fleet/.github/workflows/integration.yml

name: Test Fleetctl, Orbit & Preview

# This workflow tests enrolling of agents on the supported platforms,
# using the latest version of fleet, fleetctl and orbit.
#
# It starts the latest release of fleet with the "fleetctl preview" command.
# It generates the installers for the latest version of Orbit with the
# "fleetctl package" command.

on:
  workflow_dispatch: # Manual
  schedule:
  - cron: '0 2 * * *' # Nightly 2AM UTC
    
permissions:
  contents: read

jobs:
  gen:
    runs-on: ubuntu-latest
    outputs:
      subdomain: ${{ steps.gen.outputs.subdomain }}
      address: ${{ steps.gen.outputs.address }}
    steps:
    - id: gen
      run: |
        UUID=$(uuidgen)
        echo "::set-output name=subdomain::fleet-test-$UUID"
        echo "::set-output name=address::https://fleet-test-$UUID.fleetuem.com"        
  
  run-server:
    runs-on: ubuntu-latest
    needs: gen
    steps:
    - name: Start tunnel
      env: 
        CERT_PEM: ${{ secrets.CLOUDFLARE_TUNNEL_FLEETUEM_CERT_B64 }}
      run: |
        # Install cloudflared
        wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
        sudo dpkg -i cloudflared-linux-amd64.deb
        # Add secret
        echo "$CERT_PEM" | base64 -d > cert.pem
        # Start tunnel
        cloudflared tunnel --origincert cert.pem --hostname ${{ needs.gen.outputs.subdomain }} --url http://localhost:1337 --name ${{ needs.gen.outputs.subdomain }} &
        until [[ $(cloudflared tunnel --origincert cert.pem info -o json ${{ needs.gen.outputs.subdomain }} | jq '.conns[0].conns[0].is_pending_reconnect') = false ]]; do
          echo "Awaiting tunnel ready..."
          sleep 5
        done        

    # Download fleet and fleetctl binaries from last successful build on main
    - name: Download binaries
      uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39 #v2.16.0
      with:
        workflow: build-binaries.yaml
        branch: main
        name: build
        path: build
        check_artifacts: true

    - name: Run Fleet server
      timeout-minutes: 15
      env:
        # Use instance identifier to allow for duplicate UUIDs
        FLEET_OSQUERY_HOST_IDENTIFIER: instance
      run: |
        chmod +x ./build/fleetctl
        ./build/fleetctl preview --no-hosts
        ./build/fleetctl config set --address ${{ needs.gen.outputs.address }}
        ./build/fleetctl get enroll-secret
        docker compose -f ~/.fleet/preview/docker-compose.yml logs --follow fleet01 fleet02 &
        # Wait for all of the hosts to be enrolled
        EXPECTED=12
        until [ $(./build/fleetctl get hosts --json | wc -l | tee hostcount) -ge $EXPECTED ]; do
          echo -n "Waiting for hosts to enroll: "
          cat hostcount | xargs echo -n
          echo " / $EXPECTED"
          sleep 10
        done
        ./build/fleetctl get hosts
        echo "Success! $EXPECTED hosts enrolled."        

    - name: Slack Notification
      if: failure()
      uses: slackapi/slack-github-action@16b6c78ee73689a627b65332b34e5d409c7299da # v1.18.0
      with:
        payload: |
          {
            "text": "${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head.html_url }}",
            "blocks": [
              {
                "type": "section",
                "text": {
                  "type": "mrkdwn",
                  "text": "Integration test result: ${{ job.status }}\nhttps://github.com/fleetdm/fleet/actions/runs/${{  github.run_id }}\n${{ github.event.pull_request.html_url || github.event.head.html_url }}"
                }
              }
            ]
          }          
      env:
        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_PLATFORM_WEBHOOK_URL }}
        SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

    - name: Cleanup tunnel
      if: always()
      run: cloudflared tunnel --origincert cert.pem delete --force ${{ needs.gen.outputs.subdomain }}    

  login:
   runs-on: ubuntu-latest
   needs: gen
   outputs:
     token: ${{ steps.login.outputs.token }}
   steps:
    # Download fleet and fleetctl binaries from last successful build on main
    - name: Download binaries
      uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39 #v2.16.0
      with:
        workflow: build-binaries.yaml
        branch: main
        name: build
        path: build
        check_artifacts: true
    
    # Login only here and share the token because otherwise we could hit rate limits.
    - id: login
      name: Attempt login
      timeout-minutes: 5
      run: |
        chmod +x ./build/fleetctl
        ./build/fleetctl config set --address ${{ needs.gen.outputs.address }}
        until ./build/fleetctl login --email admin@example.com --password preview1337#
        do
          echo "Retrying in 5s..."
          sleep 5
        done
        TOKEN=$(cat ~/.fleet/config| grep token | awk '{ print $2 }')
        echo "::set-output name=token::$TOKEN"        
      
  orbit-macos:
    timeout-minutes: 15
    strategy:
      matrix:
        orbit-channel: [ 'stable', 'edge' ]
        osqueryd-channel: ['stable', 'edge' ]
    runs-on: macos-latest
    needs: [gen, login]
    steps:
    - name: Checkout Code
      uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2

    - name: Install dependencies
      run: |
        npm install -g fleetctl
        fleetctl config set --address ${{ needs.gen.outputs.address }} --token ${{ needs.login.outputs.token }}        

    - name: Install Orbit
      run: |
        sudo hostname macos-orbit-${{ matrix.orbit-channel }}-osqueryd-${{ matrix.osqueryd-channel }}
        SECRET_JSON=$(fleetctl get enroll_secret --json --debug)
        echo $SECRET_JSON
        SECRET=$(echo $SECRET_JSON | jq -r '.spec.secrets[0].secret')
        echo "Secret: $SECRET"
        echo "Hostname: $(hostname -s)"
        fleetctl package --type pkg --fleet-url=${{ needs.gen.outputs.address }} --enroll-secret=$SECRET --orbit-channel=${{ matrix.orbit-channel }} --osqueryd-channel=${{ matrix.osqueryd-channel }} --fleet-desktop
        sudo installer -pkg fleet-osquery.pkg -target /
        until fleetctl get hosts | grep -iF $(hostname -s);
        do
          echo "Awaiting enrollment..."
          sleep 10
        done        

    - name: Collect orbit logs
      if: always()
      run: |
        mkdir orbit-logs
        sudo cp /var/log/orbit/* orbit-logs/        

    - name: Upload Orbit logs
      if: always()
      uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v2
      with:
        name: orbit-macos-${{ matrix.orbit-channel }}-${{ matrix.osqueryd-channel }}-logs
        path: |
          orbit-logs          

    - name: Uninstall Orbit
      run: |
        ./orbit/tools/cleanup/cleanup_macos.sh        

  orbit-ubuntu:
    timeout-minutes: 15
    strategy:
      matrix:
        orbit-channel: [ 'stable', 'edge' ]
        osqueryd-channel: ['stable', 'edge' ]
    runs-on: ubuntu-latest
    needs: [gen, login]
    steps:
    - name: Install dependencies
      run: |
        npm install -g fleetctl
        fleetctl config set --address ${{ needs.gen.outputs.address }} --token ${{ needs.login.outputs.token }}        

    - name: Install Go
      uses: actions/setup-go@b22fbbc2921299758641fab08929b4ac52b32923 # v2
      with:
        go-version: ${{ matrix.go-version }}

    - name: Checkout Code
      uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2

    - name: Build Fleetctl
      run: make fleetctl

    - name: Install Orbit
      run: |
        sudo hostname ubuntu-orbit-${{ matrix.orbit-channel }}-osqueryd-${{ matrix.osqueryd-channel }}
        chmod +x ./build/fleetctl
        SECRET_JSON=$(fleetctl get enroll_secret --json --debug)
        echo $SECRET_JSON
        SECRET=$(echo $SECRET_JSON | jq -r '.spec.secrets[0].secret')
        echo "Secret: $SECRET"
        echo "Hostname: $(hostname -s)"
        ./build/fleetctl package --type deb --fleet-url=${{ needs.gen.outputs.address }} --enroll-secret=$SECRET  --orbit-channel=${{ matrix.orbit-channel }} --osqueryd-channel=${{ matrix.osqueryd-channel }}
        sudo dpkg -i fleet-osquery*
        until fleetctl get hosts | grep -iF $(hostname -s);
        do
          echo "Awaiting enrollment..."
          sudo systemctl status orbit.service || true
          sleep 10
        done        

    - name: Collect orbit logs
      if: always()
      run: |
        sudo journalctl -u orbit.service > orbit-logs        

    - name: Upload Orbit logs
      if: always()
      uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v2
      with:
        name: orbit-ubuntu-${{ matrix.orbit-channel }}-${{ matrix.osqueryd-channel }}-logs
        path: |
          orbit-logs          

    - name: Uninstall Orbit
      run: |
        sudo apt remove fleet-osquery -y        

  orbit-windows-build:
    timeout-minutes: 15
    strategy:
      matrix:
        orbit-channel: [ 'stable', 'edge' ]
        osqueryd-channel: ['stable', 'edge' ]
    runs-on: ubuntu-latest
    needs: [gen, login]
    steps:
    - name: Install dependencies
      run: |
        docker pull fleetdm/wix:latest &
        npm install -g fleetctl
        fleetctl config set --address ${{ needs.gen.outputs.address }} --token ${{ needs.login.outputs.token }}        

    - name: Build Orbit
      run: |
        SECRET_JSON=$(fleetctl get enroll_secret --json --debug)
        echo $SECRET_JSON
        SECRET=$(echo $SECRET_JSON | jq -r '.spec.secrets[0].secret')
        echo "Secret: $SECRET"
        echo "Hostname: $(hostname -s)"
        fleetctl package --type msi --fleet-url=${{ needs.gen.outputs.address }} --enroll-secret=$SECRET --orbit-channel=${{ matrix.orbit-channel }} --osqueryd-channel=${{ matrix.osqueryd-channel }} --fleet-desktop
        mv fleet-osquery.msi orbit-${{ matrix.orbit-channel }}-osqueryd-${{ matrix.osqueryd-channel }}.msi        

    - name: Upload MSI
      uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v2
      with:
        name: orbit-${{ matrix.orbit-channel }}-osqueryd-${{ matrix.osqueryd-channel }}.msi
        path: orbit-${{ matrix.orbit-channel }}-osqueryd-${{ matrix.osqueryd-channel }}.msi

    - name: Debug on failure
      if: failure()
      uses: mxschmitt/action-tmate@8b4e4ac71822ed7e0ad5fb3d1c33483e9e8fb270 # v3

  orbit-windows:
    timeout-minutes: 15
    strategy:
      matrix:
        orbit-channel: [ 'stable', 'edge' ]
        osqueryd-channel: ['stable', 'edge' ]
    needs: [gen, login, orbit-windows-build]
    runs-on: windows-latest
    steps:
    - name: Install dependencies
      shell: bash
      run: |
        npm install -g fleetctl
        fleetctl config set --address ${{ needs.gen.outputs.address }} --token ${{ needs.login.outputs.token }} --tls-skip-verify        

    - name: Download MSI
      id: download
      uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v2
      with:
        name: orbit-${{ matrix.orbit-channel }}-osqueryd-${{ matrix.osqueryd-channel }}.msi
    

    - name: Install Orbit
      run: |
        msiexec /i ${{steps.download.outputs.download-path}}\orbit-${{ matrix.orbit-channel }}-osqueryd-${{ matrix.osqueryd-channel }}.msi /quiet /passive /lv log.txt
        sleep 30        

    # We can't very accurately check the install on these Windows hosts since the hostnames tend to
    # overlap and we can't control the hostnames. Instead we just return and have the run-server job
    # wait until the expected number of hosts enroll.

    - name: Upload Orbit logs
      if: always()
      uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v2
      with:
        name: orbit-windows-${{ matrix.orbit-channel }}-${{ matrix.osqueryd-channel }}-logs
        path: |
          C:\Windows\system32\config\systemprofile\AppData\Local\FleetDM\Orbit\Logs\orbit-osquery.log