prometheus/.github/workflows/ci.yml

---
name: CI
on:
  pull_request:
  push:
    branches: [main, 'release-*']
    tags: ['v*']

permissions:
  contents: read

jobs:
  test_go:
    name: Go tests
    runs-on: ubuntu-latest
    container:
      # Whenever the Go version is updated here, .promu.yml
      # should also be updated.
      image: quay.io/prometheus/golang-builder:1.26-base
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: prometheus/promci-setup@3e5cd31b34b8ae19efa8f071c5e3cdb44884a7f8 # v0.2.1
        with:
          enable_npm: true
          cache_key_suffix: race
      - run: make GO_ONLY=1 SKIP_GOLANGCI_LINT=1
      - run: go test ./tsdb/ -test.tsdb-isolation=false
      - run: make -C documentation/examples/remote_storage
      - run: make -C documentation/examples

  test_go_more:
    name: More Go tests
    runs-on: ubuntu-latest
    container:
      image: quay.io/prometheus/golang-builder:1.26-base
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: prometheus/promci-setup@3e5cd31b34b8ae19efa8f071c5e3cdb44884a7f8 # v0.2.1
        with:
          cache_key_suffix: more
      - run: go test --tags=dedupelabels ./...
      - run: go test --tags=slicelabels -race ./cmd/prometheus ./model/textparse ./prompb/...
      - run: go test --tags=forcedirectio -race ./tsdb/
      - run: make protoc
      - run: make proto
      - run: git diff --exit-code

  test_go_386:
    name: Go tests for 32-bit x86
    runs-on: ubuntu-latest
    container:
      image: quay.io/prometheus/golang-builder:1.26-base
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: prometheus/promci-setup@3e5cd31b34b8ae19efa8f071c5e3cdb44884a7f8 # v0.2.1
        with:
          cache_key_suffix: "386"
      # NOTE(bwplotka): We limit concurrency to avoid issues around too many concurrent mmaps
      # caused by parallel tests. See context: https://github.com/prometheus/prometheus/pull/18709
      # Alternatively we could adjust each relevant test to have 386 aware parallelization setting.
      - run: GOARCH=386 go test -parallel=1 ./...

  list_lts_releases:
    name: List active LTS releases
    runs-on: ubuntu-latest
    outputs:
      versions: ${{ steps.lts.outputs.versions }}
    steps:
      - id: lts
        # Emit the active LTS versions as a JSON array consumed by the matrix below.
        run: |
          versions=$(curl -sSf https://prometheus.io/download.json \
            | jq -c '[.prometheus[] | select(.lts == true) | (.version | ltrimstr("v"))]')
          echo "versions=$versions" >> "$GITHUB_OUTPUT"          

  test_version_upgrade:
    name: Go tests for Prometheus upgrades and downgrades
    needs: list_lts_releases
    runs-on: ubuntu-latest
    strategy:
      # Run every LTS release even if one fails.
      fail-fast: false
      matrix:
        lts_version: ${{ fromJSON(needs.list_lts_releases.outputs.versions) }}
    container:
      image: quay.io/prometheus/golang-builder:1.26-base
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: prometheus/promci-setup@3e5cd31b34b8ae19efa8f071c5e3cdb44884a7f8 # v0.2.1
        with:
          cache_key_suffix: upgrade
      - run: go test -v --race ./cmd/prometheus/ --test.version-upgrade=true --test.lts-version=${{ matrix.lts_version }} -run TestVersionUpgrade

  test_go_oldest:
    name: Go tests with previous Go version
    runs-on: ubuntu-latest
    env:
      # Enforce the Go version.
      GOTOOLCHAIN: local
    container:
      # The go version in this image should be N-1 wrt test_go.
      image: quay.io/prometheus/golang-builder:1.25-base
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: prometheus/promci-setup@3e5cd31b34b8ae19efa8f071c5e3cdb44884a7f8 # v0.2.1
        with:
          enable_npm: false
          cache_key_suffix: oldest
      - run: make build
      # Don't run NPM build; don't run race-detector.
      - run: make test GO_ONLY=1 test-flags=""

  test_ui:
    name: UI tests
    runs-on: ubuntu-latest
    # Whenever the Go version is updated here, .promu.yml
    # should also be updated.
    container:
      image: quay.io/prometheus/golang-builder:1.26-base

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: prometheus/promci-setup@3e5cd31b34b8ae19efa8f071c5e3cdb44884a7f8 # v0.2.1
        with:
          enable_go: false
          enable_npm: true
      - run: make assets-tarball
      - run: make ui-lint
      - run: make ui-test
      - uses: prometheus/promci-artifacts/save@f9a587dbc0b2c78a0c54f8ad1cde71ea29a4b76f # v0.1.0
        with:
          directory: .tarballs

  test_windows:
    name: Go tests on Windows
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version: 1.26.x
      - run: |
          $TestTargets = go list ./... | Where-Object { $_ -NotMatch "(github.com/prometheus/prometheus/config|github.com/prometheus/prometheus/web)"}
          go test $TestTargets -vet=off -v          
        shell: powershell

  test_mixins:
    name: Mixins tests
    runs-on: ubuntu-latest
    # Whenever the Go version is updated here, .promu.yml
    # should also be updated.
    container:
      image: quay.io/prometheus/golang-builder:1.26-base
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - run: go install ./cmd/promtool/.
      - run: go install github.com/google/go-jsonnet/cmd/jsonnet@latest
      - run: go install github.com/google/go-jsonnet/cmd/jsonnetfmt@latest
      - run: go install github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb@latest
      - run: make -C documentation/prometheus-mixin clean
      - run: make -C documentation/prometheus-mixin jb_install
      - run: make -C documentation/prometheus-mixin
      - run: git diff --exit-code

  test-compliance:
    name: Compliance testing
    runs-on: ubuntu-latest
    container:
      # Whenever the Go version is updated here, .promu.yml
      # should also be updated.
      image: quay.io/prometheus/golang-builder:1.26-base
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: prometheus/promci-setup@3e5cd31b34b8ae19efa8f071c5e3cdb44884a7f8 # v0.2.1
        with:
          enable_npm: false
          cache_key_suffix: compliance
      # NOTE: Those tests are based on https://github.com/prometheus/compliance and
      # are executed against the ./cmd/prometheus main package.
      - run: go test -v --tags=compliance ./compliance/...

  build:
    name: Build Prometheus for common architectures
    runs-on: ubuntu-latest
    # Reuse the web UI built and tested by test_ui instead of rebuilding it in
    # every crossbuild container.
    needs: [test_ui]
    if: |
      !(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v2.'))
      &&
      !(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v3.'))
      &&
      !(github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release-'))
      &&
      !(github.event_name == 'push' && github.event.ref == 'refs/heads/main')      
    strategy:
      matrix:
        thread: [ 0, 1, 2 ]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: prometheus/promci-artifacts/restore@f9a587dbc0b2c78a0c54f8ad1cde71ea29a4b76f # v0.1.0
      - name: Extract pre-built UI assets
        run: |
          mkdir -p .prebuilt-ui
          tar -xzvf .tarballs/prometheus-web-ui-*.tar.gz -C .prebuilt-ui          
      - uses: prometheus/promci/build@13941414d409d227afd67544e5d306827db5a1a2 # v0.8.5
        with:
          checkout: false
          # Feed the restored UI assets into the crossbuild containers so make
          # skips the UI build (see PREBUILT_ASSETS_STATIC_DIR in the Makefile).
          promu_opts: "-p linux/amd64 -p windows/amd64 -p linux/arm64 -p darwin/amd64 -p darwin/arm64 -p linux/386 --env PREBUILT_ASSETS_STATIC_DIR=.prebuilt-ui/static"
          parallelism: 3
          thread: ${{ matrix.thread }}
  build_all:
    name: Build Prometheus for all architectures
    runs-on: ubuntu-latest
    # Reuse the web UI built and tested by test_ui instead of rebuilding it in
    # every crossbuild container.
    needs: [test_ui]
    if: |
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v2.'))
      ||
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v3.'))
      ||
      (github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release-'))
      ||
      (github.event_name == 'push' && github.event.ref == 'refs/heads/main')      
    strategy:
      matrix:
        thread: [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 ]

    # Whenever the Go version is updated here, .promu.yml
    # should also be updated.
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: prometheus/promci-artifacts/restore@f9a587dbc0b2c78a0c54f8ad1cde71ea29a4b76f # v0.1.0
      - name: Extract pre-built UI assets
        run: |
          mkdir -p .prebuilt-ui
          tar -xzvf .tarballs/prometheus-web-ui-*.tar.gz -C .prebuilt-ui          
      - uses: prometheus/promci/build@13941414d409d227afd67544e5d306827db5a1a2 # v0.8.5
        with:
          checkout: false
          parallelism: 12
          thread: ${{ matrix.thread }}
          # Feed the restored UI assets into the crossbuild containers so make
          # skips the UI build (see PREBUILT_ASSETS_STATIC_DIR in the Makefile).
          promu_opts: --env PREBUILT_ASSETS_STATIC_DIR=.prebuilt-ui/static
  build_all_status:
    # This status check aggregates the individual matrix jobs of the "Build
    # Prometheus for all architectures" step into a final status. Fails if a
    # single matrix job fails, succeeds if all matrix jobs succeed.
    # See https://github.com/orgs/community/discussions/4324 for why this is
    # needed
    name: Report status of build Prometheus for all architectures
    runs-on: ubuntu-latest
    needs: [build_all]
    # The run condition needs to include always(). Otherwise actions
    # behave unexpected:
    # only "needs" will make the Status Report be skipped if one of the builds fails https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/using-jobs-in-a-workflow#defining-prerequisite-jobs
    # And skipped is treated as success https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborat[…]n-repositories-with-code-quality-features/about-status-checks
    # Adding always ensures that the status check is run independently of the
    # results of Build All
    if: always() && github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release-')
    steps:
      - name: Successful build
        if: ${{ !(contains(needs.*.result, 'failure')) && !(contains(needs.*.result, 'cancelled')) }}
        run: exit 0
      - name: Failing or cancelled build
        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
        run: exit 1
  check_generated_parser:
    # Checks generated parser and UI functions list. Not renaming as it is a required check.
    name: Check generated parser
    runs-on: ubuntu-latest
    container:
      image: quay.io/prometheus/golang-builder:1.26-base
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: prometheus/promci-setup@3e5cd31b34b8ae19efa8f071c5e3cdb44884a7f8 # v0.2.1
        with:
          enable_npm: true
          cache_key_suffix: parser
      - run: make install-goyacc check-generated-parser
      - run: make check-generated-promql-functions
  golangci:
    name: golangci-lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Install Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version: 1.26.x
      - name: Install snmp_exporter/generator dependencies
        run: sudo apt-get update && sudo apt-get -y install libsnmp-dev
        if: github.repository == 'prometheus/snmp_exporter'
      - name: Get golangci-lint version
        id: golangci-lint-version
        run: echo "version=$(make print-golangci-lint-version)" >> $GITHUB_OUTPUT
      - name: Lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          args: --verbose
          version: ${{ steps.golangci-lint-version.outputs.version }}
      - name: Lint with slicelabels
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          args: --verbose --build-tags=slicelabels
          version: ${{ steps.golangci-lint-version.outputs.version }}
      - name: Lint with dedupelabels
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          args: --verbose --build-tags=dedupelabels
          version: ${{ steps.golangci-lint-version.outputs.version }}
      - name: Lint in compliance
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          args: --verbose
          working-directory: compliance
          version: ${{ steps.golangci-lint-version.outputs.version }}
      - name: Lint in documentation/examples/remote_storage
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          args: --verbose
          working-directory: documentation/examples/remote_storage
          version: ${{ steps.golangci-lint-version.outputs.version }}
  fuzzing:
    uses: ./.github/workflows/fuzzing.yml
    if: github.event_name == 'pull_request'
  codeql:
    uses: ./.github/workflows/codeql-analysis.yml
    permissions:
      contents: read
      security-events: write

  publish_main:
    name: Publish main branch artifacts
    runs-on: ubuntu-latest
    permissions:
      packages: write
    needs: [test_ui, test_go, test_go_more, test_go_oldest, test_windows, golangci, codeql, build_all]
    if: github.event_name == 'push' && github.event.ref == 'refs/heads/main'
    steps:
      - uses: prometheus/promci/publish_main@13941414d409d227afd67544e5d306827db5a1a2 # v0.8.5
        with:
          docker_hub_login: ${{ secrets.docker_hub_login }}
          docker_hub_password: ${{ secrets.docker_hub_password }}
          ghcr_io_password: ${{ github.token }}
          quay_io_login: ${{ secrets.quay_io_login }}
          quay_io_password: ${{ secrets.quay_io_password }}
  publish_release:
    name: Publish release artefacts
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
    needs: [test_ui, test_go, test_go_more, test_go_oldest, test_windows, golangci, codeql, build_all]
    if: |
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v2.'))
      ||
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v3.'))      
    steps:
      - uses: prometheus/promci/publish_release@13941414d409d227afd67544e5d306827db5a1a2 # v0.8.5
        with:
          docker_hub_login: ${{ secrets.docker_hub_login }}
          docker_hub_password: ${{ secrets.docker_hub_password }}
          ghcr_io_password: ${{ github.token }}
          quay_io_login: ${{ secrets.quay_io_login }}
          quay_io_password: ${{ secrets.quay_io_password }}
          github_token: ${{ github.token }}
  publish_ui_release:
    name: Publish UI on npm Registry
    runs-on: ubuntu-latest
    needs: [test_ui, codeql]
    permissions:
      contents: read
      # Required for npm trusted publishing via OIDC.
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Install nodejs
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: "web/ui/.nvmrc"
          registry-url: "https://registry.npmjs.org"
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          # Exclude the broken pnpm 11.12.0 (self-installer crash, see
          # https://github.com/pnpm/action-setup/issues/276) while still
          # picking up future 11.x releases that fix it.
          version: ">=11.0.0 <11.12.0 || >11.12.0 <12.0.0"
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.local/share/pnpm/store
          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-            
      - name: Check libraries version
        if: |
          (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v2.'))
          ||
          (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v3.'))          
        run: ./scripts/ui_release.sh --check-package "$(./scripts/get_module_version.sh ${GH_REF_NAME})"
        env:
          GH_REF_NAME: ${{ github.ref_name }}
      - name: build
        run: make assets
      - name: Copy files before publishing libs
        run: ./scripts/ui_release.sh --copy
      - name: Publish dry-run libraries
        if: |
          !(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v2.'))
          &&
          !(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v3.'))          
        run: ./scripts/ui_release.sh --publish dry-run
      - name: Publish libraries
        if: |
          (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v2.'))
          ||
          (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v3.'))          
        run: ./scripts/ui_release.sh --publish