# !! WARNING, DO NOT EDIT !! This file is generated from the templates
# in /.semaphore/semaphore.yml.d. To update, modify the relevant
# template and then run 'make gen-semaphore-yaml'.
version: v1.0
name: Calico
execution_time_limit:
  hours: 4
agent:
  machine:
    type: f1-standard-2
    os_image: ubuntu2204
auto_cancel:
  running:
    when: "branch != 'master'"
  queued:
    when: "branch != 'master'"
global_job_config:
  secrets:
    - name: docker-hub
    - name: google-service-account-for-gce
  env_vars:
    - name: GOOGLE_PROJECT
      value: unique-caldron-775
    - name: GCS_BUILD_CACHE_BUCKET
      value: calico-transient-build-artifacts-europe-west3
  prologue:
    commands:
      - export CALICO_DIR_NAME=${SEMAPHORE_GIT_DIR}
      - export GCS_CACHE_DIR=gs://$GCS_BUILD_CACHE_BUCKET/cache/${CALICO_DIR_NAME}
      - export GCS_WORKFLOW_DIR=gs://$GCS_BUILD_CACHE_BUCKET/workflow/${SEMAPHORE_WORKFLOW_ID}
      - export GOOGLE_APPLICATION_CREDENTIALS=$HOME/secrets/secret.google-service-account-key.json
      - |-
        if [[ $(uname -m) != "x86_64" || -n "$ARCH" ]]; then
          echo "Non-x86_64 build: $(uname -m) / $ARCH";
          export BUILD_CACHE_GROUP=$BUILD_CACHE_GROUP-$(uname -m)-$ARCH;
        fi
      - gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS" || true
      - gcloud config set project ${GOOGLE_PROJECT} || true
      # Try to restore the working copy from the cache, if available. Then,
      # for PRs, also try to restore the build cache.  (We skip this on branch
      # builds to ensure branches build cleanly.)
      - sudo apt-get install -y zstd || true
      - restored_wc_cache=false
      - |-
        if [[ -n "${SEMAPHORE_GIT_BRANCH}" && -z "$SKIP_CACHE_RESTORE" ]]; then
          echo "Looking for cached working copy for branch ${SEMAPHORE_GIT_BRANCH}"
          gcs_branch_cache_dir="${GCS_CACHE_DIR}/${SEMAPHORE_GIT_BRANCH}"
          if gcloud storage cp "$gcs_branch_cache_dir/working-copy.tar.zstd" /tmp/working-copy.tar.zstd; then
            echo "Restoring cache for branch ${SEMAPHORE_GIT_BRANCH}"
            tar --use-compress-program=zstd -xf /tmp/working-copy.tar.zstd & tar_pid=$!
            downloaded_build_cache=false
            if [[ -n "$BUILD_CACHE_GROUP" && -n "${SEMAPHORE_GIT_PR_NUMBER}" ]]; then
              if gcloud storage cp "$gcs_branch_cache_dir/build-cache-${BUILD_CACHE_GROUP}.tar.zstd" /tmp/build-cache.tar.zstd; then
                echo "Found build cache for group ${BUILD_CACHE_GROUP}"
                downloaded_build_cache=true
              fi
            fi
            if wait $tar_pid; then
              restored_wc_cache=true
            else
              echo "ERROR: Failed to extract working copy"
              restored_wc_cache=false
            fi
            if ${downloaded_build_cache}; then
              echo "Extracting build cache"
              tar --use-compress-program=zstd -xf /tmp/build-cache.tar.zstd -C .
              rm /tmp/build-cache.tar.zstd
            fi
            cd "${CALICO_DIR_NAME}"
          fi
        fi || true
      - |-
        if [[ ${restored_wc_cache} != true && -z "$SKIP_CHECKOUT" ]]; then
          echo "No cache restored, doing a fresh checkout..."
          cd $HOME
          rm -rf "${CALICO_DIR_NAME}"
          git clone --filter=blob:none $SEMAPHORE_GIT_URL $CALICO_DIR_NAME
          cd "${CALICO_DIR_NAME}" || exit 1
        fi
      - |-
        if [[ -z "$SKIP_CHECKOUT" ]]; then
          git fetch origin --tags --prune-tags ${SEMAPHORE_GIT_SHA}
          if [ "$SEMAPHORE_GIT_REF_TYPE" = "branch" ]; then
            git checkout ${SEMAPHORE_GIT_SHA} -B "${SEMAPHORE_GIT_BRANCH}"
          else
            git checkout ${SEMAPHORE_GIT_SHA}
          fi
          CALICO_DIR="$(pwd)"
          export CALICO_DIR
          mkdir -p artifacts
        fi
      - echo $DOCKERHUB_PASSWORD | docker login --username "$DOCKERHUB_USERNAME" --password-stdin
  epilogue:
    commands:
      - cd $HOME
      - |-
        if [[ -z "${SEMAPHORE_GIT_PR_NUMBER}" && -n "$BUILD_CACHE_GROUP" && "$STORE_BUILD_CACHE" = "true" ]]; then
          echo "On branch, storing build cache group ${BUILD_CACHE_GROUP}"
          tar --use-compress-program="zstd -3" -cf /tmp/build-cache.tar.zstd go ${CALICO_DIR_NAME}/.go-pkg-cache
          gcs_branch_cache_dir="${GCS_CACHE_DIR}/${SEMAPHORE_GIT_BRANCH}"
          gcloud storage cp /tmp/build-cache.tar.zstd "$gcs_branch_cache_dir/build-cache-${BUILD_CACHE_GROUP}.tar.zstd"
        fi
      - cd "$CALICO_DIR"
      - .semaphore/publish-artifacts
promotions:
  # Manual promotion for publishing a hashrelease.
  - name: Publish hashrelease
    pipeline_file: release/hashrelease.yml
    parameters:
      env_vars:
        - required: true
          options:
            - "true"
            - "false"
          default_value: "false"
          description: "Build container images. If 'true', container images will be built as part of the hashrelease process."
          name: BUILD_CONTAINER_IMAGES
        - required: true
          options:
            - "true"
            - "false"
          default_value: "false"
          description: "create tarball of images. If 'true', a tarball of images will be added to the release.tgz. Requires BUILD_CONTAINER_IMAGES to also be 'true'."
          name: ARCHIVE_IMAGES
        - required: true
          options:
            - "true"
            - "false"
          default_value: "false"
          description: "publish images. If 'true', images will be pushed to the container registry/registries as part of the hashrelease process. Requires BUILD_CONTAINER_IMAGES to also be 'true'."
          name: PUBLISH_IMAGES
  # Manual promotion for publishing a release.
  - name: Publish official release
    pipeline_file: release/release.yml
  # Cleanup after ourselves if we are stopped-short.
  - name: Cleanup
    pipeline_file: cleanup.yml
    auto_promote:
      when: "result = 'stopped'"
  # Have separate promotions for publishing images so we can re-run
  # them individually if they fail, and so we can run them in parallel.
  - name: Push apiserver images
    pipeline_file: push-images/apiserver.yml
    auto_promote:
      when: "branch =~ 'master|release-.*'"
  - name: Push ALP images
    pipeline_file: push-images/alp.yml
    auto_promote:
      when: "branch =~ 'master|release-.*'"
  - name: Push calicoctl images
    pipeline_file: push-images/calicoctl.yml
    auto_promote:
      when: "branch =~ 'master|release-.*'"
  - name: Push calico-node images
    pipeline_file: push-images/node.yml
    auto_promote:
      when: "branch =~ 'master|release-.*'"
  - name: Push mock calico-node images
    pipeline_file: push-images/mock-node.yml
    auto_promote:
      when: "branch =~ 'master|release-'"
  - name: Push cni-plugin images
    pipeline_file: push-images/cni-plugin.yml
    auto_promote:
      when: "branch =~ 'master|release-.*'"
  - name: Push key-cert-provisioner images
    pipeline_file: push-images/key-cert-provisioner.yml
    auto_promote:
      when: "branch =~ 'master|release-.*'"
  - name: Push kube-controllers images
    pipeline_file: push-images/kube-controllers.yml
    auto_promote:
      when: "branch =~ 'master|release-.*'"
  - name: Push pod2daemon images
    pipeline_file: push-images/pod2daemon.yml
    auto_promote:
      when: "branch =~ 'master|release-.*'"
  - name: Push typha images
    pipeline_file: push-images/typha.yml
    auto_promote:
      when: "branch =~ 'master|release-.*'"
  - name: Push Goldmane images
    pipeline_file: push-images/goldmane.yml
    auto_promote:
      when: "branch =~ 'master|release-.*'"
  - name: Push Whisker images
    pipeline_file: push-images/whisker.yml
    auto_promote:
      when: "branch =~ 'master|release-.*'"
  - name: Push Whisker Backend images
    pipeline_file: push-images/whisker-backend.yml
    auto_promote:
      when: "branch =~ 'master|release-.*'"
  - name: Push Guardian images
    pipeline_file: push-images/guardian.yml
    auto_promote:
      when: "branch =~ 'master|release-.*'"
  - name: Push Envoy images
    pipeline_file: push-images/envoy.yml
    auto_promote:
      when: "branch =~ 'master|release-.*'"
  - name: Publish openstack packages
    pipeline_file: push-images/packaging.yaml
    auto_promote:
      when: "branch =~ 'master'"
  - name: Run Fossa scans
    pipeline_file: license-scanning/fossa-scan.yml
    auto_promote:
      when: "branch =~ 'master|release-.*'"
  - name: Push E2E images
    pipeline_file: push-images/e2e-test.yml
    auto_promote:
      when: "branch =~ 'master|release-.*'"
blocks:
  - name: Check images availability
    run:
      when: "true or (branch !~ 'build-v.*' and change_in(['/charts/', '/manifests/'], {pipeline_file: 'ignore'}))"
    dependencies: []
    task:
      jobs:
        - name: Check images availability
          commands:
            - make check-images-availability
  - name: Prerequisites
    run:
      when: "true or change_in(['/'], {pipeline_file: 'track'})"
    dependencies: []
    task:
      agent:
        machine:
          type: f1-standard-2
          os_image: ubuntu2204
      jobs:
        - name: Pre-flight checks
          commands:
            - make ci-preflight-checks
  - name: Store working copy
    run:
      when: "branch =~ '.*'"
    dependencies: []
    task:
      env_vars:
        - name: SKIP_CACHE_RESTORE
          value: "true"
      jobs:
        - name: Save working copy to cache
          commands:
            - cd ..
            - tar --use-compress-program="zstd -3" -cf /tmp/working-copy.tar.zstd $CALICO_DIR_NAME
            - gcs_branch_cache_dir="${GCS_CACHE_DIR}/${SEMAPHORE_GIT_BRANCH}"
            - gcloud storage cp /tmp/working-copy.tar.zstd "$gcs_branch_cache_dir/working-copy.tar.zstd"
  - name: API
    run:
      when: "true or change_in(['/metadata.mk', '/lib.Makefile', '/api/'], {pipeline_file: 'ignore', exclude: ['/**/.gitignore', '/**/README.md', '/**/LICENSE']})"
    execution_time_limit:
      minutes: 30
    dependencies:
      - Prerequisites
    task:
      prologue:
        commands:
          - cd api
      jobs:
        - name: "API: CI"
          commands:
            - ../.semaphore/run-and-monitor make-ci.log make ci
  - name: API Server
    run:
      when: "true"
    execution_time_limit:
      minutes: 30
    dependencies:
      - Prerequisites
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "apiserver"
      prologue:
        commands:
          - cd apiserver
      jobs:
        - name: "API Server: CI"
          commands:
            - ../.semaphore/run-and-monitor make-ci.log make ci
          env_vars:
            - name: STORE_BUILD_CACHE
              value: "true"
        - name: "API Server: Build"
          matrix:
            - env_var: ARCH
              values:
                - arm64
                - ppc64le
                - s390x
          commands:
            - ../.semaphore/run-and-monitor image-$ARCH.log make build ARCH=$ARCH
  - name: Application Layer Policy
    run:
      when: "true"
    dependencies:
      - Prerequisites
    task:
      prologue:
        commands:
          - cd app-policy
      jobs:
        - name: "Application Layer Policy: CI"
          commands:
            - ../.semaphore/run-and-monitor ci.log make ci
  - name: calicoctl
    run:
      when: "true"
    dependencies:
      - Prerequisites
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "calicoctl"
      prologue:
        commands:
          - cd calicoctl
      jobs:
        - name: "calicoctl: CI"
          commands:
            - ../.semaphore/run-and-monitor ci.log make ci
          env_vars:
            - name: STORE_BUILD_CACHE
              value: "true"
  - name: CNI Plugin
    run:
      when: "true"
    dependencies:
      - Prerequisites
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "cni-plugin"
      prologue:
        commands:
          - cd cni-plugin
      jobs:
        - name: "CNI Plugin: CI"
          commands:
            - ../.semaphore/run-and-monitor ci.log make ci
          env_vars:
            - name: STORE_BUILD_CACHE
              value: "true"
        - name: "CNI Plugin: build windows images"
          commands:
            - ../.semaphore/run-and-monitor ci.log make image-windows
  - name: "CNI Plugin: Windows"
    run:
      when: "false or true"
    dependencies:
      - Prerequisites
    task:
      secrets:
        - name: banzai-secrets
      prologue:
        commands:
          # Prepare azure configuration.
          - az login --service-principal -u "${AZ_SP_ID}" -p "${AZ_SP_PASSWORD}" --tenant "${AZ_TENANT_ID}" --output none
          - export AZURE_SUBSCRIPTION_ID=$AZ_SUBSCRIPTION_ID
          - export AZURE_TENANT_ID=$AZ_TENANT_ID
          - export AZURE_CLIENT_ID=$AZ_SP_ID
          - export AZURE_CLIENT_SECRET=$AZ_SP_PASSWORD
          - export REPORT_DIR=/home/semaphore/calico/process/testing/winfv-cni-plugin/report
          - export LOGS_DIR=~/fv.log
          - export RG_PREFIX=${USER}-win-cni-${SEMAPHORE_GIT_SHA:0:4}-pr${SEMAPHORE_GIT_PR_NUMBER}
          - cd cni-plugin
          - ../.semaphore/run-and-monitor build.log make bin/windows/calico.exe bin/windows/calico-ipam.exe bin/windows/win-fv.exe
      epilogue:
        always:
          commands:
            - artifact push job ${REPORT_DIR} --destination semaphore/test-results || true
            - artifact push job ${LOGS_DIR} --destination semaphore/logs || true
            - cd ~/calico/process/testing/aso && make dist-clean
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "cni-plugin"
        - name: SEMAPHORE_ARTIFACT_EXPIRY
          value: 2w
        - name: AZURE_LOCATION
          value: eastus2
        - name: KUBE_VERSION
          value: v1.29.7
      jobs:
        - name: "CNI Plugin: Windows Containerd FV - overlay"
          execution_time_limit:
            minutes: 60
          commands:
            - export BACKEND=overlay
            - export AZURE_RESOURCE_GROUP=${RG_PREFIX}-${BACKEND}-rg
            - echo AZURE_RESOURCE_GROUP=${AZURE_RESOURCE_GROUP}
            - ../.semaphore/run-and-monitor win-fv-containerd.log ~/calico/process/testing/winfv-cni-plugin/run-win-fv.sh
        - name: "CNI Plugin: Windows Containerd FV - l2bridge"
          execution_time_limit:
            minutes: 60
          commands:
            - export BACKEND=l2bridge
            - export AZURE_RESOURCE_GROUP=${RG_PREFIX}-${BACKEND}-rg
            - echo AZURE_RESOURCE_GROUP=${AZURE_RESOURCE_GROUP}
            - ../.semaphore/run-and-monitor win-fv-containerd.log ~/calico/process/testing/winfv-cni-plugin/run-win-fv.sh
  - name: confd
    run:
      when: "true"
    dependencies:
      - Prerequisites
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "confd"
      prologue:
        commands:
          - cd confd
      jobs:
        - name: "confd: CI"
          execution_time_limit:
            minutes: 60
          commands:
            - ../.semaphore/run-and-monitor ci.log make ci
          env_vars:
            - name: STORE_BUILD_CACHE
              value: "true"
  - name: Crypto
    run:
      when: "true"
    dependencies:
      - Prerequisites
    task:
      prologue:
        commands:
          - cd crypto
      jobs:
        - name: "Crypto: CI"
          commands:
            - ../.semaphore/run-and-monitor ci.log make ci
  - name: E2E script & pipeline validations
    run:
      when: "true or change_in(['/.semaphore/end-to-end/'], {pipeline_file: 'ignore', exclude: ['/**/.gitignore', '/**/README.md', '/**/LICENSE']})"
    execution_time_limit:
      minutes: 5
    dependencies:
      - Prerequisites
    task:
      jobs:
        - name: "E2E script & pipeline validations: validate yaml"
          commands:
            - ./.semaphore/end-to-end/scripts/test_scripts/e2e-validation.sh
  - name: E2E tests
    run:
      when: "true"
    dependencies:
      - Prerequisites
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "e2e-tests"
      agent:
        machine:
          type: f1-standard-4
          os_image: ubuntu2004
      jobs:
        - name: "E2E tests: Conformance"
          commands:
            - .semaphore/run-and-monitor e2e-test.log make e2e-test
          env_vars:
            - name: STORE_BUILD_CACHE
              value: "true"
  - name: Envoy Gateway
    run:
      when: "true or change_in(['/metadata.mk', '/lib.Makefile', '/third_party/envoy-gateway'], {pipeline_file: 'ignore', exclude: ['/**/.gitignore', '/**/README.md', '/**/LICENSE']})"
    execution_time_limit:
      minutes: 30
    dependencies:
      - Prerequisites
    task:
      prologue:
        commands:
          - cd third_party/envoy-gateway
      jobs:
        - name: "Envoy Gateway: CI"
          commands:
            - ../../.semaphore/run-and-monitor make-ci.log make ci
        - name: "Envoy Gateway: build multi-arch binaries"
          matrix:
            - env_var: ARCH
              values:
                - arm64
                - ppc64le
                - s390x
          commands:
            - ../../.semaphore/run-and-monitor image-$ARCH.log make build ARCH=$ARCH
  - name: Envoy Proxy
    run:
      when: "true or change_in(['/metadata.mk', '/lib.Makefile', '/third_party/envoy-proxy'], {pipeline_file: 'ignore', exclude: ['/**/.gitignore', '/**/README.md', '/**/LICENSE']})"
    execution_time_limit:
      minutes: 30
    dependencies:
      - Prerequisites
    task:
      prologue:
        commands:
          - cd third_party/envoy-proxy
      jobs:
        - name: "Envoy Proxy: CI"
          commands:
            - ../../.semaphore/run-and-monitor make-ci.log make ci
        - name: "Envoy Proxy: build multi-arch binaries"
          matrix:
            - env_var: ARCH
              values:
                - arm64
                - ppc64le
                - s390x
          commands:
            - ../../.semaphore/run-and-monitor image-$ARCH.log make build ARCH=$ARCH
  - name: "Envoy Ratelimit"
    run:
      when: "true or change_in(['/metadata.mk', '/lib.Makefile', '/third_party/envoy-ratelimit'], {pipeline_file: 'ignore', exclude: ['/**/.gitignore', '/**/README.md', '/**/LICENSE']})"
    execution_time_limit:
      minutes: 30
    dependencies:
      - Prerequisites
    task:
      prologue:
        commands:
          - cd third_party/envoy-ratelimit
      jobs:
        - name: "Envoy Ratelimit: CI"
          commands:
            - ../../.semaphore/run-and-monitor make-ci.log make ci
        - name: "Envoy Ratelimit: build multi-arch binaries"
          matrix:
            - env_var: ARCH
              values:
                - arm64
                - ppc64le
                - s390x
          commands:
            - ../../.semaphore/run-and-monitor image-$ARCH.log make build ARCH=$ARCH
  - name: "Felix: Build"
    run:
      when: "true"
    dependencies:
      - Prerequisites
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "felix"
      prologue:
        commands:
          - cd felix
          - gcloud config set project unique-caldron-775
          - gcloud auth activate-service-account --key-file=$HOME/secrets/secret.google-service-account-key.json
      secrets:
        - name: google-service-account-for-gce
      jobs:
        - name: "Felix: Build and cache FV prerequisites"
          env_vars:
            - name: STORE_BUILD_CACHE
              value: "true"
          execution_time_limit:
            minutes: 20
          commands:
            - make build image fv-prereqs
            - ./.semaphore/cache-test-artifacts
        - name: "Felix: UT"
          execution_time_limit:
            minutes: 30
          commands:
            - ../.semaphore/run-and-monitor ut.log make ut
        - name: "Felix: k8sfv"
          execution_time_limit:
            minutes: 15
          commands:
            - ../.semaphore/run-and-monitor k8sfv-typha.log make k8sfv-test JUST_A_MINUTE=true USE_TYPHA=true
            - ../.semaphore/run-and-monitor k8sfv-no-typha.log make k8sfv-test JUST_A_MINUTE=true USE_TYPHA=false
        - name: "Felix: Static checks"
          execution_time_limit:
            minutes: 15
          commands:
            - ../.semaphore/run-and-monitor static-checks.log make static-checks
      epilogue:
        always:
          commands:
            - 'test-results publish --name "${SEMAPHORE_JOB_NAME}" ./report/*.xml || true'
  - name: "Felix: multi-arch build"
    run:
      when: "true"
    dependencies:
      - "Felix: Build"
    task:
      prologue:
        commands:
          - cd felix
      jobs:
        - name: "Felix: build multi-arch binaries"
          matrix:
            - env_var: ARCH
              values:
                - ppc64le
                - s390x
          commands:
            # Only building the code, not the image here because the felix image is now only used for FV tests, which
            # only run on AMD64 at the moment.
            - ../.semaphore/run-and-monitor build-$ARCH.log make build ARCH=$ARCH
  - name: "Felix: Build - native arm64 runner"
    run:
      when: "true"
    dependencies:
      - "Felix: Build"
    task:
      agent:
        machine:
          type: s1-aws-arm64-2
      prologue:
        commands:
          - cd felix
      jobs:
        - name: "Felix: build arm64 binaries"
          commands:
            - ../.semaphore/run-and-monitor build-arm64.log make build ARCH=arm64
  - name: "Felix: Build Windows binaries"
    run:
      when: "true"
    dependencies:
      - Prerequisites
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "felix"
      jobs:
        - name: "Felix: Build Windows binaries"
          commands:
            - cd felix
            - make bin/calico-felix.exe fv/win-fv.exe
  - name: "Felix: Windows FV"
    run:
      when: "false or true"
    dependencies: ["Felix: Build Windows binaries"]
    task:
      secrets:
        - name: banzai-secrets
        - name: private-repo
      prologue:
        commands:
          - az login --service-principal -u "${AZ_SP_ID}" -p "${AZ_SP_PASSWORD}" --tenant "${AZ_TENANT_ID}" --output none
          - export REPORT_DIR=/home/semaphore/report
          - export AZURE_SUBSCRIPTION_ID=$AZ_SUBSCRIPTION_ID
          - export AZURE_TENANT_ID=$AZ_TENANT_ID
          - export AZURE_CLIENT_ID=$AZ_SP_ID
          - export AZURE_CLIENT_SECRET=$AZ_SP_PASSWORD
          - export REPORT_DIR=/home/semaphore/calico/process/testing/winfv-felix/report
          - export LOGS_DIR=~/fv.log
          - export RG_PREFIX=${USER}-win-felix-${SEMAPHORE_GIT_SHA:0:4}-pr${SEMAPHORE_GIT_PR_NUMBER}
          - cd felix
      epilogue:
        always:
          commands:
            - artifact push job ${REPORT_DIR} --destination semaphore/test-results || true
            - artifact push job ${LOGS_DIR} --destination semaphore/logs || true
            - cd ~/calico/process/testing/aso && make dist-clean
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "felix"
        - name: FV_TYPE
          value: "calico-felix"
        - name: SEMAPHORE_ARTIFACT_EXPIRY
          value: 2w
        - name: CONTAINERD_VERSION
          value: 1.7.22
      jobs:
        - name: "Felix: Windows FV"
          commands:
            - export AZURE_RESOURCE_GROUP=${RG_PREFIX}-${BACKEND}-rg
            - echo AZURE_RESOURCE_GROUP=${AZURE_RESOURCE_GROUP}
            - ../.semaphore/run-and-monitor win-fv-felix.log ~/calico/process/testing/winfv-felix/run-win-fv.sh
  - name: "Felix: iptables tests on Ubuntu 22.04"
    run:
      when: "true"
    dependencies:
      - "Felix: Build"
    task:
      jobs:
        - name: "Felix: iptables tests on Ubuntu 22.04"
          execution_time_limit:
            minutes: 180
          env_vars:
            - name: FELIX_TEST_GROUP
              value: "22.04-ipt"
          commands:
            - source felix/.semaphore/fv-prologue
            - export NUM_FV_BATCHES=16
            - .semaphore/vms/create-test-vms ${VM_PREFIX}
            - .semaphore/vms/run-tests-on-vms ${VM_PREFIX}
      epilogue:
        always:
          commands:
            - source felix/.semaphore/fv-epilogue
      secrets:
        - name: google-service-account-for-gce
  - name: "Felix: nftables tests on Ubuntu 22.04"
    run:
      when: "true"
    dependencies:
      - "Felix: Build"
    task:
      jobs:
        - name: "Felix: nftables tests on Ubuntu 22.04"
          execution_time_limit:
            minutes: 180
          env_vars:
            - name: FELIX_TEST_GROUP
              value: "22.04-nft"
          commands:
            - source felix/.semaphore/fv-prologue
            - export NUM_FV_BATCHES=16
            - .semaphore/vms/create-test-vms ${VM_PREFIX}
            - .semaphore/vms/run-tests-on-vms ${VM_PREFIX}
      epilogue:
        always:
          commands:
            - source felix/.semaphore/fv-epilogue
      secrets:
        - name: google-service-account-for-gce
  - name: "Felix: BPF tests on Ubuntu 24.04 (iptables)"
    run:
      when: "true"
    dependencies:
      - "Felix: Build"
    task:
      jobs:
        - name: "Felix: BPF tests on Ubuntu 24.04"
          execution_time_limit:
            minutes: 180
          env_vars:
            - name: FELIX_TEST_GROUP
              value: "bpf-24.04-ipt-with-ut"
          commands:
            - source felix/.semaphore/fv-prologue
            - export NUM_FV_BATCHES=60
            - .semaphore/vms/create-test-vms ${VM_PREFIX}
            - .semaphore/vms/run-tests-on-vms ${VM_PREFIX}
      epilogue:
        always:
          commands:
            - source felix/.semaphore/fv-epilogue
      secrets:
        - name: google-service-account-for-gce
  - name: "Felix: BPF tests on Ubuntu 22.04 (nftables)"
    run:
      when: "true"
    dependencies:
      - "Felix: Build"
    task:
      jobs:
        - name: "Felix: BPF tests on Ubuntu 22.04 (nftables)"
          execution_time_limit:
            minutes: 180
          env_vars:
            - name: FELIX_TEST_GROUP
              value: "bpf-22.04-nft-with-ut"
            - name: FELIX_FV_BPFATTACHTYPE
              value: "tc"
          commands:
            - source felix/.semaphore/fv-prologue
            # Limit to BPF conntrack tests to reduce overall runtime.
            - export FV_FOCUS='_BPF_.*ct=true'
            - export NUM_FV_BATCHES=10
            - .semaphore/vms/create-test-vms ${VM_PREFIX}
            - .semaphore/vms/run-tests-on-vms ${VM_PREFIX}
      epilogue:
        always:
          commands:
            - source felix/.semaphore/fv-epilogue
      secrets:
        - name: google-service-account-for-gce
  - name: "Felix: BPF program-loading check on 25.04 (nftables)"
    run:
      when: "true"
    dependencies:
      - "Felix: Build"
    task:
      jobs:
        - name: "Felix: BPF program-loading check on 25.04"
          execution_time_limit:
            minutes: 60
          env_vars:
            - name: FELIX_TEST_GROUP
              value: "bpf-25.04-nft-no-fv-with-ut"
            - name: FELIX_FV_BPFATTACHTYPE
              value: "tc"
          commands:
            - source felix/.semaphore/fv-prologue
            # Only run the UT that checks that the precompiled BPF binaries are loadable.
            - export UT_FOCUS="TestPrecompiledBinariesAreLoadable"
            - .semaphore/vms/create-test-vms ${VM_PREFIX}
            - .semaphore/vms/run-tests-on-vms ${VM_PREFIX}
      epilogue:
        always:
          commands:
            - source felix/.semaphore/fv-epilogue
      secrets:
        - name: google-service-account-for-gce
  - name: "Felix: BPF tests on Ubuntu 25.04 with jitharden=2 (nftables)"
    run:
      when: "true"
    dependencies:
      - "Felix: Build"
    task:
      jobs:
        - name: "Felix: BPF tests on Ubuntu 25.04 with jitharden=2"
          execution_time_limit:
            minutes: 180
          env_vars:
            - name: FELIX_TEST_GROUP
              value: "bpf-25.04-nft-with-ut-jitharden"
            - name: FELIX_FV_BPFATTACHTYPE
              value: "tc"
          commands:
            - source felix/.semaphore/fv-prologue
            # Limit to BPF TCP+conntrack tests to reduce overall runtime.
            - export FV_FOCUS='_BPF_.*tcp.*ct=true'
            - export NUM_FV_BATCHES=16
            - .semaphore/vms/create-test-vms ${VM_PREFIX}
            - .semaphore/vms/run-on-vms ${VM_PREFIX} "sudo sysctl -w net.core.bpf_jit_harden=2"
            - .semaphore/vms/run-tests-on-vms ${VM_PREFIX}
      epilogue:
        always:
          commands:
            - source felix/.semaphore/fv-epilogue
      secrets:
        - name: google-service-account-for-gce
  - name: Goldmane
    run:
      when: "true"
    execution_time_limit:
      minutes: 30
    dependencies:
      - Prerequisites
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "goldmane"
      prologue:
        commands:
          # The Makefile sometimes tries to rebuild the protobuf files on non-amd architectures
          # even when they don't need to be. Touch the file to update the timestamp. We know
          # they will be up-to-date due to preflight checks.
          - touch goldmane/proto/api.pb.go
          - cd goldmane
      jobs:
        - name: "Goldmane: CI"
          commands:
            - ../.semaphore/run-and-monitor make-ci.log make ci
          env_vars:
            - name: STORE_BUILD_CACHE
              value: "true"
        - name: "Goldmane: build multi-arch"
          matrix:
            - env_var: ARCH
              values:
                - arm64
                - ppc64le
                - s390x
          commands:
            - ../.semaphore/run-and-monitor image-$ARCH.log make build ARCH=$ARCH
  - name: Guardian
    run:
      when: "true"
    execution_time_limit:
      minutes: 30
    dependencies:
      - Prerequisites
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "guardian"
      prologue:
        commands:
          - cd guardian
      jobs:
        - name: "Guardian: CI"
          commands:
            - ../.semaphore/run-and-monitor make-ci.log make ci
          env_vars:
            - name: STORE_BUILD_CACHE
              value: "true"
        - name: "Guardian: build multi-arch"
          matrix:
            - env_var: ARCH
              values:
                - arm64
                - ppc64le
                - s390x
          commands:
            - ../.semaphore/run-and-monitor image-$ARCH.log make build ARCH=$ARCH
  - name: kube-controllers
    run:
      when: "true"
    dependencies:
      - Prerequisites
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "kube-controllers"
      prologue:
        commands:
          - cd kube-controllers
      jobs:
        - name: "kube-controllers: CI"
          commands:
            - ../.semaphore/run-and-monitor ci.log make ci
          env_vars:
            - name: STORE_BUILD_CACHE
              value: "true"
  - name: Libraries (lib)
    run:
      when: "true or change_in(['/lib/'], {pipeline_file: 'ignore'})"
    execution_time_limit:
      minutes: 30
    dependencies:
      - Prerequisites
    task:
      prologue:
        commands:
          - cd lib
      jobs:
        - name: "Libraries: CI"
          commands:
            - ../.semaphore/run-and-monitor make-ci.log make ci
  - name: libcalico-go
    run:
      when: "true"
    dependencies:
      - Prerequisites
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "libcalico-go"
      prologue:
        commands:
          - cd libcalico-go
      jobs:
        - name: "libcalico-go: CI"
          commands:
            - ../.semaphore/run-and-monitor make-ci.log make ci
          env_vars:
            - name: STORE_BUILD_CACHE
              value: "true"
  - name: "Node: Build"
    run:
      when: "true"
    dependencies:
      - Prerequisites
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "node"
      agent:
        machine:
          type: f1-standard-4
          os_image: ubuntu2004
      prologue:
        commands:
          - cd node
      jobs:
        - name: "Node: CI"
          commands:
            - ../.semaphore/run-and-monitor ci.log make ci
          env_vars:
            - name: STORE_BUILD_CACHE
              value: "true"
  - name: "Node: multi-arch build"
    run:
      when: "true"
    dependencies:
      - "Node: Build"
    task:
      prologue:
        commands:
          - cd node
      jobs:
        - name: "Node: build multi-arch images"
          matrix:
            - env_var: ARCH
              values:
                - ppc64le
                - s390x
          commands:
            - ../.semaphore/run-and-monitor image-$ARCH.log make image ARCH=$ARCH
        - name: "Node: build Windows archive"
          commands:
            - ../.semaphore/run-and-monitor build-windows-archive.log make build-windows-archive
        - name: "Node: build Windows image"
          commands:
            - ../.semaphore/run-and-monitor build-windows-image.log make image-windows
  - name: "Node: Build - native arm64 runner"
    run:
      when: "true"
    dependencies:
      - "Node: Build"
    task:
      agent:
        machine:
          type: s1-aws-arm64-2
      prologue:
        commands:
          - cd node
      jobs:
        - name: "Node: build arm64 image"
          commands:
            - ../.semaphore/run-and-monitor build-arm64.log make image ARCH=arm64
  - name: "Node: kind-cluster tests"
    run:
      # KinD tests also build and run all the other images.
      when: "true"
    dependencies:
      - "Prerequisites"
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "node"
      prologue:
        commands:
          # Set up access to GCP buckets.
          - export GOOGLE_APPLICATION_CREDENTIALS=$HOME/secrets/secret.google-service-account-key.json
          - gcloud auth activate-service-account --key-file=$GOOGLE_APPLICATION_CREDENTIALS
          - gcloud config set project unique-caldron-775
          - cd node
          - export SHORT_WORKFLOW_ID=$(echo ${SEMAPHORE_WORKFLOW_ID} | sha256sum | cut -c -8)
          - export ZONE=europe-west3-c
          - export VM_PREFIX=sem-${SEMAPHORE_PROJECT_NAME}-${SHORT_WORKFLOW_ID}-kind-
          - echo VM_PREFIX=${VM_PREFIX}
          - export COMPONENT=node
          - export VM_DISK_SIZE=80GB
          - mkdir artifacts
          - ./.semaphore/cache-test-artifacts
          - ../.semaphore/vms/create-test-vms ${VM_PREFIX}
      jobs:
        - name: "Node: kind-cluster tests"
          execution_time_limit:
            minutes: 120
          commands:
            - ../.semaphore/vms/run-tests-on-vms ${VM_PREFIX}
      epilogue:
        always:
          commands:
            - ../.semaphore/vms/collect-artifacts-from-vms ${VM_PREFIX}
            - '../.semaphore/vms/publish-reports "Node: KinD STs"'
            - ../.semaphore/vms/clean-up-vms ${ZONE} ${VM_PREFIX}
      secrets:
        - name: google-service-account-for-gce
  - name: pod2daemon
    run:
      when: "true"
    dependencies:
      - Prerequisites
    task:
      prologue:
        commands:
          - cd pod2daemon
      jobs:
        - name: "pod2daemon: CI"
          commands:
            - ../.semaphore/run-and-monitor ci.log make ci
            - 'test-results publish ./report/*.xml --name "pod2daemon: UT" || true'
  - name: "Tools (hack directory)"
    run:
      when: "true or change_in(['/metadata.mk', '/lib.Makefile', '/hack/', '/api/', '/libcalico-go/'], {pipeline_file: 'ignore', exclude: ['/**/.gitignore', '/**/README.md', '/**/LICENSE']})"
    dependencies:
      - Prerequisites
    task:
      prologue:
        commands:
          - cd hack
      jobs:
        - name: "Tools (hack directory): CI"
          commands:
            - ../.semaphore/run-and-monitor make-ci.log make ci
  - name: Typha
    run:
      when: "true"
    dependencies:
      - Prerequisites
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "typha"
      prologue:
        commands:
          - cd typha
      jobs:
        - name: "Typha: UT and FV tests"
          commands:
            - export TEST_SUITE_PREFIX="calico/base"
            - ../.semaphore/run-and-monitor make-ci.log make ci
          env_vars:
            - name: STORE_BUILD_CACHE
              value: "true"
        - name: "Typha: FV tests on UBI-minimal"
          commands:
            - 'export TEST_SUITE_PREFIX="UBI-minimal"'
            - ../.semaphore/run-and-monitor make-fv-ubi.log make clean image fv
          env_vars:
            - name: USE_UBI_AS_CALICO_BASE
              value: '1'
      epilogue:
        always:
          commands:
            - 'test-results publish --ignore-missing ./report/*.xml ../felix/report/*.xml --suite-prefix="$TEST_SUITE_PREFIX" --name "Typha" || true'
  - name: Whisker backend
    run:
      when: "true"
    execution_time_limit:
      minutes: 30
    dependencies:
      - Prerequisites
    task:
      prologue:
        commands:
          - cd whisker-backend
      jobs:
        - name: "Whisker backend: CI"
          commands:
            - ../.semaphore/run-and-monitor make-ci.log make ci
        - name: "Whisker backend: build multi-arch"
          matrix:
            - env_var: ARCH
              values:
                - arm64
                - ppc64le
                - s390x
          commands:
            - ../.semaphore/run-and-monitor image-$ARCH.log make build ARCH=$ARCH
  - name: Whisker
    run:
      when: "true or change_in(['/metadata.mk', '/lib.Makefile', '/whisker/'], {pipeline_file: 'ignore', exclude: ['/**/.gitignore', '/**/README.md', '/**/LICENSE']})"
    execution_time_limit:
      minutes: 30
    dependencies:
      - Prerequisites
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "whisker"
      prologue:
        commands:
          - cd whisker
      jobs:
        - name: "Whisker: CI"
          commands:
            - ../.semaphore/run-and-monitor make-ci.log make ci
          env_vars:
            - name: STORE_BUILD_CACHE
              value: "true"
        - name: "Whisker: build multi-arch images"
          matrix:
            - env_var: ARCH
              values:
                - arm64
                - ppc64le
                - s390x
          commands:
            - ../.semaphore/run-and-monitor image-$ARCH.log make build ARCH=$ARCH
  - name: key-cert-provisioner
    run:
      when: "true"
    dependencies:
      - Prerequisites
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "key-cert-provisioner"
      prologue:
        commands:
          - cd key-cert-provisioner
      jobs:
        - name: "key-cert-provisioner: CI"
          commands:
            - ../.semaphore/run-and-monitor ci.log make ci
          env_vars:
            - name: STORE_BUILD_CACHE
              value: "true"
  - name: "OpenStack integration (Yoga)"
    run:
      when: "true or change_in(['/metadata.mk', '/lib.Makefile', '/networking-calico/', '/.semaphore/semaphore.yml.d/blocks/40-openstack.yml'], {pipeline_file: 'ignore'})"
    dependencies:
      - Prerequisites
    task:
      agent:
        machine:
          type: f1-standard-2
          os_image: ubuntu2004
      prologue:
        commands:
          - cd networking-calico
      jobs:
        - name: "OpenStack: Unit and FV tests (tox) on Yoga"
          commands:
            - ../.semaphore/run-and-monitor tox.log make tox-yoga
        - name: "OpenStack: Mainline ST (DevStack + Tempest) on Yoga"
          commands:
            # For some reason python3-wrapt is pre-installed on a Semaphore ubuntu2004 node, but with
            # a version (1.11.2) that is different from the version that OpenStack needs (1.13.3), and
            # this was causing the DevStack setup to fail, because pip doesn't know how to uninstall
            # or replace the existing version.  Happily we do know that, so let's do it upfront here.
            - sudo apt-get remove -y python3-wrapt || true
            # Install all the packages that would trigger an initramfs update using a workaround
            # for limited /boot partition space in the ubuntu2004 image
            - sudo apt update
            - sudo rsync -av /boot/ /boot2/
            - sudo mount --bind /boot2 /boot
            - sudo apt install -y cryptsetup lsscsi open-iscsi thin-provisioning-tools
            - sudo umount /boot
            - sudo rsync -av /boot2/ /boot/ --exclude "*.new" --exclude "*.dpkg-bak" --delete --inplace
            - sudo rm -rf /boot2/
            # Set NC_PLUGIN_REPO and NC_PLUGIN_REF so that DevStack will use the networking-calico
            # code from the current PR or branch.  The following checkout is to make sure of having a
            # local ref that we can specify.
            - git checkout -b devstack-test
            - export NC_PLUGIN_REPO=$(dirname $(pwd))
            - export NC_PLUGIN_REF=$(git rev-parse --abbrev-ref HEAD)
            - sudo git config --system --add safe.directory ${NC_PLUGIN_REPO}/.git
            - TEMPEST=true DEVSTACK_BRANCH=unmaintained/yoga ./devstack/bootstrap.sh
      epilogue:
        on_fail:
          commands:
            - mkdir logs
            - sudo journalctl > logs/journalctl.txt
            - artifact push job logs
  - name: "OpenStack integration (Caracal)"
    run:
      when: "true or change_in(['/metadata.mk', '/lib.Makefile', '/networking-calico/', '/.semaphore/semaphore.yml.d/blocks/40-openstack.yml'], {pipeline_file: 'ignore'})"
    dependencies:
      - Prerequisites
    task:
      agent:
        machine:
          type: f1-standard-2
          os_image: ubuntu2204
      prologue:
        commands:
          - cd networking-calico
      jobs:
        - name: "OpenStack: Unit and FV tests (tox) on Caracal"
          commands:
            - ../.semaphore/run-and-monitor tox.log make tox-caracal
        - name: "OpenStack: Mainline ST (DevStack + Tempest) on Caracal"
          commands:
            # For some reason python3-wrapt is pre-installed on a Semaphore ubuntu2004 node, but with
            # a version (1.11.2) that is different from the version that OpenStack needs (1.13.3), and
            # this was causing the DevStack setup to fail, because pip doesn't know how to uninstall
            # or replace the existing version.  Happily we do know that, so let's do it upfront here.
            - sudo apt-get remove -y python3-wrapt || true
            # Set NC_PLUGIN_REPO and NC_PLUGIN_REF so that DevStack will use the networking-calico
            # code from the current PR or branch.  The following checkout is to make sure of having a
            # local ref that we can specify.
            - git checkout -b devstack-test
            - export NC_PLUGIN_REPO=$(dirname $(pwd))
            - export NC_PLUGIN_REF=$(git rev-parse --abbrev-ref HEAD)
            - sudo git config --system --add safe.directory ${NC_PLUGIN_REPO}/.git
            - TEMPEST=true DEVSTACK_BRANCH=unmaintained/2024.1 ./devstack/bootstrap.sh
      epilogue:
        always:
          commands:
            - mkdir logs
            - sudo journalctl > logs/journalctl.txt
            - artifact push job logs
  - name: Mock node
    run:
      when: "true"
    dependencies:
      - Prerequisites
    task:
      env_vars:
        - name: BUILD_CACHE_GROUP
          value: "mock-node"
      prologue:
        commands:
          - cd test-tools/mocknode
      jobs:
        - name: "Mock node: CI"
          commands:
            - ../../.semaphore/run-and-monitor make-ci.log make ci
          env_vars:
            - name: STORE_BUILD_CACHE
              value: "true"
  - name: Release tooling
    run:
      when: "true"
    execution_time_limit:
      minutes: 30
    dependencies:
      - Prerequisites
    task:
      prologue:
        commands:
          - cd release
      jobs:
        - name: "Release tooling: CI"
          commands:
            - ../.semaphore/run-and-monitor release-ci.log make ci
            - 'test-results publish --name "Release tool: UT" ./report/*.xml || true'
        - name: "Release tooling: build"
          commands:
            - ../.semaphore/run-and-monitor release-build.log make build
            - cache store release-${SEMAPHORE_GIT_SHA} bin
after_pipeline:
  task:
    jobs:
      - name: Reports
        commands:
          - test-results gen-pipeline-report --force
