ROX-29003: Add ACS smoke test

.github/workflows/acs-smoke-test.yml

@@ -0,0 +1,151 @@
+name: "ACS Smoke Test"
+
+on:
+  # TODO: remove pull_request trigger before merging
+  pull_request:
+    branches: [master]
+  workflow_dispatch:
+    inputs:
+      operator-index-image:
+        description: 'ACS Operator index image (e.g., quay.io/rhacs-eng/stackrox-operator-index:ocp-v4-22-...)'
+        required: true
+        type: string
+      acs-version:
+        description: 'ACS minor version under test (e.g. 4.10). Determines channel and Y-2 oldest.'
+        required: true
+        type: string
+      cluster-lifespan:
+        description: 'Cluster lifespan (e.g., 2h, 4h, 8h)'
+        required: false
+        default: '2h'
+        type: string
+  workflow_call:
+    inputs:
+      operator-index-image:
+        description: 'ACS Operator index image'
+        required: true
+        type: string
+      acs-version:
+        description: 'ACS minor version under test (e.g. 4.10). Determines channel and Y-2 oldest.'
+        required: true
+        type: string
+      cluster-lifespan:
+        description: 'Cluster lifespan (e.g., 2h, 4h, 8h)'
+        required: false
+        default: '2h'
+        type: string
+
+env:
+  CLUSTER_NAME: smoke-${{ github.run_number }}
+  GH_TOKEN: ${{ github.token }}
+  GH_NO_UPDATE_NOTIFIER: 1
+
+run-name: >-
+  ${{ format('ACS Smoke Test - {0}', inputs.operator-index-image) }}
+
+jobs:
+  create-cluster:
+    name: Create OpenShift cluster
+    runs-on: ubuntu-latest
+    outputs:
+      cluster-name: ${{ steps.info.outputs.name }}
+    steps:
+      - name: Set cluster name
+        id: info
+        run: echo "name=${{ env.CLUSTER_NAME }}" >> "$GITHUB_OUTPUT"
+
+      - name: Create OpenShift cluster
+        uses: stackrox/actions/infra/create-cluster@v1
+        with:
+          token: ${{ secrets.INFRA_TOKEN }}
+          flavor: openshift-4
+          name: ${{ env.CLUSTER_NAME }}
+          lifespan: ${{ inputs.cluster-lifespan || '2h' }}
+          wait: true
+
+  run-smoke-tests:
+    name: Run ACS smoke tests
+    needs: create-cluster
+    runs-on: ubuntu-latest
+    env:
+      INFRA_TOKEN: ${{ secrets.INFRA_TOKEN }}
+    container:
+      image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.11@sha256:df3459cf038e73775314b3a5d36d14dda41e6df438a0273c9efa8d23e0f2358a
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v7
+
+      - name: Install infractl
+        uses: stackrox/actions/infra/install-infractl@v1
+
+      - name: Download cluster kubeconfig
+        run: |
+          infractl artifacts \
+            --download-dir=./artifacts \
+            ${{ needs.create-cluster.outputs.cluster-name }}
+
+      - name: Set KUBECONFIG
+        run: echo "KUBECONFIG=${{ github.workspace }}/artifacts/kubeconfig" >> "$GITHUB_ENV"
+
+      - name: "Test 1: upgrade oldest-supported → provided"
+        working-directory: ./smoke-test
+        env:
+          # Add a || operator-index image and version for testing in the PR.
+          # TODO: remove before merging!
+          OPERATOR_INDEX_IMAGE: ${{ inputs.operator-index-image || 'quay.io/rhacs-eng/stackrox-operator-index:ocp-v4-22-7a9fcba929e5858cca91a84c3e5da8c829a3c990-fast' }}
+          ACS_VERSION: ${{ inputs.acs-version || '4.11' }}
+        run: bash upgrade-oldest-test.sh
+
+      - name: Reset operator state between tests
+        working-directory: ./smoke-test
+        run: |
+          source lib.sh
+          reset_operator
+        shell: bash
+
+      - name: "Test 2: install provided → optionally upgrade to latest GA"
+        working-directory: ./smoke-test
+        env:
+          # Add a || operator-index image and version for testing in the PR.
+          # TODO: remove before merging!
+          OPERATOR_INDEX_IMAGE: ${{ inputs.operator-index-image || 'quay.io/rhacs-eng/stackrox-operator-index:ocp-v4-22-7a9fcba929e5858cca91a84c3e5da8c829a3c990-fast' }}
+          ACS_VERSION: ${{ inputs.acs-version || '4.11' }}
+        run: bash upgrade-latest-test.sh
+
+  cleanup-cluster:
+    name: Cleanup cluster
+    needs: [create-cluster, run-smoke-tests]
+    runs-on: ubuntu-latest
+    if: always() && needs.create-cluster.result != 'cancelled'
+    env:
+      INFRA_TOKEN: ${{ secrets.INFRA_TOKEN }}
+    steps:
+      - name: Install infractl
+        uses: stackrox/actions/infra/install-infractl@v1
+
+      - name: Delete cluster
+        run: infractl delete ${{ needs.create-cluster.outputs.cluster-name }}
+
+  report-status:
+    name: Report test status
+    needs: [create-cluster, run-smoke-tests, cleanup-cluster]
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - name: Write summary
+        run: |
+          cat <<'EOF' >> "$GITHUB_STEP_SUMMARY"
+          # ACS Smoke Test Results
+
+          | Field | Value |
+          |-------|-------|
+          | **Operator image** | `${{ inputs.operator-index-image }}` |
+          | **Cluster** | `${{ needs.create-cluster.outputs.cluster-name }}` |
+          | **Create cluster** | ${{ needs.create-cluster.result }} |
+          | **Smoke tests** | ${{ needs.run-smoke-tests.result }} |
+          | **Cleanup** | ${{ needs.cleanup-cluster.result }} |
+
+          ## Tests run:
+          1. **Test 1** — install oldest supported ACS version, upgrade to the provided operator-index image
+          2. **Test 2** — install provided operator-index image, upgrade to latest GA if minor is behind
+          EOF

.github/workflows/auto-smoke-test.yml

@@ -0,0 +1,147 @@
+name: "Auto Smoke Test"
+
+on:
+  workflow_dispatch:
+    inputs:
+      acs-version-override:
+        description: 'Override ACS version, skips bundles.yaml diff (e.g. "4.10")'
+        required: false
+        type: string
+      operator-index-image-override:
+        description: 'Override operator-index image, skips Quay polling (e.g. quay.io/rhacs-eng/stackrox-operator-index:ocp-v4-22-...)'
+        required: false
+        type: string
+  push:
+    branches: [master]
+    paths: ['bundles.yaml']
+  pull_request:
+    paths: ['bundles.yaml']
+
+env:
+  # OCP version used to construct the Konflux-built operator-index image tag.
+  # Update when infra cluster uses a newer OCP version.
+  OCP_VERSION: v4-22
+
+jobs:
+  derive-inputs:
+    name: Derive smoke test inputs
+    runs-on: ubuntu-latest
+    outputs:
+      acs-versions: ${{ steps.version.outputs.acs-versions }}
+      operator-index-image: ${{ steps.image.outputs.operator-index-image }}
+      should-run: ${{ steps.version.outputs.should-run }}
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Determine ACS version
+        id: version
+        env:
+          ACS_VERSION_OVERRIDE: ${{ inputs.acs-version-override }}
+          OPERATOR_INDEX_IMAGE_OVERRIDE: ${{ inputs.operator-index-image-override }}
+          BASE_REF: ${{ github.base_ref }}
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          # Image override without version override is ambiguous then fail fast.
+          if [ -n "$OPERATOR_INDEX_IMAGE_OVERRIDE" ] && [ -z "$ACS_VERSION_OVERRIDE" ]; then
+            echo "::error::operator-index-image-override requires acs-version-override to also be set"
+            exit 1
+          fi
+
+          if [ -n "$ACS_VERSION_OVERRIDE" ]; then
+            echo "Version override provided, skipping bundles.yaml diff: $ACS_VERSION_OVERRIDE"
+            echo "acs-versions=[\"$ACS_VERSION_OVERRIDE\"]" >> "$GITHUB_OUTPUT"
+            echo "should-run=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [ "$EVENT_NAME" = "pull_request" ]; then
+            DIFF_BASE="origin/$BASE_REF"
+          else
+            # Merge to master then diff the previous commit.
+            DIFF_BASE="HEAD~1"
+          fi
+
+          # Match only the `version:` key, ignore `oldest_supported_version:` and others.
+          NEW_VERSIONS=$(git diff "$DIFF_BASE" -- bundles.yaml \
+            | grep '^+[[:space:]]*version:' \
+            | sed 's/.*version:[[:space:]]*//' \
+            || true)
+
+          if [ -z "$NEW_VERSIONS" ]; then
+            echo "No new versions found in bundles.yaml diff, skipping smoke test"
+            echo "should-run=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Build version JSON array for the matrix.
+          MINORS_JSON=$(echo "$NEW_VERSIONS" \
+            | sed 's/^\([0-9]*\.[0-9]*\).*/\1/' \
+            | sort -uV \
+            | jq -Rc '[.,inputs]')
+          echo "New versions added: $(echo "$NEW_VERSIONS" | tr '\n' ' '), testing minors: $MINORS_JSON"
+          echo "acs-versions=$MINORS_JSON" >> "$GITHUB_OUTPUT"
+          echo "should-run=true" >> "$GITHUB_OUTPUT"
+
+      - name: Determine operator-index image
+        id: image
+        if: steps.version.outputs.should-run == 'true'
+        env:
+          OPERATOR_INDEX_IMAGE_OVERRIDE: ${{ inputs.operator-index-image-override }}
+          SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+        run: |
+          if [ -n "$OPERATOR_INDEX_IMAGE_OVERRIDE" ]; then
+            echo "operator-index-image=$OPERATOR_INDEX_IMAGE_OVERRIDE" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          TAG="ocp-${OCP_VERSION}-${SHA}-fast"
+          IMAGE="quay.io/rhacs-eng/stackrox-operator-index:${TAG}"
+
+          CHECK_NAME="Red Hat Konflux / operator-index-ocp-${OCP_VERSION}-on-push"
+          echo "Waiting for Konflux check '$CHECK_NAME' on $SHA..."
+
+          for i in $(seq 1 40); do
+            RESULT=$(gh api /repos/stackrox/operator-index/commits/"$SHA"/check-runs \
+              | jq -r --arg name "$CHECK_NAME" \
+                '.check_runs[] | select(.name == $name) | "\(.status) \(.conclusion)"')
+            case "$RESULT" in
+              "completed success")
+                echo "Konflux build succeeded, verifying image in Quay..."
+                if curl -sf --max-time 30 --connect-timeout 10 \
+                  "https://quay.io/api/v1/repository/rhacs-eng/stackrox-operator-index/tag/?specificTag=${TAG}" \
+                  | jq -e '.tags | length > 0' > /dev/null; then
+                  echo "Image confirmed in Quay: $IMAGE"
+                  echo "operator-index-image=$IMAGE" >> "$GITHUB_OUTPUT"
+                  exit 0
+                fi
+                echo "Konflux check passed but image not found in Quay: $IMAGE"
+                exit 1 ;;
+              "completed "*)
+                echo "Konflux build failed: $RESULT"
+                exit 1 ;;
+            esac
+            echo "Attempt $i/40: ${RESULT:-check not yet started}, retrying in 3 minutes..."
+            [ "$i" -lt 40 ] && sleep 180
+          done
+
+          echo "Timed out after 2 hours waiting for Konflux build: $CHECK_NAME"
+          exit 1
+
+  smoke-test:
+    name: Run smoke test
+    needs: derive-inputs
+    if: needs.derive-inputs.outputs.should-run == 'true'
+    strategy:
+      matrix:
+        acs-version: ${{ fromJson(needs.derive-inputs.outputs.acs-versions) }}
+      # if any matrix job fails, continue to run the rest of the jobs
+      fail-fast: false
+    uses: ./.github/workflows/acs-smoke-test.yml
+    with:
+      operator-index-image: ${{ needs.derive-inputs.outputs.operator-index-image }}
+      acs-version: ${{ matrix.acs-version }}
+      cluster-lifespan: 3h
+    secrets: inherit