test_security.yml

name: Test k-NN on Secure Cluster
on:
  schedule:
    - cron: '0 0 * * *'  # every night
  push:
    branches:
      - "*"
      - "feature/**"
  pull_request:
    branches:
      - "*"
      - "feature/**"

jobs:
  Get-CI-Image-Tag:
    uses: opensearch-project/opensearch-build/.github/workflows/get-ci-image-tag.yml@main
    with:
      product: opensearch

  integ-test-with-security-linux:
    strategy:
      matrix:
        java: [11, 17, 21]

    name: Run Integration Tests on Linux
    runs-on: ubuntu-latest
    needs: Get-CI-Image-Tag
    container:
      # using the same image which is used by opensearch-build team to build the OpenSearch Distribution
      # this image tag is subject to change as more dependencies and updates will arrive over time
      image: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-version-linux }}
      # need to switch to root so that github actions can install runner binary on container without permission issues.
      options: --user root

    steps:
      - name: Checkout k-NN
        uses: actions/checkout@v1
        with:
          submodules: true

        # Git functionality in CMAKE file does not work with given ubuntu image. Therefore, handling it here.
      - name: Apply Git Patch
        # Deleting file at the end to skip `git apply` inside CMAKE file
        run: |
          cd jni/external/faiss
          git apply --ignore-space-change --ignore-whitespace --3way ../../patches/faiss/0001-Custom-patch-to-support-multi-vector.patch
          rm ../../patches/faiss/0001-Custom-patch-to-support-multi-vector.patch
          git apply --ignore-space-change --ignore-whitespace --3way ../../patches/faiss/0002-Custom-patch-to-support-sqfp16-neon.patch
          rm ../../patches/faiss/0002-Custom-patch-to-support-sqfp16-neon.patch
          git apply --ignore-space-change --ignore-whitespace --3way ../../patches/faiss/0003-Custom-patch-to-support-AVX2-Linux-CI.patch
          rm ../../patches/faiss/0003-Custom-patch-to-support-AVX2-Linux-CI.patch
        working-directory: ${{ github.workspace }}

      - name: Setup Java ${{ matrix.java }}
        uses: actions/setup-java@v1
        with:
          java-version: ${{ matrix.java }}

      - name: Run build
        # switching the user, as OpenSearch cluster can only be started as root/Administrator on linux-deb/linux-rpm/windows-zip.
        run: |
          chown -R 1000:1000 `pwd`
          su `id -un 1000` -c "whoami && java -version && ./gradlew integTest -Dsecurity.enabled=true -Dsimd.enabled=true"