenticate to GCP
+        uses: google-github-actions/auth@v3
+        with:
+          credentials_json: ${{ secrets.GCP_RELEASE_AUTOMATION_SA }}
+
+      - name: Delete cluster
+        run: infractl delete ${{ needs.create-cluster.outputs.cluster-name }}
+
+  report-status:
+    name: Report test status
+    needs: [create-cluster, run-smoke-tests, cleanup-cluster]
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - name: Write summary
+        run: |
+          cat <<'EOF' >> "$GITHUB_STEP_SUMMARY"
+          # ACS Smoke Test Results
+
+          | Field | Value |
+          |-------|-------|
+          | **Operator image** | `${{ inputs.operator-index-image }}` |
+          | **Cluster** | `${{ needs.create-cluster.outputs.cluster-name }}` |
+          | **Create cluster** | ${{ needs.create-cluster.result }} |
+          | **Smoke tests** | ${{ needs.run-smoke-tests.result }} |
+          | **Cleanup** | ${{ needs.cleanup-cluster.result }} |
+
+          ## Tests run:
+          1. **Test 1** — install oldest supported ACS version, upgrade to the provided operator-index image
+          2. **Test 2** — install provided operator-index image, upgrade to latest GA if minor is behind
+          EOF

.github/workflows/auto-smoke-test.yml

@@ -0,0 +1,142 @@
+name: "Auto Smoke Test"
+
+on:
+  workflow_dispatch:
+    inputs:
+      acs-version-override:
+        description: 'Override ACS version, skips bundles.yaml diff (e.g. "4.10")'
+        required: false
+        type: string
+      operator-index-image-override:
+        description: 'Override operator-index image, skips Quay polling (e.g. quay.io/rhacs-eng/stackrox-operator-index:ocp-v4-22-...)'
+        required: false
+        type: string
+  push:
+    branches: [master]
+    paths: ['bundles.yaml']
+  pull_request:
+    paths: ['bundles.yaml']
+
+env:
+  # OCP version used to construct the Konflux-built operator-index image tag.
+  # Update when infra cluster uses a newer OCP version.
+  OCP_VERSION: v4-22
+
+jobs:
+  derive-inputs:
+    name: Derive smoke test inputs
+    runs-on: ubuntu-latest
+    outputs:
+      acs-version: ${{ steps.version.outputs.acs-version }}
+      operator-index-image: ${{ steps.image.outputs.operator-index-image }}
+      should-run: ${{ steps.version.outputs.should-run }}
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Determine ACS version
+        id: version
+        env:
+          ACS_VERSION_OVERRIDE: ${{ inputs.acs-version-override }}
+          OPERATOR_INDEX_IMAGE_OVERRIDE: ${{ inputs.operator-index-image-override }}
+          BASE_REF: ${{ github.base_ref }}
+          EVENT_NAME: ${{ github.event_name }}
+          BEFORE_SHA: ${{ github.event.before }}
+        run: |
+          # Image override without version override is ambiguous — fail fast.
+          if [ -n "$OPERATOR_INDEX_IMAGE_OVERRIDE" ] && [ -z "$ACS_VERSION_OVERRIDE" ]; then
+            echo "::error::operator-index-image-override requires acs-version-override to also be set"
+            exit 1
+          fi
+
+          if [ -n "$ACS_VERSION_OVERRIDE" ]; then
+            echo "acs-version=$ACS_VERSION_OVERRIDE" >> "$GITHUB_OUTPUT"
+            echo "should-run=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [ "$EVENT_NAME" = "pull_request" ]; then
+            DIFF_BASE="origin/$BASE_REF"
+          else
+            # Use event.before to capture all commits in the push, not just the tip commit.
+            DIFF_BASE="$BEFORE_SHA"
+            # event.before is all-zeros on first push to a branch; fall back to parent.
+            if [[ "$DIFF_BASE" =~ ^0+$ ]]; then
+              DIFF_BASE="HEAD~1"
+            fi
+          fi
+
+          # Exclude diff headers first, then match only the `version:` key (not
+          # `oldest_supported_version:` or other keys that contain "version").
+          NEW_VERSIONS=$(git diff "$DIFF_BASE" -- bundles.yaml \
+            | grep -v '^+++' \
+            | grep '^+[[:space:]]*version:' \
+            | sed 's/.*version:[[:space:]]*//' \
+            | sort -V || true)
+
+          if [ -z "$NEW_VERSIONS" ]; then
+            echo "No new versions found in bundles.yaml diff, skipping smoke test"
+            echo "should-run=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          LATEST=$(echo "$NEW_VERSIONS" | tail -1)
+          MINOR=$(echo "$LATEST" | cut -d. -f1-2)
+          echo "New versions added: $(echo "$NEW_VERSIONS" | tr '\n' ' '), testing minor: $MINOR"
+          echo "acs-version=$MINOR" >> "$GITHUB_OUTPUT"
+          echo "should-run=true" >> "$GITHUB_OUTPUT"
+
+      - name: Determine operator-index image
+        id: image
+        if: steps.version.outputs.should-run == 'true'
+        env:
+          OPERATOR_INDEX_IMAGE_OVERRIDE: ${{ inputs.operator-index-image-override }}
+        run: |
+          if [ -n "$OPERATOR_INDEX_IMAGE_OVERRIDE" ]; then
+            echo "operator-index-image=$OPERATOR_INDEX_IMAGE_OVERRIDE" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            SHA="${{ github.event.pull_request.head.sha }}"
+          else
+            SHA="${{ github.sha }}"
+          fi
+
+          TAG="ocp-${OCP_VERSION}-${SHA}-fast"
+          IMAGE="quay.io/rhacs-eng/stackrox-operator-index:${TAG}"
+          echo "Waiting for Konflux to build: $IMAGE"
+
+          for i in $(seq 1 40); do
+            if RESPONSE=$(curl -sf --max-time 30 --connect-timeout 10 \
+              "https://quay.io/api/v1/repository/rhacs-eng/stackrox-operator-index/tag/?specificTag=${TAG}"); then
+              FOUND=$(echo "$RESPONSE" | python3 -c \
+                "import json,sys; d=json.load(sys.stdin); print('true' if d.get('tags') else 'false')" \
+                2>/dev/null || echo 'false')
+              if [ "$FOUND" = "true" ]; then
+                echo "Image available after attempt $i: $IMAGE"
+                echo "operator-index-image=$IMAGE" >> "$GITHUB_OUTPUT"
+                exit 0
+              fi
+              echo "Attempt $i/40: image not yet in Quay, retrying in 3 minutes..."
+            else
+              echo "Attempt $i/40: Quay API request failed (network or HTTP error), retrying in 3 minutes..."
+            fi
+            [ "$i" -lt 40 ] && sleep 180
+          done
+
+          echo "Timed out after 2 hours waiting for: $IMAGE"
+          exit 1
+
+  smoke-test:
+    name: Run smoke test
+    needs: derive-inputs
+    if: needs.derive-inputs.outputs.should-run == 'true'
+    uses: ./.github/workflows/acs-smoke-test.yml
+    with:
+      operator-index-image: ${{ needs.derive-inputs.outputs.operator-index-image }}
+      acs-version: ${{ needs.derive-inputs.outputs.acs-version }}
+      cluster-lifespan: 3h
+    secrets: inherit