fix component name inconsistencies and add ci test pipeline

.github/workflows/ci.yml

@@ -0,0 +1,147 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  # ---------------------------------------------------------------------------
+  # Detect which component directories changed
+  # ---------------------------------------------------------------------------
+  detect-changes:
+    runs-on: arc-scale-set
+    permissions:
+      pull-requests: read
+    outputs:
+      cloudnative-pg: ${{ steps.changes.outputs.cloudnative-pg }}
+      keycloak: ${{ steps.changes.outputs.keycloak }}
+      artifact-conduit: ${{ steps.changes.outputs.artifact-conduit }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Detect changed paths (PR only)
+        if: github.event_name == 'pull_request'
+        uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            cloudnative-pg:
+              - 'cloudnative-pg/**'
+            keycloak:
+              - 'keycloak/**'
+            artifact-conduit:
+              - 'artifact-conduit/**'
+
+      - name: Resolve changes
+        id: changes
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            {
+              echo "cloudnative-pg=${{ steps.filter.outputs.cloudnative-pg }}"
+              echo "keycloak=${{ steps.filter.outputs.keycloak }}"
+              echo "artifact-conduit=${{ steps.filter.outputs.artifact-conduit }}"
+            } >> "$GITHUB_OUTPUT"
+          else
+            # push to main or workflow_dispatch → test everything
+            {
+              echo "cloudnative-pg=true"
+              echo "keycloak=true"
+              echo "artifact-conduit=true"
+            } >> "$GITHUB_OUTPUT"
+          fi
+
+  # ---------------------------------------------------------------------------
+  # Validate OCM component descriptors (always runs for all 3 components)
+  # ---------------------------------------------------------------------------
+  validate:
+    runs-on: arc-scale-set
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - component: artifact-conduit
+            path: ./artifact-conduit
+          - component: cloudnative-pg
+            path: ./cloudnative-pg
+          - component: keycloak
+            path: ./keycloak
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up OCM CLI
+        uses: open-component-model/ocm-setup-action@8c71929f38d3486e352e5d7aaf813f36accaaf43
+
+      - name: Build OCM component (dry-run)
+        run: |
+          cd "${{ matrix.path }}"
+          ocm add componentversion \
+            --version 0.0.0-ci \
+            --create \
+            --file ./ctf \
+            component-constructor.yaml
+
+      - name: Verify resources resolve
+        run: |
+          cd "${{ matrix.path }}"
+          ocm get resources ./ctf
+
+      - name: Clean up CTF
+        if: always()
+        run: rm -rf "${{ matrix.path }}/ctf"
+
+  # ---------------------------------------------------------------------------
+  # Integration tests (reusable workflows)
+  # ---------------------------------------------------------------------------
+  test-cloudnative-pg:
+    needs: [detect-changes, validate]
+    if: needs.detect-changes.outputs.cloudnative-pg == 'true'
+    uses: ./.github/workflows/test-cloudnative-pg.yml
+
+  test-keycloak:
+    needs: [detect-changes, validate]
+    if: needs.detect-changes.outputs.keycloak == 'true'
+    uses: ./.github/workflows/test-keycloak.yml
+
+  test-artifact-conduit:
+    needs: [detect-changes, validate]
+    if: needs.detect-changes.outputs.artifact-conduit == 'true'
+    uses: ./.github/workflows/test-artifact-conduit.yml
+    secrets: inherit
+
+  # ---------------------------------------------------------------------------
+  # Gate job for branch protection (single required status check)
+  # ---------------------------------------------------------------------------
+  ci-success:
+    if: always()
+    needs:
+      - detect-changes
+      - validate
+      - test-cloudnative-pg
+      - test-keycloak
+      - test-artifact-conduit
+    runs-on: arc-scale-set
+    steps:
+      - name: Evaluate job results
+        run: |
+          results=( \
+            "${{ needs.detect-changes.result }}" \
+            "${{ needs.validate.result }}" \
+            "${{ needs.test-cloudnative-pg.result }}" \
+            "${{ needs.test-keycloak.result }}" \
+            "${{ needs.test-artifact-conduit.result }}" \
+          )
+          for r in "${results[@]}"; do
+            if [[ "$r" == "failure" || "$r" == "cancelled" ]]; then
+              echo "::error::Job failed or was cancelled: $r"
+              exit 1
+            fi
+          done
+          echo "All jobs passed (success or skipped)."

.github/workflows/release-ocm-components.yml

@@ -6,19 +6,71 @@ on:
       - 'v*'
 
 jobs:
+  # ---------------------------------------------------------------------------
+  # Validate component descriptors before building
+  # ---------------------------------------------------------------------------
+  validate:
+    runs-on: arc-scale-test
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: artifact-conduit
+            path: ./artifact-conduit
+          - name: cloudnative-pg
+            path: ./cloudnative-pg
+          - name: keycloak
+            path: ./keycloak
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up OCM CLI
+        uses: open-component-model/ocm-setup-action@8c71929f38d3486e352e5d7aaf813f36accaaf43
+
+      - name: Extract version from tag
+        id: version
+        run: echo "version=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+
+      - name: Validate OCM component
+        run: |
+          cd "${{ matrix.path }}"
+          ocm add componentversion \
+            --version "${{ steps.version.outputs.version }}" \
+            --create \
+            --file ./ctf \
+            component-constructor.yaml
+
+      - name: Verify resources resolve
+        run: |
+          cd "${{ matrix.path }}"
+          ocm get resources ./ctf
+
+      - name: Clean up
+        if: always()
+        run: rm -rf "${{ matrix.path }}/ctf"
+
+  # ---------------------------------------------------------------------------
+  # Build CTFs, push to GHCR, and upload artifacts
+  # ---------------------------------------------------------------------------
   build-and-push:
+    needs: validate
     runs-on: arc-scale-set
     permissions:
-      packages: write # Push to ghcr.io
+      packages: write
     strategy:
       matrix:
-        component:
-          - ./artifact-conduit
-          - ./cloudnative-pg
-          - ./keycloak
+        include:
+          - name: artifact-conduit
+            path: ./artifact-conduit
+          - name: cloudnative-pg
+            path: ./cloudnative-pg
+          - name: keycloak
+            path: ./keycloak
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Set up OCM CLI
         uses: open-component-model/ocm-setup-action@8c71929f38d3486e352e5d7aaf813f36accaaf43
@@ -32,22 +84,72 @@ jobs:
 
       - name: Extract version from tag
         id: version
-        run: |
-          VERSION=${GITHUB_REF#refs/tags/}
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+        run: echo "version=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
 
       - name: Build OCM Component
         run: |
-          cd ${{ matrix.component }}
-          ocm add componentversion --version ${{ steps.version.outputs.version }} --create --file ./ctf component-constructor.yaml
+          cd "${{ matrix.path }}"
+          ocm add componentversion \
+            --version "${{ steps.version.outputs.version }}" \
+            --create \
+            --file ./ctf \
+            component-constructor.yaml
 
       - name: Push to GHCR
         run: |
-          cd ${{ matrix.component }}
+          cd "${{ matrix.path }}"
           ocm transfer ctf --copy-local-resources ./ctf ghcr.io/${{ github.repository_owner }}
 
+      - name: Upload CTF artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ctf-${{ matrix.name }}
+          path: ${{ matrix.path }}/ctf
+          retention-days: 5
+
       - name: Clean up
         if: always()
+        run: rm -rf "${{ matrix.path }}/ctf"
+
+  # ---------------------------------------------------------------------------
+  # Create GitHub Release with CTF archives and checksums
+  # ---------------------------------------------------------------------------
+  create-release:
+    needs: build-and-push
+    runs-on: arc-scale-set
+    permissions:
+      contents: write
+    steps:
+      - name: Extract version from tag
+        id: version
+        run: echo "version=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+
+      - name: Download all CTF artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      - name: Package CTF archives
+        run: |
+          mkdir -p release
+          VERSION="${{ steps.version.outputs.version }}"
+          for component in artifact-conduit cloudnative-pg keycloak; do
+            tar -czf "release/${component}-ctf-${VERSION}.tar.gz" \
+              -C "artifacts/ctf-${component}" .
+          done
+
+      - name: Generate checksums
+        run: |
+          cd release
+          sha256sum -- *.tar.gz > checksums.sha256
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          cd ${{ matrix.component }}
-          rm -rf ./ctf
+          VERSION="${{ steps.version.outputs.version }}"
+          gh release create "$VERSION" \
+            --repo "${{ github.repository }}" \
+            --title "Release $VERSION" \
+            --generate-notes \
+            release/*

.github/workflows/test-artifact-conduit.yml

@@ -0,0 +1,67 @@
+name: "Test: Artifact Conduit"
+
+on:
+  workflow_call:
+    secrets:
+      GITHUB_TOKEN:
+        required: true
+
+jobs:
+  test:
+    runs-on: arc-scale-set
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Create kind cluster
+        uses: helm/kind-action@v1
+        with:
+          cluster_name: arc-test
+
+      - name: Install cert-manager
+        run: |
+          kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml
+          echo "Waiting for cert-manager deployments..."
+          kubectl wait --for=condition=Available deployment/cert-manager \
+            -n cert-manager --timeout=120s
+          kubectl wait --for=condition=Available deployment/cert-manager-webhook \
+            -n cert-manager --timeout=120s
+          kubectl wait --for=condition=Available deployment/cert-manager-cainjector \
+            -n cert-manager --timeout=120s
+
+      - name: Login to GHCR (Helm OCI)
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | \
+            helm registry login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+      - name: Install Artifact Conduit via Helm
+        run: |
+          helm install arc \
+            oci://ghcr.io/opendefensecloud/charts/arc \
+            --version v0.2.1 \
+            --namespace arc-system \
+            --create-namespace \
+            -f artifact-conduit/minimal-values.yaml \
+            --wait \
+            --timeout 5m
+
+      - name: Verify deployments
+        run: |
+          kubectl wait --for=condition=Available deployment \
+            -l app.kubernetes.io/instance=arc \
+            -n arc-system \
+            --timeout=180s
+          echo "--- Running pods ---"
+          kubectl get pods -n arc-system
+
+      - name: Collect debug info on failure
+        if: failure()
+        run: |
+          echo "--- Pods ---"
+          kubectl get pods -A
+          echo "--- Deployments ---"
+          kubectl get deployments -n arc-system -o wide || true
+          echo "--- Events ---"
+          kubectl get events -n arc-system --sort-by='.lastTimestamp' || true
+          echo "--- Helm status ---"
+          helm status arc -n arc-system || true