ci.yml

name: CI

on:
  push:
    branches:
      - main
      - release-*
  pull_request:
    branches:
      - "**"
  schedule:
    - cron: "0 3 * * *" # run every day at 3am UTC (nightly builds)
  workflow_dispatch:
    inputs:
      is_production_release:
        description: 'Is this a production release?'
        required: false
        type: boolean
        default: false
      release_version:
        description: 'Release version (e.g., v2.0.3)'
        required: false
        type: string
        default: ''
      operator_version:
        description: 'Operator release version (e.g., v1.0.0). Optional'
        required: false
        type: string
        default: ''
      dry_run:
        description: 'If true, does a dry run of the production workflow'
        required: false
        type: boolean
        default: false

defaults:
  run:
    shell: bash

concurrency:
  group: ${{ inputs.is_production_release && format('prod-{0}', inputs.release_version) || format('{0}-ci', github.ref_name) }}
  cancel-in-progress: ${{ !inputs.is_production_release }}

permissions:
  contents: read

jobs:
  create-tag-and-release:
    runs-on: ubuntu-24.04
    if: github.event_name == 'workflow_dispatch' && inputs.release_version != '' && startsWith(github.ref, 'refs/heads/release-')
    permissions:
      contents: write
    steps:
      - name: Validate Release Branch and Version
        run: |
          echo "Validating release from: ${GITHUB_REF}"

          INPUT_VERSION="${{ inputs.release_version }}"
          INPUT_OPERATOR_VERSION="${{ inputs.operator_version }}"

          # Validate version format
          if [[ ! "${INPUT_VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
          echo "❌ Invalid version format: ${INPUT_VERSION}"
          echo "Expected format: v1.2.3"
          exit 1
          fi

          # Validate version format if operator version is provided
          if [[ -n "${INPUT_OPERATOR_VERSION}" && ! "${INPUT_OPERATOR_VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
          echo "❌ Invalid operator version format: ${INPUT_OPERATOR_VERSION}"
          echo "Expected format: v1.2.3"
          exit 1
          fi

          echo "✅ Valid release branch: ${GITHUB_REF}"
          echo "✅ Valid version format: ${INPUT_VERSION}"
          [[ -n "${INPUT_OPERATOR_VERSION}" ]] && echo "✅ Valid operator version format: ${INPUT_OPERATOR_VERSION}"

      - name: Checkout Repository
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0

      - name: Create Release Tag
        run: |
          VERSION="${{ inputs.release_version }}"
          git config user.name "NGF Release Bot"
          git config user.email "integrations@nginx.com"

          if git rev-parse --verify "refs/tags/${VERSION}" >/dev/null 2>&1; then
          echo "Tag ${VERSION} already exists - skipping tag creation"
          else
          echo "Creating annotated tag ${VERSION}"
          git tag -a "${VERSION}" -m "Release ${VERSION}"

          if [[ "${{ inputs.dry_run }}" == "true" ]]; then
          echo "DRY RUN: Would push tag ${VERSION} and operator tag ${{ inputs.operator_version || '' }}"
          git push --dry-run origin "${VERSION}"
          else
          git push origin "${VERSION}"
          echo "Created and pushed tag: ${VERSION}"
          fi
          fi

  vars:
    name: Checks and variables
    runs-on: ubuntu-24.04
    outputs:
      go_path: ${{ steps.vars.outputs.go_path }}
      min_k8s_version: ${{ steps.vars.outputs.min_k8s_version }}
      k8s_latest: ${{ steps.vars.outputs.k8s_latest }}
      helm_changes: ${{ steps.filter.outputs.charts }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
      - name: Configure GOPROXY
        id: goproxy
        run: |
          if [[ "${{ secrets.ARTIFACTORY_USER }}" == "" ]]; then
          echo "No Artifactory secrets available - using direct GOPROXY"
          GOPROXY_VALUE="direct"
          elif [[ "${{ inputs.is_production_release }}" == "true" ]] || [[ ("${{ github.event_name }}" == "push" || "${{ github.event_name }}" == "schedule") && ("${{ github.ref }}" == "refs/heads/main" || "${{ github.ref }}" =~ ^refs/heads/release-) ]]; then
          echo "Production mode - using production Artifactory"
          GOPROXY_VALUE="https://${{ secrets.ARTIFACTORY_USER }}:${{ secrets.ARTIFACTORY_TOKEN }}@${{ secrets.ARTIFACTORY_ENDPOINT }}"
          else
          echo "Development mode - using dev Artifactory"
          GOPROXY_VALUE="https://${{ secrets.ARTIFACTORY_USER }}:${{ secrets.ARTIFACTORY_TOKEN }}@${{ secrets.ARTIFACTORY_DEV_ENDPOINT }}"
          fi
          echo "GOPROXY=${GOPROXY_VALUE}" >> $GITHUB_ENV

      - name: Setup Golang Environment
        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version: stable
          cache-dependency-path: |
            go.sum
            .github/.cache/buster-for-vars

      - name: Check for changes
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: filter
        with:
          filters: |
            charts:
            - charts/nginx-gateway-fabric/**/*

      - name: Output Variables
        id: vars
        run: |
          K8S_KIND_VERSION=v1.34.0 # renovate: datasource=docker depName=kindest/node
          echo "go_path=$(go env GOPATH)" >> $GITHUB_OUTPUT
          echo "min_k8s_version=v1.25.16" >> $GITHUB_OUTPUT
          echo "k8s_latest=${K8S_KIND_VERSION}" >> $GITHUB_OUTPUT

      - name: Check if go.mod and go.sum are up to date
        run: go mod tidy && git diff --exit-code -- go.mod go.sum

      - name: Check if go.mod and go.sum are up to date in tests
        run: go mod tidy && git diff --exit-code -- go.mod go.sum
        working-directory: tests

      - name: Check if all the generated files are up to date
        run: make generate-all && git diff --exit-code

  unit-tests:
    name: Unit Tests
    runs-on: ubuntu-24.04
    needs: vars
    steps:
      - name: Checkout Repository
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0

      - name: Configure GOPROXY
        id: goproxy
        run: |
          if [[ "${{ secrets.ARTIFACTORY_USER }}" == "" ]]; then
          GOPROXY_VALUE="direct"
          else
          GOPROXY_VALUE="https://${{ secrets.ARTIFACTORY_USER }}:${{ secrets.ARTIFACTORY_TOKEN }}@${{ secrets.ARTIFACTORY_DEV_ENDPOINT }}"
          fi
          echo "GOPROXY=${GOPROXY_VALUE}" >> $GITHUB_ENV

      - name: Setup Golang Environment
        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version: stable
          cache-dependency-path: |
            go.sum
            .github/.cache/buster-for-unit-tests

      - name: Run Tests
        run: make unit-test

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Upload Coverage Report
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: cover-${{ github.run_id }}.html
          path: ${{ github.workspace }}/cover.html
        if: always()

  njs-unit-tests:
    name: NJS Unit Tests
    runs-on: ubuntu-24.04
    needs: vars
    steps:
      - name: Checkout Repository
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0

      - name: Setup Node.js Environment
        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version-file: .nvmrc

      - name: Run tests
        run: npm --prefix ${{ github.workspace }}/internal/controller/nginx/modules install-ci-test

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

  binary:
    name: Build Binary
    runs-on: ${{ github.repository_owner == 'nginx' && (inputs.is_production_release || ((github.event_name == 'push' || github.event_name == 'schedule') && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-')))) && 'ubuntu-24.04-amd64' || 'ubuntu-24.04' }}
    needs: [vars, unit-tests, njs-unit-tests]
    outputs:
      json: ${{ steps.gateway_binaries.outputs.json }}
    permissions:
      contents: write # for goreleaser/goreleaser-action and lucacome/draft-release to create/update releases
      id-token: write # for goreleaser/goreleaser-action to sign artifacts
      issues: write # for goreleaser/goreleaser-action to close milestone
    steps:
      - name: Checkout Repository
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0

      - name: Configure GOPROXY
        id: goproxy
        run: |
          if [[ "${{ secrets.ARTIFACTORY_USER }}" == "" ]]; then
          echo "No Artifactory secrets available - using direct GOPROXY"
          GOPROXY_VALUE="direct"
          elif [[ "${{ inputs.is_production_release }}" == "true" ]] || [[ ("${{ github.event_name }}" == "push" || "${{ github.event_name }}" == "schedule") && ("${{ github.ref }}" == "refs/heads/main" || "${{ github.ref }}" =~ ^refs/heads/release-) ]]; then
          echo "Production mode - using production Artifactory"
          GOPROXY_VALUE="https://${{ secrets.ARTIFACTORY_USER }}:${{ secrets.ARTIFACTORY_TOKEN }}@${{ secrets.ARTIFACTORY_ENDPOINT }}"
          else
          echo "Development mode - using dev Artifactory"
          GOPROXY_VALUE="https://${{ secrets.ARTIFACTORY_USER }}:${{ secrets.ARTIFACTORY_TOKEN }}@${{ secrets.ARTIFACTORY_DEV_ENDPOINT }}"
          fi
          echo "GOPROXY=${GOPROXY_VALUE}" >> $GITHUB_ENV

      - name: Setup Golang Environment
        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version: stable
          cache-dependency-path: |
            go.sum
            .github/.cache/buster-for-binary

      - name: Set Go module cache
        run: |
          mkdir -p ${{ github.workspace }}/.gocache
          echo "GOMODCACHE=${{ github.workspace }}/.gocache" >> $GITHUB_ENV
          echo "GOCACHE=${{ github.workspace }}/.gocache" >> $GITHUB_ENV

      - name: Create/Update Draft
        uses: lucacome/draft-release@0ebb400b90474a1b791602046abf8394e9f5402d # v2.0.2
        with:
          minor-label: "enhancement"
          major-label: "change"
          publish: ${{ inputs.is_production_release && (inputs.dry_run == false || inputs.dry_run == null) && true || false }}
          collapse-after: 20
          notes-header: |
            *Below is the auto-generated changelog, which includes all PRs that went into the release.
            For a shorter version that highlights only important changes, see [CHANGELOG.md](https://github.com/nginx/nginx-gateway-fabric/blob/{{version}}/CHANGELOG.md).*
        if: ${{ github.event_name == 'push' && github.ref != 'refs/heads/main' }}

      - name: Download Syft
        if: ${{ inputs.is_production_release }}
        uses: anchore/sbom-action/download-syft@fbfd9c6c189226748411491745178e0c2017392d # v0.20.10

      - name: Install Cosign
        if: ${{ inputs.is_production_release }}
        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Build binary
        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
        with:
          version: v2.12.7 # renovate: datasource=github-tags depName=goreleaser/goreleaser
          args: ${{ (inputs.is_production_release && (inputs.dry_run == false || inputs.dry_run == null)) && 'release' || 'build --snapshot' }} --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GOPATH: ${{ needs.vars.outputs.go_path }}
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_COMMUNITY }}
          TELEMETRY_ENDPOINT: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/heads/release-') && 'oss-dev.edge.df.f5.com:443' || 'oss.edge.df.f5.com:443' }}
          TELEMETRY_ENDPOINT_INSECURE: "false"

      - name: Extract gateway binaries info
        id: gateway_binaries
        run: |
          set -e
          binaries=()
          for bin in $(find ${{ github.workspace }}/dist -type f -name "gateway"); do
          dir=$(basename $(dirname "$bin"))
          if [[ "$dir" =~ gateway_([a-zA-Z0-9]+)_([a-zA-Z0-9]+) ]]; then
          os="${BASH_REMATCH[1]}"
          arch="${BASH_REMATCH[2]}"
          digest=$(sha256sum "$bin" | cut -d' ' -f1)
          binaries+=("{\"path\":\"$bin\",\"os\":\"$os\",\"arch\":\"$arch\",\"digest\":\"$digest\"}")
          fi
          done
          # Join array elements with commas
          IFS=','
          json="[${binaries[*]}]"
          echo "Generated JSON: $json"
          echo "json=$json" >> $GITHUB_OUTPUT

      - name: Upload Artifacts
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: dist-${{ github.run_id }}
          path: ${{ github.workspace }}/dist
          retention-days: 1

  assertion:
    name: Generate and Sign Assertion Documents
    needs: [vars, binary]
    if: ${{ inputs.is_production_release }}
    permissions:
      contents: read
      id-token: write # for compliance-rules action to sign assertion doc
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        gateway: ${{ fromJson(needs.binary.outputs.json) }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0

      - name: Configure GOPROXY
        id: goproxy
        run: |
          echo "Production mode - using production Artifactory"
          GOPROXY_VALUE="https://${{ secrets.ARTIFACTORY_USER }}:${{ secrets.ARTIFACTORY_TOKEN }}@${{ secrets.ARTIFACTORY_ENDPOINT }}"
          echo "GOPROXY=${GOPROXY_VALUE}" >> $GITHUB_ENV

      - name: Setup Golang Environment
        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version: stable

      - name: Download Artifacts
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: dist-${{ github.run_id }}
          path: ${{ github.workspace }}/dist

      - name: List Dependencies in Go Binary
        id: godeps
        run: |
          go version -m dist/gateway_${{ matrix.gateway.os }}_${{ matrix.gateway.arch }}*/gateway > goversionm_${{ github.run_id }}_${{ github.run_number }}_${{ matrix.gateway.os }}_${{ matrix.gateway.arch }}.txt
          echo "goversionm=$(find -type f -name "goversionm*.txt" | head -n 1)" >> $GITHUB_OUTPUT
          goversionm=$(find -type f -name "goversionm*.txt" | head -n 1)
          cat $goversionm

      - name: Generate Assertion Document
        id: assertiondoc
        uses: nginxinc/compliance-rules/.github/actions/assertion@0aab935582c35a00e2c671d8fe25b7fdd72a927b # v0.3.1
        with:
          artifact-name: ${{ github.event.repository.name }}_${{ github.sha }}_${{ github.run_number }}_${{ matrix.gateway.os }}_${{ matrix.gateway.arch }}
          artifact-digest: ${{ matrix.gateway.digest }}
          build-type: 'github'
          builder-id: 'github.com'
          builder-version: '0.1.0-xyz'
          invocation-id: ${{ github.run_id }}.${{ github.run_number }}.${{ strategy.job-index }}
          started-on: ${{ github.event.head_commit.timestamp || github.event.created_at }}
          finished-on: ${{ github.event.head_commit.timestamp || github.event.created_at }}
          artifactory-user: ${{ secrets.ARTIFACTORY_USER }}
          artifactory-api-token: ${{ secrets.ARTIFACTORY_TOKEN }}
          artifactory-url: ${{ secrets.ARTIFACTORY_URL }}
          artifactory-repo: 'f5-nginx-go-local-approved-dependency'
          build-content-path: ${{ steps.godeps.outputs.goversionm }}
          assertion-doc-file: assertion_${{ github.event.repository.name }}_${{ github.sha }}_${{ github.run_id }}_${{ github.run_number }}_${{ matrix.gateway.os }}_${{ matrix.gateway.arch }}.json

      - name: Sign and Store Assertion Document
        id: sign
        uses: nginxinc/compliance-rules/.github/actions/sign@0aab935582c35a00e2c671d8fe25b7fdd72a927b # v0.3.1
        with:
          assertion-doc: ${{ steps.assertiondoc.outputs.assertion-document-path }}

  build-oss:
    name: Build OSS images
    needs: [vars, binary]
    strategy:
      fail-fast: false
      matrix:
        image: [ngf, nginx]
        platforms: ["linux/arm64, linux/amd64"]
        build-os: ["", ubi]
    uses: ./.github/workflows/build.yml
    with:
      image: ${{ matrix.image }}
      platforms: ${{ matrix.platforms }}
      build-os: ${{ matrix.build-os }}
      tag: ${{ inputs.release_version || '' }}
      dry_run: ${{ inputs.dry_run || false}}
      runner: ${{ github.repository_owner == 'nginx' && (inputs.is_production_release || ((github.event_name == 'push' || github.event_name == 'schedule') && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-')))) && 'ubuntu-24.04-amd64' || 'ubuntu-24.04' }}
    permissions:
      contents: read # for docker/build-push-action to read repo content
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      packages: write # for docker/build-push-action to push to GHCR
      id-token: write # for docker/login to login to NGINX registry
    secrets: inherit

  build-plus:
    name: Build Plus images
    needs: [vars, binary]
    uses: ./.github/workflows/build.yml
    strategy:
      fail-fast: false
      matrix:
        build-os: ["", ubi]
    with:
      image: plus
      platforms: "linux/arm64, linux/amd64"
      build-os: ${{ matrix.build-os }}
      tag: ${{ inputs.release_version || '' }}
      dry_run: ${{ inputs.dry_run || false }}
      runner: ${{ github.repository_owner == 'nginx' && (inputs.is_production_release || ((github.event_name == 'push' || github.event_name == 'schedule') && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-')))) && 'ubuntu-24.04-amd64' || 'ubuntu-24.04' }}
    permissions:
      contents: read # for docker/build-push-action to read repo content
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      packages: write # for docker/build-push-action to push to GHCR
      id-token: write # for docker/login to login to NGINX registry
    secrets: inherit

  build-operator:
    name: Build Operator images
    needs: [vars, binary]
    uses: ./.github/workflows/build.yml
    with:
      image: operator
      platforms: "linux/arm64, linux/amd64"
      tag: ${{ inputs.operator_version || '' }}
      dry_run: ${{ inputs.dry_run || false }}
      runner: ${{ github.repository_owner == 'nginx' && (inputs.is_production_release || ((github.event_name == 'push' || github.event_name == 'schedule') && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-')))) && 'ubuntu-24.04-amd64' || 'ubuntu-24.04' }}
    permissions:
      contents: read # for docker/build-push-action to read repo content
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      packages: write # for docker/build-push-action to push to GHCR
      id-token: write # for docker/login to login to NGINX registry
    secrets: inherit

  functional-tests:
    name: Functional tests
    needs: [vars, build-oss, build-plus]
    strategy:
      fail-fast: false
      matrix:
        image: [nginx, plus]
        build-os: ["", ubi]
        k8s-version:
          [
            "${{ needs.vars.outputs.min_k8s_version }}",
            "${{ needs.vars.outputs.k8s_latest }}",
          ]
    uses: ./.github/workflows/functional.yml
    with:
      image: ${{ matrix.image }}
      k8s-version: ${{ matrix.k8s-version }}
      build-os: ${{ matrix.build-os }}
    secrets: inherit
    permissions:
      contents: read

  conformance-tests:
    name: Conformance tests
    needs: [vars, build-oss, build-plus]
    strategy:
      fail-fast: false
      matrix:
        image: [nginx, plus]
        build-os: ["", ubi]
        k8s-version:
          [
            "${{ needs.vars.outputs.min_k8s_version }}",
            "${{ needs.vars.outputs.k8s_latest }}",
          ]
        enable-experimental: [true, false]
    uses: ./.github/workflows/conformance.yml
    with:
      image: ${{ matrix.image }}
      k8s-version: ${{ matrix.k8s-version }}
      enable-experimental: ${{ matrix.enable-experimental }}
      build-os: ${{ matrix.build-os }}
      production-release: ${{ inputs.is_production_release == true && (inputs.dry_run == false || inputs.dry_run == null) }}
      release_version: ${{ inputs.release_version }}
      enable-inference-extension: true
    secrets: inherit
    permissions:
      contents: write

  helm-tests:
    name: Helm Tests
    needs: [vars, build-oss, build-plus]
    strategy:
      fail-fast: false
      matrix:
        image: [nginx, plus]
        k8s-version:
          [
            "${{ needs.vars.outputs.min_k8s_version }}",
            "${{ needs.vars.outputs.k8s_latest }}",
          ]
    uses: ./.github/workflows/helm.yml
    with:
      image: ${{ matrix.image }}
      k8s-version: ${{ matrix.k8s-version }}
      tag: ${{ inputs.release_version || '' }}
    secrets: inherit
    if: ${{ needs.vars.outputs.helm_changes == 'true' || github.event_name == 'schedule' }}

  publish-helm:
    name: Package and Publish Helm Chart
    runs-on: ${{ github.repository_owner == 'nginx' && 'ubuntu-24.04-amd64' || 'ubuntu-24.04' }}
    needs: [vars, helm-tests]
    if: ${{ inputs.is_production_release || github.ref == 'refs/heads/main' }}
    permissions:
      contents: read
      packages: write # for helm to push to GHCR
    steps:
      - name: Checkout Repository
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0

      - name: Setup Helm
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1

      - name: Login to GitHub Container Registry
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Package
        id: package
        run: |
          output=$(helm package ${{ !inputs.is_production_release && '--app-version edge --version 0.0.0-edge' || '' }} charts/nginx-gateway-fabric)
          echo "path=$(basename -- $(echo $output | cut -d: -f2))" >> $GITHUB_OUTPUT

      - name: Push to GitHub Container Registry
        if: ${{ inputs.dry_run == false || inputs.dry_run == null }}
        run: |
          helm push ${{ steps.package.outputs.path }} oci://ghcr.io/nginx/charts

  cel-tests:
    name: CEL Tests
    runs-on: ubuntu-24.04
    needs: vars
    steps:
      - name: Checkout Repository
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0

      - name: Configure GOPROXY
        id: goproxy
        run: |
          if [[ "${{ secrets.ARTIFACTORY_USER }}" == "" ]]; then
          GOPROXY_VALUE="direct"
          else
          GOPROXY_VALUE="https://${{ secrets.ARTIFACTORY_USER }}:${{ secrets.ARTIFACTORY_TOKEN }}@${{ secrets.ARTIFACTORY_DEV_ENDPOINT }}"
          fi
          echo "GOPROXY=${GOPROXY_VALUE}" >> $GITHUB_ENV

      - name: Setup Golang Environment
        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version: stable
          cache-dependency-path: |
            go.sum
            .github/.cache/buster-for-unit-tests

      - name: Deploy Kubernetes
        id: k8s
        run: |
          kind create cluster --name ${{ github.run_id }} --image=kindest/node:${{ needs.vars.outputs.k8s_latest }}

      - name: Apply CustomResourceDefinition
        run: |
          kubectl kustomize config/crd | kubectl apply --server-side -f -

      - name: Run Tests
        run: make test-cel-validation
        working-directory: ./tests