forge-unstable.yaml

# Continuously run unstable forge tests against the latest main branch, to promote to stable.
name: Continuous Forge Tests - Unstable

permissions:
  issues: write
  pull-requests: write
  contents: read
  id-token: write
  actions: write #required for workflow cancellation via check-aptos-core

on:
  # Allow triggering manually
  workflow_dispatch:
    inputs:
      IMAGE_TAG:
        required: false
        type: string
        description: The docker image tag to test. This may be a git SHA1, or a tag like "<branch>_<git SHA1>". If not specified, Forge will find the latest build based on the git history (starting from GIT_SHA input)
      GIT_SHA:
        required: false
        type: string
        description: The git SHA1 to checkout. This affects the Forge test runner that is used. If not specified, the latest main will be used
  schedule:
    - cron: "0 15 * * *" # the main branch cadence
  pull_request:
    paths:
      - ".github/workflows/forge-unstable.yaml"

env:
  AWS_ACCOUNT_NUM: ${{ secrets.ENV_ECR_AWS_ACCOUNT_NUM }}
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  AWS_REGION: us-west-2
  IMAGE_TAG: ${{ inputs.IMAGE_TAG }} # this is only used for workflow_dispatch, otherwise defaults to empty

jobs:
  # This job determines the image tag and branch to test, and passes them to the other jobs
  # NOTE: this may be better as a separate workflow as the logic is quite complex but generalizable
  determine-test-metadata:
    runs-on: ubuntu-latest
    outputs:
      IMAGE_TAG: ${{ steps.determine-test-image-tag.outputs.IMAGE_TAG }}
      BRANCH: ${{ steps.determine-test-branch.outputs.BRANCH }}
    steps:
      - name: Determine branch based on cadence
        id: determine-test-branch
        run: |
          if [[ "${{ github.event_name }}" == "schedule" ]]; then
            if [[ "${{ github.event.schedule }}" == "0 15 * * *" ]]; then
              echo "Branch: main"
              echo "BRANCH=main" >> $GITHUB_OUTPUT
            else
              echo "Unknown schedule: ${{ github.event.schedule }}"
              exit 1
            fi
          else
            echo "Using GIT_SHA"
            # on workflow_dispatch, this will simply use the inputs.GIT_SHA given (or the default)
            # on pull_request, this will default to null and the following "checkout" step will use the PR's base branch
            echo "BRANCH=${{ inputs.GIT_SHA }}" >> $GITHUB_OUTPUT
          fi

      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # pin@v3
        with:
          ref: ${{ steps.determine-test-branch.outputs.BRANCH }}
          fetch-depth: 0

      - uses: aptos-labs/aptos-core/.github/actions/check-aptos-core@main
        with:
          cancel-workflow: ${{ github.event_name == 'schedule' }} # Cancel the workflow if it is scheduled on a fork

      # find_latest_images.py requires docker utilities and having authenticated to internal docker image registries
      - uses: aptos-labs/aptos-core/.github/actions/docker-setup@main
        id: docker-setup
        with:
          GCP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          GCP_SERVICE_ACCOUNT_EMAIL: ${{ secrets.GCP_SERVICE_ACCOUNT_EMAIL }}
          EXPORT_GCP_PROJECT_VARIABLES: "false"
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DOCKER_ARTIFACT_REPO: ${{ secrets.AWS_DOCKER_ARTIFACT_REPO }}
          GIT_CREDENTIALS: ${{ secrets.GIT_CREDENTIALS }}

      - uses: ./.github/actions/python-setup
        with:
          pyproject_directory: testsuite

      - name: Determine image tag
        id: determine-test-image-tag
        # forge relies on the default and failpoints variants
        run: ./testrun find_latest_image.py --variant failpoints --variant performance
        shell: bash
        working-directory: testsuite

      - name: Write summary
        run: |
          IMAGE_TAG=${{ steps.determine-test-image-tag.outputs.IMAGE_TAG }}
          BRANCH=${{ steps.determine-test-branch.outputs.BRANCH }}
          if [ -n "${BRANCH}" ]; then
            echo "BRANCH: [${BRANCH}](https://github.com/${{ github.repository }}/tree/${BRANCH})" >> $GITHUB_STEP_SUMMARY
          fi
          echo "IMAGE_TAG: [${IMAGE_TAG}](https://github.com/${{ github.repository }}/commit/${IMAGE_TAG})" >> $GITHUB_STEP_SUMMARY

  forge-continuous:
    if: ${{ github.event_name != 'pull_request' }}
    needs: determine-test-metadata
    uses: aptos-labs/aptos-core/.github/workflows/workflow-run-forge.yaml@main
    secrets: inherit
    with:
      IMAGE_TAG: ${{ needs.determine-test-metadata.outputs.IMAGE_TAG }}
      # GCP cluster
      FORGE_CLUSTER_NAME: aptos-forge-1
      COMMENT_HEADER: forge-continuous
      # This test suite is configured using the forge.py config test command
      FORGE_TEST_SUITE: continuous

  run-forge-state-sync-slow-processing-catching-up-test:
    if: ${{ github.event_name != 'pull_request' }}
    needs: determine-test-metadata
    uses: aptos-labs/aptos-core/.github/workflows/workflow-run-forge.yaml@main
    secrets: inherit
    with:
      IMAGE_TAG: ${{ needs.determine-test-metadata.outputs.IMAGE_TAG }}
      # GCP cluster
      FORGE_CLUSTER_NAME: aptos-forge-1
      FORGE_NAMESPACE: forge-state-sync-slow-processing-catching-up-test-${{ needs.determine-test-metadata.outputs.IMAGE_TAG }}
      FORGE_RUNNER_DURATION_SECS: 900
      FORGE_TEST_SUITE: state_sync_slow_processing_catching_up
      POST_TO_SLACK: true
      FORGE_ENABLE_FAILPOINTS: true

  run-forge-twin-validator-test:
    if: ${{ github.event_name != 'pull_request' }}
    needs: determine-test-metadata
    uses: aptos-labs/aptos-core/.github/workflows/workflow-run-forge.yaml@main
    secrets: inherit
    with:
      IMAGE_TAG: ${{ needs.determine-test-metadata.outputs.IMAGE_TAG }}
      # GCP cluster
      FORGE_CLUSTER_NAME: aptos-forge-1
      FORGE_NAMESPACE: forge-twin-validator-${{ needs.determine-test-metadata.outputs.IMAGE_TAG }}
      FORGE_RUNNER_DURATION_SECS: 900
      FORGE_TEST_SUITE: twin_validator_test
      POST_TO_SLACK: true

  run-forge-state-sync-failures-catching-up-test:
    if: ${{ github.event_name != 'pull_request' }}
    needs: determine-test-metadata
    uses: aptos-labs/aptos-core/.github/workflows/workflow-run-forge.yaml@main
    secrets: inherit
    with:
      IMAGE_TAG: ${{ needs.determine-test-metadata.outputs.IMAGE_TAG }}
      FORGE_NAMESPACE: forge-state-sync-failures-catching-up-test-${{ needs.determine-test-metadata.outputs.IMAGE_TAG }}
      # GCP cluster
      FORGE_CLUSTER_NAME: aptos-forge-1
      FORGE_RUNNER_DURATION_SECS: 900
      FORGE_TEST_SUITE: state_sync_failures_catching_up
      FORGE_ENABLE_FAILPOINTS: true
      POST_TO_SLACK: ${{ needs.determine-test-metadata.outputs.BRANCH == 'main' }} # only post to slack on main branch

  run-forge-validator-reboot-stress-test:
    if: ${{ github.event_name != 'pull_request' }}
    needs: determine-test-metadata
    uses: aptos-labs/aptos-core/.github/workflows/workflow-run-forge.yaml@main
    secrets: inherit
    with:
      IMAGE_TAG: ${{ needs.determine-test-metadata.outputs.IMAGE_TAG }}
      # GCP cluster
      FORGE_CLUSTER_NAME: aptos-forge-1
      FORGE_NAMESPACE: forge-validator-reboot-stress-${{ needs.determine-test-metadata.outputs.IMAGE_TAG }}
      # Run for 40 minutes
      FORGE_RUNNER_DURATION_SECS: 2400
      FORGE_TEST_SUITE: validator_reboot_stress_test
      POST_TO_SLACK: true