ci-build.yaml

name: CI
on:
  push:
    branches:
      - "main"
      - "release-*"
      - "!release-2.8"
  pull_request:
    branches:
      - "main"
      - "release-*"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  changed-files:
    name: Get changed files
    outputs:
      # reference: https://github.com/tj-actions/changed-files#outputs-
      tests: ${{ steps.changed-files.outputs.tests_any_modified == 'true' }}
      e2e-tests: ${{ steps.changed-files.outputs.e2e-tests_any_modified == 'true' }}
      codegen: ${{ steps.changed-files.outputs.codegen_any_modified == 'true' }}
      lint: ${{ steps.changed-files.outputs.lint_any_modified == 'true' }}
      ui: ${{ steps.changed-files.outputs.ui_any_modified == 'true' }}
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 50 # assume PRs are less than 50 commits
      - name: Get relevant files changed per group
        id: changed-files
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
          files_yaml: |
            common: &common
              - .github/workflows/ci-build.yaml
              - .github/actions/**
              - Makefile
              - Tiltfile
              - Dockerfile
              - hack/tilt/**
            tests: &tests
              - *common
              - cmd/**
              - config/**
              - errors/**
              - persist/**
              - pkg/**
              - server/**
              - test/**
              - util/**
              - workflow/**
              - go.mod
              - go.sum
            e2e-tests:
              - *tests
              # plus manifests and SDKs that are used in E2E tests
              - Dockerfile
              - manifests/**
              - sdks/**
              # example test suite
              - examples/**
              - go.mod
              - go.sum
              - hack/k8s-versions.sh
            codegen:
              - *common
              # generated files
              - api/**
              - docs/fields.md
              - docs/executor_swagger.md
              - docs/cli/**
              - docs/workflow-controller-configmap.md
              - docs/metrics.md
              - pkg/**
              - sdks/java/**
              # files that generation is based off
              - pkg/**
              - cmd/**
              - examples/** # examples are used within the fields lists
              - manifests/** # a few of these are generated and committed
              - config/** # docs/workflow-controller-configmap.md is generated from config/*.go
              - persist/** # docs/database-migrations.md is generated from persist/sqldb/migrate.go
              - util/sync/db/** # docs/database-migrations.md is generated from util/sync/db/migrate.go
              - util/telemetry/builder/** # docs/metrics.md and docs/tracing.md are generated from util/telemetry/builder/values.yaml
              # generation scripts
              - hack/api/**
              - hack/docs/**
              - hack/manifests/**
              - go.mod
              - go.sum
            lint:
              - *tests
              - .features/**
              # plus lint config
              - .golangci.yml
              # all GH workflows / actions
              - .github/workflows/**
              # docs files below
              - docs/**
              # generated files are covered by codegen
              - '!docs/fields.md'
              - '!docs/executor_swagger.md'
              - '!docs/cli/**'
              # docs scripts & tools from `make docs`
              - hack/docs/copy-readme.sh
              - hack/docs/check-env-doc.sh
              - hack/featuregen/**
              - .markdownlint.yaml
              - .mlc_config.json
              - .cspell.json
              - _typos.toml
              - properdocs.yml
              - go.mod
              - go.sum
            ui:
              - *common
              - ui/**

  tests:
    name: Unit Tests
    needs: [ changed-files ]
    if: ${{ needs.changed-files.outputs.tests == 'true' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.26"
          cache: true
      - run: make test STATIC_FILES=false GOTEST_FLAGS='-covermode=atomic -coverprofile=coverage.out'
      - name: Upload test results
        if: ${{ always() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: test-results-unit
          path: test/reports/json/unit.json
          if-no-files-found: warn
          retention-days: 10
      - name: Upload coverage report
        # runs on PRs as well as main so codecov can comment a coverage report on the PR
        if: github.repository == 'argoproj/argo-workflows'
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          files: coverage.out
          disable_search: true
          flags: unit-tests
          fail_ci_if_error: true
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  tests-windows:
    name: Windows Unit Tests
    needs: [ changed-files ]
    if: ${{ needs.changed-files.outputs.tests == 'true' }}
    runs-on: windows-2022
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.26"
          cache: true
      # windows run does not use makefile target because it does a lot more than just testing and is not cross-platform compatible
      - run: if (!(Test-Path "ui/dist/app/index.html")) { New-Item -ItemType Directory -Force -Path "ui/dist/app" | Out-Null; New-Item -ItemType File -Path "ui/dist/app/placeholder" | Out-Null }; go test -p 20 -covermode=atomic -coverprofile='coverage.out' $(go list ./... | select-string -Pattern 'github.com/argoproj/argo-workflows/v4/workflow/controller' , 'github.com/argoproj/argo-workflows/v4/server' -NotMatch)
        env:
          KUBECONFIG: /dev/null
          # This job runs go test directly (not through make), so it must set the
          # tag the Makefile normally exports: without it, Kubernetes v0.35 types
          # lack ProtoMessage() and pkg/apiclient's startup probe fails.
          GOFLAGS: -tags=kubernetes_protomessage_one_more_release
      - name: Upload coverage report
        # runs on PRs as well as main so codecov can comment a coverage report on the PR
        if: github.repository == 'argoproj/argo-workflows'
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          files: coverage.out
          disable_search: true
          flags: unit-tests-windows
          fail_ci_if_error: true
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  e2e-tools:
    name: E2E Tools
    needs: [ changed-files ]
    # also required by e2e-ui (runs on ui-only changes); keep this condition a
    # superset of e2e-ui's, else a skipped dependency cascades and e2e-ui is
    # silently skipped on ui-only PRs
    if: ${{ needs.changed-files.outputs.e2e-tests == 'true' || needs.changed-files.outputs.ui == 'true' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.26"
          cache: true
      - name: Build k3d and Tilt once
        # The whole e2e matrix shares these binaries via the artifact below, so
        # we hit the k3d module proxy and the Tilt release CDN once each — not in
        # ~14 parallel jobs, which throttles the CDN. This is why neither install
        # needs download retries.
        run: |
          make k3d tilt
          mkdir -p tools-bin
          cp "$(go env GOPATH)/bin/k3d" "$(go env GOPATH)/bin/tilt" tools-bin/
      - name: Upload tools
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-tools
          path: tools-bin
          if-no-files-found: error

  e2e-tests:
    name: E2E Tests
    needs: [ changed-files, e2e-tools ]
    if: ${{ needs.changed-files.outputs.e2e-tests == 'true' }}
    runs-on: ubuntu-24.04
    # These tests usually finish in ~25m, but occasionally they take much longer due to resource
    # contention on the runner, which we have no control over.
    timeout-minutes: 60
    env:
      KUBECONFIG: /home/runner/.kube/config
      E2E_ENV_FACTOR: 2
    strategy:
      fail-fast: false
      matrix:
        include:
          - test: test-artifacts
            profile: minimal
            use-api: false
          - test: test-artifacts
            profile: minimal
            use-api: false
            initless: true
          - test: test-executor
            profile: minimal
            use-api: false
          - test: test-executor
            profile: minimal
            use-api: false
            initless: true
          - test: test-corefunctional
            profile: minimal
            use-api: false
          - test: test-corefunctional
            profile: minimal
            use-api: false
            initless: true
          - test: test-functional
            profile: minimal
            use-api: false
          - test: test-functional
            profile: minimal
            use-api: false
            initless: true
          - test: test-api
            profile: mysql
            use-api: true
          - test: test-api
            profile: postgres
            use-api: true
          - test: test-metrics
            profile: mysql
            use-api: true
          - test: test-metrics
            profile: postgres
            use-api: true
          - test: test-tracing
            profile: telemetry
            use-api: false
          - test: test-telemetry
            profile: telemetry-stack
            use-api: false
            retries: 0
          - test: test-cli
            profile: mysql
            use-api: true
          # Cron tests are not retryable without a controller restart
          - test: test-cron
            profile: minimal
            use-api: false
            retries: 0
          - test: test-examples
            profile: minimal
            use-api: false
            retries: 0
          - test: test-examples
            profile: minimal
            use-api: false
            retries: 0
            initless: true
          - test: test-plugins
            profile: plugins
            use-api: false
          - test: test-plugins
            profile: plugins
            use-api: false
            initless: true
          - test: test-go-sdk
            profile: minimal
            use-api: true
            secure: true
          - test: test-java-sdk
            profile: minimal
            use-api: true
          - test: test-artifacts
            k8s_version: min
            profile: minimal
            use-api: false
          - test: test-executor
            k8s_version: min
            profile: minimal
            use-api: false
          - test: test-corefunctional
            k8s_version: min
            profile: minimal
            use-api: false
          - test: test-functional
            k8s_version: min
            profile: minimal
            use-api: false
          - test: test-dbsemaphore
            k8s_version: min
            profile: mysql
            use-api: false
          - test: test-dbsemaphore
            k8s_version: min
            profile: postgres
            use-api: false
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.26"
          cache: true
      - name: Install Java for the SDK
        if: ${{matrix.test == 'test-java-sdk'}}
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: '8'
          distribution: adopt
          cache: maven
      - name: Set up k3d cluster and E2E tooling
        uses: ./.github/actions/e2e-cluster-up
        with:
          k8s-version: ${{ matrix.k8s_version || 'max' }}
          cli-auth-kubeconfig: "true"
      - name: Build images and start Argo in-cluster
        # tilt builds the production images, deploys them, and then keeps
        # running through the test steps so its port-forwards (argo-server,
        # minio, databases) keep serving the tests over localhost. `tilt wait`
        # gates on every resource (image builds, deploys, readiness probes)
        # becoming Ready; the step timeout bounds the wait.
        run: |
          tilt up --stream -- --mode=ci --profile=${{matrix.profile}} \
            --api=${{matrix.use-api}} \
            --secure=${{matrix.secure || 'false'}} \
            --auth-mode=client \
            --initless=${{matrix.initless || 'false'}} \
            --pod-status-capture-finalizer=true > /tmp/tilt.log 2>&1 &
          # resources only register once the Tiltfile finishes evaluating; wait
          # for one we know is always defined before trusting `--all`, which
          # would otherwise pass on the (Tiltfile) resource alone
          until tilt get uiresource workflow-controller >/dev/null 2>&1; do
            echo "waiting for Tilt to load..."
            sleep 2
          done
          until tilt wait --for=condition=Ready uiresource --all --timeout=15s 2>/dev/null; do
            echo "waiting for Tilt resources to become ready..."
            tilt get uiresources 2>/dev/null || true
            sleep 5
          done
        timeout-minutes: 15
      - name: Validate release manifests
        run: make manifests-validate
      - name: Run tests ${{matrix.test}}
        env:
          # don't default in the expression: `matrix.retries || '2'` would turn
          # an explicit `retries: 0` into 2, because 0 is falsy
          MATRIX_RETRIES: ${{ matrix.retries }}
        run: make ${{matrix.test}} E2E_SUITE_TIMEOUT=30m STATIC_FILES=false INITLESS=${{ matrix.initless || 'false' }} TEST_RETRIES="${MATRIX_RETRIES:-2}"
      - name: Upload test results
        if: ${{ always() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: test-results-${{matrix.test}}-${{matrix.profile}}-k8s-${{matrix.k8s_version || 'max'}}${{ matrix.initless && '-initless' || '' }}
          path: test/reports/json/${{matrix.test}}.json
          if-no-files-found: warn
          retention-days: 10

      # failure debugging below
      - name: Failure debug - logs
        if: ${{ failure() }}
        uses: ./.github/actions/e2e-failure-debug
      - name: Failure debug - describe MinIO/Database deployment
        if: ${{ failure() }}
        run: |
          set -eux
          kubectl get deploy
          kubectl describe deploy
      - name: Failure debug - describe MinIO/Database pods
        if: ${{ failure() }}
        run: |
          set -eux
          kubectl get pods -l '!workflows.argoproj.io/workflow'
          kubectl describe pods -l '!workflows.argoproj.io/workflow'
      - name: Failure debug - MinIO/MySQL logs
        if: ${{ failure() }}
        run: kubectl logs -l '!workflows.argoproj.io/workflow' --prefix
      - name: Failure debug - describe Workflow pods
        if: ${{ failure() }}
        run: |
          set -eux
          kubectl get pods -l workflows.argoproj.io/workflow
          kubectl describe pods -l workflows.argoproj.io/workflow

        # workaround for status checks -- check this one job instead of each individual E2E job in the matrix
        # this allows us to skip the entire matrix when it doesn't need to run while still having accurate status checks
        # see https://github.com/orgs/community/discussions/9141#discussioncomment-2296809 and https://github.com/orgs/community/discussions/26822#discussioncomment-3305794
  e2e-tests-composite-result:
    name: E2E Tests - Composite result
    needs: [ e2e-tools, e2e-tests, e2e-ui ]
    if: ${{ always() }}
    runs-on: ubuntu-24.04
    steps:
      - run: |
          tools="${{ needs.e2e-tools.result }}"
          result="${{ needs.e2e-tests.result }}"
          ui="${{ needs.e2e-ui.result }}"
          # a tools failure skips the dependent jobs, which must not count as a pass
          if [[ $tools == "failure" ]]; then
            exit 1
          fi
          # mark as successful even if skipped (e.g. a PR that touches neither)
          if [[ ( $result == "success" || $result == "skipped" ) && ( $ui == "success" || $ui == "skipped" ) ]]; then
            exit 0
          else
            exit 1
          fi

  codegen:
    name: Codegen
    needs: [ changed-files ]
    if: ${{ needs.changed-files.outputs.codegen == 'true' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    env:
      GOPATH: /home/runner/go
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.26"
          cache: true
      - name: Install protoc
        run: |
          set -eux -o pipefail
          curl -OL https://github.com/protocolbuffers/protobuf/releases/download/v3.19.4/protoc-3.19.4-linux-x86_64.zip
          sudo unzip -o protoc-3.19.4-linux-x86_64.zip -d /usr/local bin/protoc
          sudo unzip -o protoc-3.19.4-linux-x86_64.zip -d /usr/local 'include/*'
          sudo chmod +x /usr/local/bin/protoc
          sudo find /usr/local/include -type f | xargs sudo chmod a+r
          sudo find /usr/local/include -type d | xargs sudo chmod a+rx
          ls /usr/local/include/google/protobuf/
      - name: Pull OpenAPI Generator CLI Docker image
        run: |
          docker pull openapitools/openapi-generator-cli:v5.4.0 &
          docker pull openapitools/openapi-generator-cli:v5.2.1 &
      - name: Create symlinks
        run: |
          mkdir -p /home/runner/go/src/github.com/argoproj
          ln -s "$PWD" /home/runner/go/src/github.com/argoproj/argo-workflows
      - run: make codegen -B STATIC_FILES=false
      # if codegen makes changes that are not in the PR, fail the build
      - name: Check if codegen made changes not present in the PR
        run: git diff --exit-code

  lint:
    name: Lint
    needs: [ changed-files ]
    if: ${{ needs.changed-files.outputs.lint == 'true' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 15 # must be strictly greater than the timeout in .golangci.yml
    env:
      GOPATH: /home/runner/go
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.26"
          cache: true
      - run: make lint STATIC_FILES=false
      # if lint makes changes that are not in the PR, fail the build
      - name: Check if lint made changes not present in the PR
        run: git diff --exit-code
      # lint GH Actions
      - name: Ensure GH Actions are pinned to SHAs
        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@c5fc58bd0be7a4b94b73ce40250322d5b838a108 # v5.0.7

  ui:
    name: UI
    needs: [ changed-files ]
    if: ${{ needs.changed-files.outputs.ui == 'true' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 6
    env:
      NODE_OPTIONS: --max-old-space-size=4096
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24" # change in all GH Workflows
          cache: yarn
          cache-dependency-path: ui/yarn.lock
      - run: yarn --cwd ui install
      - run: yarn --cwd ui build
      - run: yarn --cwd ui test
      - run: yarn --cwd ui lint
      - run: yarn --cwd ui deduplicate
      # if lint or deduplicate make changes that are not in the PR, fail the build
      - name: Check if lint & deduplicate made changes not present in the PR
        run: git diff --exit-code
      # check to see if it'll start (but not if it'll render)
      - run: yarn --cwd ui start &
      - run: until curl http://localhost:8080 > /dev/null ; do sleep 10s ; done
        timeout-minutes: 1

  e2e-ui:
    name: E2E UI
    needs: [ changed-files, e2e-tools ]
    if: ${{ needs.changed-files.outputs.ui == 'true' || needs.changed-files.outputs.e2e-tests == 'true' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    env:
      KUBECONFIG: /home/runner/.kube/config
      E2E_ENV_FACTOR: 2
      NODE_OPTIONS: --max-old-space-size=4096
      # In CI, Tilt (--mode=ci) runs no webpack dev server; the in-cluster
      # argo-server serves the production UI bundle at :2746. Point Playwright
      # there — this also gives production-bundle coverage.
      ARGO_UI_BASE_URL: http://localhost:2746
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.26"
          cache: true
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24" # change in all GH Workflows
          cache: yarn
          cache-dependency-path: ui/yarn.lock
      - name: Set up k3d cluster and E2E tooling
        uses: ./.github/actions/e2e-cluster-up
      - name: Install UI dependencies and Playwright browser
        run: |
          yarn --cwd ui install
          yarn --cwd ui playwright install --with-deps chromium
      - name: Build images and start Argo in-cluster
        # tilt builds the production images (UI baked in), deploys them, and keeps
        # its argo-server port-forward (:2746) serving through the test steps.
        run: |
          tilt up --stream -- --mode=ci --profile=minimal \
            --api=true \
            --auth-mode=client \
            --pod-status-capture-finalizer=true > /tmp/tilt.log 2>&1 &
          # resources only register once the Tiltfile finishes evaluating; wait
          # for one we know is always defined before trusting `--all`
          until tilt get uiresource workflow-controller >/dev/null 2>&1; do
            echo "waiting for Tilt to load..."
            sleep 2
          done
          until tilt wait --for=condition=Ready uiresource --all --timeout=15s 2>/dev/null; do
            echo "waiting for Tilt resources to become ready..."
            tilt get uiresources 2>/dev/null || true
            sleep 5
          done
        timeout-minutes: 15
      - name: Wait for UI server
        run: until curl -fs http://localhost:2746 > /dev/null ; do sleep 5s ; done
        timeout-minutes: 3
      - name: Run UI E2E tests
        run: make test-ui-e2e
      - name: Upload Playwright report
        if: ${{ failure() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report
          path: |
            ui/playwright-report/
            ui/test-results/
          if-no-files-found: warn
          retention-days: 10

      # failure debugging below
      - name: Failure debug - logs
        if: ${{ failure() }}
        uses: ./.github/actions/e2e-failure-debug