ci-image-checks.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
---
name: CI Image Checks
on:  # yamllint disable-line rule:truthy
  workflow_call:
    inputs:
      runners:
        description: "The array of labels (in json form) determining runners."
        required: true
        type: string
      platform:
        description: "Platform for the build - 'linux/amd64' or 'linux/arm64'"
        required: true
        type: string
      python-versions-list-as-string:
        description: "The list of python versions as string separated by spaces"
        required: true
        type: string
      branch:
        description: "Branch used to run the CI jobs in (main/v*_*_test)."
        required: true
        type: string
      canary-run:
        description: "Whether this is a canary run (true/false)"
        required: true
        type: string
      default-python-version:
        description: "Which version of python should be used by default"
        required: true
        type: string
      docs-list-as-string:
        description: "Stringified list of docs to build (space separated)"
        required: true
        type: string
      upgrade-to-newer-dependencies:
        description: "Whether to upgrade to newer dependencies (true/false)"
        required: true
        type: string
      basic-checks-only:
        description: "Whether to run only basic checks (true/false)"
        required: true
        type: string
      latest-versions-only:
        description: "Whether to run only latest versions (true/false)"
        required: true
        type: string
      ci-image-build:
        description: "Whether to build CI images (true/false)"
        required: true
        type: string
      skip-prek-hooks:
        description: "Whether to skip prek hooks (true/false)"
        required: true
        type: string
      include-success-outputs:
        description: "Whether to include success outputs"
        required: true
        type: string
      debug-resources:
        description: "Whether to debug resources (true/false)"
        required: true
        type: string
      docs-build:
        description: "Whether to build docs (true/false)"
        required: true
        type: string
      run-api-codegen:
        description: "Whether to run API codegen (true/false)"
        required: true
        type: string
      default-postgres-version:
        description: "The default version of the postgres to use"
        required: true
        type: string
      run-coverage:
        description: "Whether to run coverage or not (true/false)"
        required: true
        type: string
      use-uv:
        description: "Whether to use uv to build the image (true/false)"
        required: true
        type: string
      source-head-repo:
        description: "The source head repository to use for back-references"
        default: "apache/airflow"
        type: string
      source-head-ref:
        description: "The source head ref to use for back-references"
        default: "main"
        type: string
    secrets:
      DOCS_AWS_ACCESS_KEY_ID:
        required: true
      DOCS_AWS_SECRET_ACCESS_KEY:
        required: true
      SLACK_BOT_TOKEN:
        required: false


permissions:
  contents: read
jobs:
  static-checks:
    timeout-minutes: 45
    name: "Static checks"
    runs-on: ${{ fromJSON(inputs.runners) }}
    env:
      PYTHON_MAJOR_MINOR_VERSION: "${{ inputs.default-python-version }}"
      UPGRADE_TO_NEWER_DEPENDENCIES: "${{ inputs.upgrade-to-newer-dependencies }}"
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    if: inputs.basic-checks-only == 'false' && inputs.latest-versions-only != 'true'
    steps:
      - name: "Cleanup repo"
        shell: bash
        run: sudo rm -rf ${GITHUB_WORKSPACE}/*
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - name: "Prepare breeze & CI image: ${{ inputs.default-python-version }}"
        uses: ./.github/actions/prepare_breeze_and_image
        with:
          platform: ${{ inputs.platform }}
          python: "${{ inputs.default-python-version }}"
          use-uv: ${{ inputs.use-uv }}
          make-mnt-writeable-and-cleanup: true
        id: breeze
      - name: "Install prek"
        uses: ./.github/actions/install-prek
        id: prek
        with:
          platform: ${{ inputs.platform }}
          save-cache: true
      - name: "Static checks"
        run: prek --all-files --show-diff-on-failure --color always
        env:
          VERBOSE: "true"
          SKIP: ${{ inputs.skip-prek-hooks }}
          COLUMNS: "202"
          SKIP_GROUP_OUTPUT: "true"
          DEFAULT_BRANCH: ${{ inputs.branch }}
          RUFF_FORMAT: "github"
      - name: "Show prek log on failure"
        run: cat ~/.cache/prek/prek.log || true
        if: failure()
      - name: "Check PR title is not Conventional Commits"
        # With "squash and merge" the PR title becomes the commit subject that lands on the
        # target branch (individual commit subjects are often "fixup"/"apply review" and do
        # not survive the squash), so the title is what we must validate. Read it from an env
        # var rather than interpolating it into the script to avoid shell injection from a
        # crafted PR title.
        if: github.event_name == 'pull_request'
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
        run: |
          printf '%s\n' "$PR_TITLE" \
            | ./scripts/ci/prek/check_no_conventional_commit_message.py --from-stdin

  build-docs:
    timeout-minutes: 150
    name: "Build documentation"
    runs-on: ${{ fromJSON(inputs.runners) }}
    if: inputs.docs-build == 'true'
    env:
      GITHUB_REPOSITORY: ${{ github.repository }}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      GITHUB_USERNAME: ${{ github.actor }}
      INCLUDE_NOT_READY_PROVIDERS: "true"
      INCLUDE_SUCCESS_OUTPUTS: "${{ inputs.include-success-outputs }}"
      PYTHON_MAJOR_MINOR_VERSION: "${{ inputs.default-python-version }}"
      VERBOSE: "true"
    steps:
      - name: "Cleanup repo"
        shell: bash
        run: sudo rm -rf ${GITHUB_WORKSPACE}/*
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - name: "Prepare breeze & CI image: ${{ inputs.default-python-version }}"
        uses: ./.github/actions/prepare_breeze_and_image
        with:
          platform: ${{ inputs.platform }}
          python: "${{ inputs.default-python-version }}"
          use-uv: ${{ inputs.use-uv }}
          make-mnt-writeable-and-cleanup: true
      - name: "Restore docs inventory cache"
        # yamllint disable-line rule:line-length
        uses: apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0  # restore/v1.0.0
        with:
          path: ./generated/_inventory_cache/
          key: cache-docs-inventory-v1
        id: restore-docs-inventory-cache
      - name: "Building docs"
        env:
          DOCS_LIST_AS_STRING: ${{ inputs.docs-list-as-string }}
        run: >
          breeze build-docs ${DOCS_LIST_AS_STRING} --refresh-airflow-inventories
      - name: "Check for missing third-party inventories"
        id: check-missing-inventories
        if: always()
        shell: bash
        run: |
          MARKER_FILE="./generated/_inventory_cache/.missing_third_party_inventories"
          if [[ -f "${MARKER_FILE}" ]]; then
            echo "missing=true" >> "${GITHUB_OUTPUT}"
            echo "::warning::Missing third-party inventories:"
            cat "${MARKER_FILE}"
            echo "packages<<EOF" >> "${GITHUB_OUTPUT}"
            cat "${MARKER_FILE}" >> "${GITHUB_OUTPUT}"
            echo "EOF" >> "${GITHUB_OUTPUT}"
          else
            echo "missing=false" >> "${GITHUB_OUTPUT}"
          fi
      - name: "Get docs build job URL"
        id: get-job-url
        if: >-
          always() &&
          inputs.canary-run == 'true'
        shell: bash
        run: |
          JOB_URL=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/jobs" \
            --jq '[.jobs[] | select(.name | test("Build documentation"))][0].html_url // empty')
          if [[ -z "${JOB_URL}" ]]; then
            JOB_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          fi
          echo "url=${JOB_URL}" >> "${GITHUB_OUTPUT}"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: "Determine inventory notification action"
        id: inventory-notification
        if: >-
          always() &&
          inputs.canary-run == 'true'
        shell: bash
        run: python3 scripts/ci/slack_notification_state.py
        env:
          # yamllint disable-line rule:line-length
          ARTIFACT_NAME: "slack-state-inventory-${{ inputs.branch }}-${{ contains(inputs.platform, 'arm') && 'arm' || 'amd' }}"
          CURRENT_FAILURES: "${{ steps.check-missing-inventories.outputs.packages }}"
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: "Upload inventory notification state"
        if: >-
          always() &&
          inputs.canary-run == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          # yamllint disable-line rule:line-length
          name: "slack-state-inventory-${{ inputs.branch }}-${{ contains(inputs.platform, 'arm') && 'arm' || 'amd' }}"
          path: ./slack-state/
          retention-days: 7
          overwrite: true
      - name: "Notify Slack about missing inventories (new/changed)"
        if: >-
          inputs.canary-run == 'true' &&
          steps.inventory-notification.outputs.action == 'notify_new'
        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d  # v4.0.0
        with:
          method: chat.postMessage
          token: ${{ env.SLACK_BOT_TOKEN }}
          # yamllint disable rule:line-length
          payload: |
            channel: "internal-airflow-ci-cd"
            text: "⚠️ Missing 3rd-party doc inventories in canary build on *${{ github.ref_name }}*: ${{ steps.check-missing-inventories.outputs.packages }}\n\n<${{ steps.get-job-url.outputs.url }}|View job log>"
          # yamllint enable rule:line-length
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
      - name: "Notify Slack about missing inventories (still not fixed)"
        if: >-
          inputs.canary-run == 'true' &&
          steps.inventory-notification.outputs.action == 'notify_reminder'
        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d  # v4.0.0
        with:
          method: chat.postMessage
          token: ${{ env.SLACK_BOT_TOKEN }}
          # yamllint disable rule:line-length
          payload: |
            channel: "internal-airflow-ci-cd"
            text: "⚠️🔁 Still not fixed: Missing 3rd-party doc inventories in canary build on *${{ github.ref_name }}*: ${{ steps.check-missing-inventories.outputs.packages }}\n\n<${{ steps.get-job-url.outputs.url }}|View job log>"
          # yamllint enable rule:line-length
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
      - name: "Notify Slack about inventory recovery"
        if: >-
          inputs.canary-run == 'true' &&
          steps.inventory-notification.outputs.action == 'notify_recovery'
        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d  # v4.0.0
        with:
          method: chat.postMessage
          token: ${{ env.SLACK_BOT_TOKEN }}
          # yamllint disable rule:line-length
          payload: |
            channel: "internal-airflow-ci-cd"
            text: "✅ All 3rd-party doc inventories are now available in canary build on *${{ github.ref_name }}*\n\n<${{ steps.get-job-url.outputs.url }}|View job log>"
          # yamllint enable rule:line-length
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
      - name: "Save docs inventory cache"
        uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0  # save/v1.0.0
        with:
          path: ./generated/_inventory_cache/
          key: cache-docs-inventory-v1
          if-no-files-found: 'error'
          retention-days: '2'
        if: steps.restore-docs-inventory-cache.outputs.stash-hit != 'true'
      - name: "Upload build docs"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: airflow-docs
          path: './generated/_build'
          retention-days: '7'
          if-no-files-found: 'error'

  publish-docs:
    timeout-minutes: 150
    name: "Publish documentation and validate versions"
    permissions:
      id-token: write
      contents: read
    needs: build-docs
    runs-on: ${{ fromJSON(inputs.runners) }}
    env:
      GITHUB_REPOSITORY: ${{ github.repository }}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      GITHUB_USERNAME: ${{ github.actor }}
      INCLUDE_NOT_READY_PROVIDERS: "true"
      INCLUDE_SUCCESS_OUTPUTS: "${{ inputs.include-success-outputs }}"
      PYTHON_MAJOR_MINOR_VERSION: "${{ inputs.default-python-version }}"
      VERBOSE: "true"
      HEAD_REPO: "${{ inputs.source-head-repo }}"
      HEAD_REF: "${{ inputs.source-head-ref }}"
    steps:
      - name: "Cleanup repo"
        shell: bash
        run: sudo rm -rf ${GITHUB_WORKSPACE}/*
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - name: "Prepare breeze & CI image: ${{ inputs.default-python-version }}"
        uses: ./.github/actions/prepare_breeze_and_image
        with:
          platform: ${{ inputs.platform }}
          python: "${{ inputs.default-python-version }}"
          use-uv: ${{ inputs.use-uv }}
          make-mnt-writeable-and-cleanup: true
      - name: "Download docs prepared as artifacts"
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: airflow-docs
          path: './generated/_build'
      - name: "Make sure SBOM dir exists and has the right permissions"
        run: |
          sudo mkdir -vp ./files/sbom
          sudo chown -R "${USER}" .
        if: >
          inputs.canary-run == 'true' &&
          (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
      - name: "Determine Airflow version for SBOMs"
        run: |
          AIRFLOW_VERSION=$(awk -F'"' '/^__version__ = / {print $2}' airflow-core/src/airflow/__init__.py)
          test -n "${AIRFLOW_VERSION}"
          echo "AIRFLOW_VERSION=${AIRFLOW_VERSION}" >> "${GITHUB_ENV}"
        if: >
          inputs.canary-run == 'true' &&
          (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
      - name: "Prepare SBOMs"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: >
          breeze sbom update-sbom-information
          --airflow-version ${AIRFLOW_VERSION} --remote-name origin --force
          --all-combinations --run-in-parallel --airflow-root-path "${GITHUB_WORKSPACE}"
          --airflow-constraints-reference constraints-main
        if: >
          inputs.canary-run == 'true' &&
          (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
      - name: "Generated SBOM files"
        run: |
          echo "Generated SBOM files:"
          find ./generated/_build/docs/apache-airflow/stable/sbom/ -type f | sort
        if: >
          inputs.canary-run == 'true' &&
          (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
      - name: Check disk space available
        run: df -H
      - name: Create /mnt/airflow-site directory
        run: sudo mkdir -p /mnt/airflow-site && sudo chown -R "${USER}" /mnt/airflow-site
      - name: "Clone airflow-site"
        run: >
          git clone https://github.com/apache/airflow-site.git /mnt/airflow-site/airflow-site &&
          echo "AIRFLOW_SITE_DIRECTORY=/mnt/airflow-site/airflow-site" >> "$GITHUB_ENV"
      - name: "Publish docs"
        env:
          DOCS_LIST_AS_STRING: ${{ inputs.docs-list-as-string }}
        run: >
          breeze release-management publish-docs --override-versioned --run-in-parallel
          ${DOCS_LIST_AS_STRING}
      - name: Check disk space available
        run: df -H
      - name: "Generate back references for providers"
        run: breeze release-management add-back-references all-providers
      - name: "Generate back references for apache-airflow"
        run: breeze release-management add-back-references apache-airflow
      - name: "Generate back references for docker-stack"
        run: breeze release-management add-back-references docker-stack
      - name: "Generate back references for helm-chart"
        run: breeze release-management add-back-references helm-chart
      - name: "Generate back references for apache-airflow-ctl"
        run: breeze release-management add-back-references apache-airflow-ctl
      - name: "Validate published doc versions"
        id: validate-docs-versions
        run: cd ./dev/breeze && uv run ./src/airflow_breeze/utils/docs_version_validation.py
        env:
          AIRFLOW_SITE_DIRECTORY: /mnt/airflow-site/airflow-site
      - name: Install AWS CLI v2
        run: |
          curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip
          unzip -q /tmp/awscliv2.zip -d /tmp
          rm /tmp/awscliv2.zip
          sudo /tmp/aws/install --update
          rm -rf /tmp/aws/
        if: >
          inputs.canary-run == 'true' &&
          (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd  # v6.3.0
        with:
          aws-access-key-id: ${{ secrets.DOCS_AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.DOCS_AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-central-1
        if: >
          inputs.canary-run == 'true' &&
          (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
      - name: "Upload documentation to AWS S3"
        run: aws s3 sync --delete ./generated/_build s3://apache-airflow-docs
        if: >
          inputs.canary-run == 'true' &&
          (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')

  test-python-api-client:
    timeout-minutes: 60
    name: "Test Python API client"
    runs-on: ${{ fromJSON(inputs.runners) }}
    if: inputs.run-api-codegen == 'true'
    env:
      BACKEND: "postgres"
      BACKEND_VERSION: "${{ inputs.default-postgres-version }}"
      DEBUG_RESOURCES: "${{ inputs.debug-resources }}"
      ENABLE_COVERAGE: "${{ inputs.run-coverage }}"
      GITHUB_REPOSITORY: ${{ github.repository }}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      GITHUB_USERNAME: ${{ github.actor }}
      JOB_ID: "python-api-client-tests"
      PYTHON_MAJOR_MINOR_VERSION: "${{ inputs.default-python-version }}"
      VERBOSE: "true"
    steps:
      - name: "Cleanup repo"
        shell: bash
        run: sudo rm -rf ${GITHUB_WORKSPACE}/*
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 2
          persist-credentials: false
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: "apache/airflow-client-python"
          fetch-depth: 1
          persist-credentials: false
          path: ./airflow-client-python
      - name: "Prepare breeze & CI image: ${{ inputs.default-python-version }}"
        uses: ./.github/actions/prepare_breeze_and_image
        with:
          platform: ${{ inputs.platform }}
          python: "${{ inputs.default-python-version }}"
          use-uv: ${{ inputs.use-uv }}
          make-mnt-writeable-and-cleanup: true
      - name: "Generate airflow python client"
        run: >
          breeze release-management prepare-python-client --distribution-format both
          --python-client-repo ./airflow-client-python
      - name: "Show diff"
        run: git diff --color HEAD
        working-directory: ./airflow-client-python
      - name: "Python API client tests"
        run: breeze testing python-api-client-tests