Update OWNERS for /charts/partners/atiwary-containers/testw

.github/actions/check-chart-locks/action.yml

@@ -0,0 +1,63 @@
+name: Check For Lock
+description: |
+  Checks for the existence of chart-name in a given chart lock file. If a chart
+  is found to be locked at the URL searched, the lockpath is returned should the
+  caller need it for further evaluation.
+
+  Designed to work with OWNERS file merges to prevent chart naming conflicts.
+inputs:
+  # e.g. vault
+  chart-name:
+    required: true
+    description:
+      Check the lock status of this chart by name.
+  fail-workflow-if-locked:
+    required: false
+    default: 'false'
+    description: |
+      Forces a failure of this action when the chart is locked. Must explicitly
+      be set to the value 'true'. All other values (even a boolean true) are
+      considered false.
+outputs:
+  # e.g. true/false
+  chart-is-locked:
+    description: Whether the chart provided via the chart-name input is locked
+    value: ${{ steps.set-lock-state.outputs.chart-is-locked }}
+  # e.g. charts/category/vendor/chartname if package-is-locked is true, else null
+  locked-to-path:
+    description: The path to which a locked chart is locked.
+    value: ${{ steps.check-for-chart-lock.outputs.locked-to-path }}
+runs:
+  using: composite
+  steps:
+  - name: Generate Locks
+    id: generate-locks
+    uses: ./.github/actions/generate-chart-locks
+  - name: Check lockfile for chart lock
+    id: check-for-chart-lock
+    shell: bash
+    run: |
+      set -e
+      echo "Ensuring expected key exists in lock JSON."
+      jq --exit-status .packages < ${{ steps.generate-locks.outputs.lockfile-path }}
+
+      echo "Checking if chart '${{ inputs.chart-name }}' is locked."
+      LOCK_PATH=$(jq -r '.packages."${{ inputs.chart-name }}"' < ${{ steps.generate-locks.outputs.lockfile-path }})
+
+      echo "locked-to-path=${LOCK_PATH}" | tee -a $GITHUB_OUTPUT
+
+  # Defaults to a locked state as a safeguard.
+  - name: Set lock state output
+    shell: bash
+    id: set-lock-state
+    run: |
+      echo "chart-is-locked=${{ steps.check-for-chart-lock.outputs.locked-to-path != 'null' }}" | tee -a $GITHUB_OUTPUT
+
+  - name: Fail if requested and the chart is locked
+    shell: bash
+    if: |
+      inputs.fail-workflow-if-locked == 'true' &&
+      steps.set-lock-state.outputs.chart-is-locked == 'true'
+    run: |
+      echo "::error::Workflow is failing at the caller's request."
+      exit -1

.github/actions/generate-chart-locks/action.yaml

@@ -0,0 +1,76 @@
+name: Generate Chart Locks
+description: |
+  Generates chart locks at runtime and places the generated contents on the
+  filesystem.
+
+  For pull_request / pull_request_target events, this will pull down the branch
+  receiving the changes as the source of truth.
+
+  In the production repository, this will always pull the main branch, regardless
+  of which branch is receiving the pull request.
+
+  It is expected that the CI scripts have already been installed at call time.
+inputs:
+  to-file:
+    description: Where to write the chart-locks.json file.
+    default: "/tmp/chart-locks.json"
+    required: false
+  generator-cmd-path:
+    description: |
+      The path to the generate-chart-locks command. This action expects CI
+      scripts to be installed by the caller, and so it stands to reason the
+      caller may install scripts at various locations.
+    default: "../ve1/bin/generate-chart-locks"
+    required: false
+outputs:
+  lockfile-path:
+    description: |
+      Where the lock file was written. Mostly placed as an output to simplify
+      workflows for callers.
+    value: ${{ steps.generate-chart-locks.outputs.lockfile-path }}
+runs:
+  using: composite
+  steps:
+  - name: Resolve repository ref
+    id: resolve
+    shell: bash
+    run: |
+      set -e
+
+      # PRs to the production repository will always use main.
+      if [ "${GITHUB_REPOSITORY}" == "openshift-helm-charts/charts" ]; then
+        echo "Running in the production repository."
+        echo "The only allowed ref is 'refs/heads/main'."
+        echo "ref=refs/heads/main" | tee -a $GITHUB_OUTPUT
+        exit 0
+      fi
+
+      echo "GITHUB_EVENT_NAME = '${GITHUB_EVENT_NAME}'"
+      echo "GITHUB_BASE_REF = '${GITHUB_BASE_REF}'"
+
+      # GITHUB_BASE_REF is set for pull_requests/pull_requests_targets, but empty for
+      # workflow_dispatch. We'll set it to main if it's not set.
+      resolvedRef="refs/heads/${GITHUB_BASE_REF:-"main"}"
+      echo "ref=${resolvedRef}" | tee -a $GITHUB_OUTPUT
+  - name: Checkout
+    id: clone-repository
+    uses: actions/checkout@v4
+    with:
+      ref: ${{ steps.resolve.outputs.ref }}
+      path: temp-gen-chart-lock-repo
+  - name: Set up Python
+    uses: ./.github/actions/setup-python
+  - name: Generate lock file JSON from existing charts
+    working-directory: temp-gen-chart-lock-repo
+    id: generate-chart-locks
+    shell: bash
+    run: |
+      set -eo pipefail
+      ${{ inputs.generator-cmd-path }} | jq | tee ${{ inputs.to-file }}
+      echo "lockfile-path=$(realpath ${{ inputs.to-file }})" | tee -a $GITHUB_OUTPUT
+  - name: Cleanup
+    id: cleanup
+    if: always()
+    shell: bash
+    run: |
+      rm -rf temp-gen-chart-lock-repo

.github/actions/get-ocp-range/action.yaml

@@ -0,0 +1,35 @@
+name: 'Get OCP range'
+description: 'Get the range of OCP versions corresponding to the provided range of Kubernetes versions'
+inputs:
+  kube-version-range:
+    description: 'Range of Kubernetes versions'
+    required: true
+outputs:
+  ocp-version-range:
+    description: "Corresponsing range of OCP versions"
+    value: ${{ steps.run-get-ocp-range.outputs.ocp-version-range }}
+runs:
+  using: "composite"
+  steps:
+    - name: Setup Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: '>=1.20'
+
+    - name: Install get-ocp-range
+      shell: bash
+      run: go install github.com/opdev/getocprange/cmd/get-ocp-range@latest
+
+    - name: Run get-ocp-range
+      id: run-get-ocp-range
+      shell: bash
+      run: |
+        echo "::debug::Received kubeVersionRange to translate '${{ inputs.kube-version-range }}'"
+        OCP_VERSION_RANGE=$(get-ocp-range '${{ inputs.kube-version-range }}')
+        echo "ocp-version-range=$OCP_VERSION_RANGE" >> $GITHUB_OUTPUT
+        echo "::debug::Successfully translated kubeVersionRange to OCPVersionRange $OCP_VERSION_RANGE"
+
+    - name: Display error message if get-ocp-range failed
+      if: ${{ failure() && steps.run-get-ocp-range.outcome == 'failure' }}
+      shell: bash
+      run: echo "::error file=.github/actions/get-ocp-range/action.yaml::Error running get-ocp-range"

.github/actions/setup-python/action.yml

@@ -0,0 +1,13 @@
+name: Setup Python
+description: |
+  Consistently installs python across this project. Should be used as a
+  replacement for direct calls to actions/setup-python.
+
+  Serves as the single place to update python versions over time across the
+  project.
+runs:
+  using: composite
+  steps:
+  - uses: actions/setup-python@v5
+    with:
+      python-version: '3.10'

.github/labeler.yml

@@ -0,0 +1,4 @@
+allow/chart-changes:
+  - any: ['charts/partners/**/**/*', '!charts/partners/**/**/OWNERS']
+  - any: ['charts/redhat/**/**/*', '!charts/partners/**/**/OWNERS']
+  - any: ['charts/community/**/**/*', '!charts/partners/**/**/OWNERS']

.github/workflows/behave.yml

@@ -0,0 +1,150 @@
+name: Behave Testing
+
+# Behave Testing will run the repository's Behave testing with each feature file
+# getting its own runner. All feature files found within the specific path are
+# included.
+
+on:
+  workflow_call:
+    inputs:
+      tags:
+        type: string
+        required: true
+        description: |
+          The behave tags to use. E.g "full". Multiple tags should be specified
+          separated by a comma, e.g. "owners,redhat".
+      pr-body:
+        type: string
+        required: true
+        description: |
+          Every pull request created by this automation will have this pr-body.
+      behave-logging-level:
+        type: string
+        required: false
+        default: WARNING
+        description: |
+          Value passed to behave's --logging-level flag.
+      # actions/checkout related inputs used for testing. In some cases behave
+      # calls will use the PR branch instead of the main branch. E.g. when doing
+      # release testing
+      checkout-fetch-depth:
+        type: number
+        required: false
+        default: 1 # aligns with actions/checkout default.
+        description: |
+          fetch-depth flag to actions/checkout.
+
+          If setting to a pull request, caller is responsible 
+          for verifying the user is a trusted user.
+      checkout-repository:
+        type: string
+        required: false
+        default: ""
+        description: |
+          repository flag to actions/checkout
+
+          If setting to a pull request, caller is responsible 
+          for verifying the user is a trusted user.
+      checkout-ref:
+        type: string
+        required: false
+        default: ""
+        description: |
+          ref flag to actions/checkout
+
+          If setting to a pull request, caller is responsible 
+          for verifying the user is a trusted user.
+    secrets:
+      # bot-name is not technically secret, but must be listed as a secret
+      # because you can't pass the ${{ secrets }} context as an input in the
+      # calling workflow, and our repos have this configured as a secret.
+      bot-name:
+        required: true
+        description: |
+          The name of the GitHub user that will send pull requests.
+      bot-token:
+        description: |
+          A GitHub token for the bot user that will initiate pull 
+          requests for testing. Should NOT be set to GITHUB_TOKEN.
+        required: true
+jobs:
+  get-features:
+    runs-on: ubuntu-latest
+    outputs:
+      features: ${{ steps.find-features.outputs.features }}
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.checkout-ref }}
+          repository: ${{ inputs.checkout-repository }}
+          fetch-depth: ${{ inputs.checkout-fetch-depth }}
+      - name: find features
+        # Find the feature files currently defined in repo. We expect to find at
+        # least 15 files, though that number is arbitrarily chosen at a figure
+        # below the actual count at the time of this writing (19).
+        #
+        # The expectation is that all behave tests are expected to exist at this
+        # path.
+        id: find-features
+        run: |
+          set -e
+          cd tests/functional/behave_features
+          features=$(find . -name '*.feature' | sed -e 's%\./%%g' | jq -R -s -c 'split("\n") | del(.[] | select(length == 0))')
+          [ "${features}" == "" ] && { echo "The feature file variable was empty"; exit 1 ;}
+          echo "Found feature files: ${features}"
+          echo "Running sanity checks."
+          echo -n "File list correctly formatted into an array: "; echo "${features}" | jq --exit-status 'type == "array"'
+          echo -n "A sufficient number of feature files were found: "; echo "${features}" | jq --exit-status 'length > 15'
+          echo "Sanity checks done."
+          echo "features=${features}" | tee -a $GITHUB_OUTPUT
+  run-tests:
+    runs-on: ubuntu-latest
+    needs: [get-features]
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix: 
+        feature-file: ${{ fromJson(needs.get-features.outputs.features) }}
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.bot-token }}
+          ref: ${{ inputs.checkout-ref }}
+          repository: ${{ inputs.checkout-repository }}
+          fetch-depth: ${{ inputs.checkout-fetch-depth }}
+
+      - name: Set up Python
+        uses: ./.github/actions/setup-python
+
+      - name: Set up CI scripts
+        run: |
+          # set up python scripts
+          echo "set up python script in $PWD"
+          python3 -m venv ve1
+          cd scripts
+          ../ve1/bin/pip3 install -r requirements.txt
+          ../ve1/bin/pip3 install .
+          cd ..
+
+        # Pull request numbers are included in generated chart names in E2E, so it's included
+        # as an environment variable which E2E consumes.
+      - name: Populate PR_NUMBER environment variable
+        if: github.event_name == 'pull_request_target' || github.event_name == 'pull_request'
+        run: |
+          echo "PR_NUMBER=${{ github.event.pull_request.number }}" | tee $GITHUB_ENV
+
+      - name: Run Tests
+        env:
+          GITHUB_TOKEN: ${{ secrets.github-token }}
+          BOT_NAME: ${{ secrets.bot-name }}
+          BOT_TOKEN: ${{ secrets.bot-token }}
+          PR_BODY: ${{ inputs.pr-body }}
+        run: |
+          ve1/bin/behave tests/functional/behave_features/ \
+            --include ${{ matrix.feature-file }} \
+            --tags=${{ inputs.tags }} \
+            --logging-level=${{ inputs.behave-logging-level }} \
+            --no-capture \
+            --no-color