refactor: cleanup test environment variables

.github/workflows/e2e_test.yaml

@@ -19,7 +19,26 @@ jobs:
       provider: lxd
       test-tox-env: integration-juju3.6
       modules: '["test_e2e"]'
-      extra-arguments: "-m openstack"
+      # INTEGRATION_TOKEN, OS_PASSWORD are passed through INTEGRATION_TEST_SECRET_ENV_VALUE_<N>
+      # mapping. See CONTRIBUTING.md for more details.
+      extra-arguments: |
+        -m=openstack \
+        --log-format="%(asctime)s %(levelname)s %(message)s" \
+        --path="${{ vars.INTEGRATION_TEST_PATH }}" \
+        --openstack-auth-url="${{ vars.INTEGRATION_TEST_OPENSTACK_AUTH_URL }}" \
+        --openstack-project-domain-name="${{ vars.INTEGRATION_TEST_OPENSTACK_PROJECT_DOMAIN_NAME }}" \
+        --openstack-project-name="${{ vars.INTEGRATION_TEST_OPENSTACK_PROJECT_NAME }}" \
+        --openstack-user-domain-name="${{ vars.INTEGRATION_TEST_OPENSTACK_USER_DOMAIN_NAME }}" \
+        --openstack-username="${{ vars.INTEGRATION_TEST_OPENSTACK_USERNAME }}" \
+        --openstack-region-name="${{ vars.INTEGRATION_TEST_OPENSTACK_REGION_NAME }}" \
+        --openstack-network-name="${{ vars.INTEGRATION_TEST_OPENSTACK_NETWORK_NAME }}" \
+        --openstack-flavor-name="${{ vars.INTEGRATION_TEST_OPENSTACK_FLAVOR_NAME }}" \
+        --https-proxy="${{ vars.INTEGRATION_TEST_HTTPS_PROXY }}" \
+        --http-proxy="${{ vars.INTEGRATION_TEST_HTTP_PROXY }}" \
+        --no-proxy="${{ vars.INTEGRATION_TEST_NO_PROXY }}" \
+        --openstack-https-proxy="${{ vars.INTEGRATION_TEST_OPENSTACK_HTTPS_PROXY }}" \
+        --openstack-http-proxy="${{ vars.INTEGRATION_TEST_OPENSTACK_HTTP_PROXY }}" \
+        --openstack-no-proxy="${{ vars.INTEGRATION_TEST_OPENSTACK_NO_PROXY }}"
       self-hosted-runner: true
       self-hosted-runner-label: pfe-ci
 

.github/workflows/integration_test.yaml

@@ -21,9 +21,29 @@ jobs:
       provider: lxd
       test-tox-env: integration-juju3.6
       modules: '["test_charm_metrics_failure", "test_charm_metrics_success", "test_charm_fork_repo", "test_charm_fork_path_change", "test_charm_no_runner", "test_charm_runner", "test_debug_ssh", "test_charm_upgrade",  "test_reactive"]'
-      extra-arguments: '-m openstack --log-format="%(asctime)s %(levelname)s %(message)s"'
+      # INTEGRATION_TOKEN, OS_PASSWORD are passed through INTEGRATION_TEST_SECRET_ENV_VALUE_<N>
+      # mapping. See CONTRIBUTING.md for more details.
+      extra-arguments: |
+        -m=openstack \
+        --log-format="%(asctime)s %(levelname)s %(message)s" \
+        --path="${{ vars.INTEGRATION_TEST_PATH }}" \
+        --openstack-auth-url="${{ vars.INTEGRATION_TEST_OPENSTACK_AUTH_URL }}" \
+        --openstack-project-domain-name="${{ vars.INTEGRATION_TEST_OPENSTACK_PROJECT_DOMAIN_NAME }}" \
+        --openstack-project-name="${{ vars.INTEGRATION_TEST_OPENSTACK_PROJECT_NAME }}" \
+        --openstack-user-domain-name="${{ vars.INTEGRATION_TEST_OPENSTACK_USER_DOMAIN_NAME }}" \
+        --openstack-username="${{ vars.INTEGRATION_TEST_OPENSTACK_USERNAME }}" \
+        --openstack-region-name="${{ vars.INTEGRATION_TEST_OPENSTACK_REGION_NAME }}" \
+        --openstack-network-name="${{ vars.INTEGRATION_TEST_OPENSTACK_NETWORK_NAME }}" \
+        --openstack-flavor-name="${{ vars.INTEGRATION_TEST_OPENSTACK_FLAVOR_NAME }}" \
+        --https-proxy="${{ vars.INTEGRATION_TEST_HTTPS_PROXY }}" \
+        --http-proxy="${{ vars.INTEGRATION_TEST_HTTP_PROXY }}" \
+        --no-proxy="${{ vars.INTEGRATION_TEST_NO_PROXY }}" \
+        --openstack-https-proxy="${{ vars.INTEGRATION_TEST_OPENSTACK_HTTPS_PROXY }}" \
+        --openstack-http-proxy="${{ vars.INTEGRATION_TEST_OPENSTACK_HTTP_PROXY }}" \
+        --openstack-no-proxy="${{ vars.INTEGRATION_TEST_OPENSTACK_NO_PROXY }}" \
+        --test-image-id="${{ vars.INTEGRATION_TEST_IMAGE_ID }}"
       self-hosted-runner: true
-      self-hosted-runner-label: pfe-ci 
+      self-hosted-runner-label: pfe-ci
   openstack-integration-tests-cross-controller-private-endpoint:
     name: Cross controller integration test using private-endpoint
     uses: canonical/operator-workflows/.github/workflows/integration_test.yaml@main
@@ -34,7 +54,27 @@ jobs:
       provider: lxd
       test-tox-env: integration-juju3.6
       modules: '["test_prometheus_metrics"]'
-      extra-arguments: '-m openstack --log-format="%(asctime)s %(levelname)s %(message)s"'
+      # INTEGRATION_TOKEN, OS_PASSWORD are passed through INTEGRATION_TEST_SECRET_ENV_VALUE_<N>
+      # mapping. See CONTRIBUTING.md for more details.
+      extra-arguments: |
+        -m=openstack \
+        --log-format="%(asctime)s %(levelname)s %(message)s" \
+        --path="${{ vars.INTEGRATION_TEST_PATH }}" \
+        --openstack-auth-url="${{ vars.INTEGRATION_TEST_OPENSTACK_AUTH_URL }}" \
+        --openstack-project-domain-name="${{ vars.INTEGRATION_TEST_OPENSTACK_PROJECT_DOMAIN_NAME }}" \
+        --openstack-project-name="${{ vars.INTEGRATION_TEST_OPENSTACK_PROJECT_NAME }}" \
+        --openstack-user-domain-name="${{ vars.INTEGRATION_TEST_OPENSTACK_USER_DOMAIN_NAME }}" \
+        --openstack-username="${{ vars.INTEGRATION_TEST_OPENSTACK_USERNAME }}" \
+        --openstack-region-name="${{ vars.INTEGRATION_TEST_OPENSTACK_REGION_NAME }}" \
+        --openstack-network-name="${{ vars.INTEGRATION_TEST_OPENSTACK_NETWORK_NAME }}" \
+        --openstack-flavor-name="${{ vars.INTEGRATION_TEST_OPENSTACK_FLAVOR_NAME }}" \
+        --https-proxy="${{ vars.INTEGRATION_TEST_HTTPS_PROXY }}" \
+        --http-proxy="${{ vars.INTEGRATION_TEST_HTTP_PROXY }}" \
+        --no-proxy="${{ vars.INTEGRATION_TEST_NO_PROXY }}" \
+        --openstack-https-proxy="${{ vars.INTEGRATION_TEST_OPENSTACK_HTTPS_PROXY }}" \
+        --openstack-http-proxy="${{ vars.INTEGRATION_TEST_OPENSTACK_HTTP_PROXY }}" \
+        --openstack-no-proxy="${{ vars.INTEGRATION_TEST_OPENSTACK_NO_PROXY }}" \
+        --test-image-id="${{ vars.INTEGRATION_TEST_IMAGE_ID }}"
       self-hosted-runner: true
       self-hosted-runner-label: pfe-ci
   allure-report:

CONTRIBUTING.md

@@ -42,6 +42,19 @@ that can be used for linting and formatting code when you're preparing contribut
 
 > NOTE: Integration tests are currently intended to run on the CI and may not work locally without further argument.
 
+<!-- vale Canonical.007-Headings-sentence-case = NO -->
+#### CI testing setup guidelines
+<!-- vale Canonical.007-Headings-sentence-case = YES -->
+
+To prefer explicit setting arguments passing, use `extra-arguments` of the
+[following reusable workflow](https://github.com/canonical/operator-workflows/blob/main/.github/workflows/integration_test_run.yaml)
+to pass in non-sensitive values.
+For sensitive values (`INTEGRATION_TOKEN`: `--token`, `OS_PASSWORD`: `--openstack-password`), map
+them via `INTEGRATION_TEST_SECRET_ENV_NAME_<N>`
+environment variable settings under [repository](https://github.com/canonical/github-runner-operator)
+> settings > variables > actions.
+This is to prevent GitHub from leaking secrets when passing them over the CLI calls (unresolved).
+
 ### Building the charm
 
 Build the charm in this git repository using:

actions.yaml

@@ -2,6 +2,6 @@
 # See LICENSE file for licensing details.
 
 check-runners:
-    description: Get info on active and registered runners
+  description: Get info on active and registered runners
 flush-runners:
-    description: Clear out all runners and start a new set
+  description: Clear out all runners and start a new set

charmcraft.yaml

@@ -2,28 +2,30 @@
 # See LICENSE file for licensing details.
 
 type: charm
+
 parts:
   charm:
     charm-python-packages:
-      - setuptools>=75.8.0  # for jinja2
+      - setuptools>=75.8.0 # for jinja2
     build-packages:
-      - git  # for installing git source of pylxd 
-      - libffi-dev  # for cffi
-      - libssl-dev  # for cryptography
+      - git # for installing git source of pylxd
+      - libffi-dev # for cffi
+      - libssl-dev # for cryptography
       - pkg-config # for cryptography
     build-snaps:
       - rustup # for cryptography
     override-build: |
       rustup default stable
       craftctl default
+
 bases:
   - build-on:
-    - name: "ubuntu"
-      channel: "22.04"
-      architectures:
-      - amd64
+      - name: "ubuntu"
+        channel: "22.04"
+        architectures:
+          - amd64
     run-on:
-    - name: "ubuntu"
-      channel: "22.04"
-      architectures:
-      - amd64
+      - name: "ubuntu"
+        channel: "22.04"
+        architectures:
+          - amd64

metadata.yaml

@@ -12,7 +12,6 @@ summary: Creates a group of self-hosted github runners.
 description: |
   A [Juju](https://juju.is/) [charm](https://juju.is/docs/olm/charmed-operators) managing
   [self-hosted runners for GitHub Actions](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners).
-
   Each unit of this charm will start a configurable number of virtual machines to host
   self-hosted runners. Each runner performs only one job, after which it unregisters from GitHub to 
   ensure that each job runs in a clean environment. The charm will periodically check the number of 

tests/conftest.py

@@ -3,6 +3,7 @@
 
 """Fixtures for github runner charm."""
 
+import os
 
 from pytest import Parser
 
@@ -25,13 +26,11 @@ def pytest_addoption(parser: Parser):
             "An optionally comma separated GitHub Personal Access Token(s). "
             "Add more than one to help reduce rate limiting."
         ),
+        default=os.environ.get("INTEGRATION_TOKEN"),
     )
     parser.addoption(
         "--charm-file", action="store", help="The prebuilt github-runner-operator charm file."
     )
-    parser.addoption(
-        "--token-alt", action="store", help="An alternative token to test the change of a token."
-    )
     parser.addoption(
         "--http-proxy",
         action="store",
@@ -47,12 +46,6 @@ def pytest_addoption(parser: Parser):
         action="store",
         help="No proxy configuration value for juju model proxy configuration.",
     )
-    parser.addoption(
-        "--openstack-clouds-yaml",
-        action="store",
-        help="The OpenStack clouds yaml file for the charm to use.",
-        default="",
-    )
     parser.addoption(
         "--use-existing-app-suffix",
         action="store",
@@ -83,95 +76,56 @@ def pytest_addoption(parser: Parser):
     )
     # Private endpoint options AMD64
     parser.addoption(
-        "--openstack-network-name-amd64",
+        "--openstack-network-name",
         action="store",
         help="The Openstack network to create testing instances under.",
     )
     parser.addoption(
-        "--openstack-flavor-name-amd64",
+        "--openstack-flavor-name",
         action="store",
         help="The Openstack flavor to create testing instances with.",
     )
     parser.addoption(
-        "--openstack-auth-url-amd64",
+        "--openstack-auth-url",
         action="store",
         help="The URL to Openstack authentication service, i.e. keystone.",
+        default=os.environ.get("OS_AUTH_URL"),
     )
     parser.addoption(
-        "--openstack-password-amd64",
+        "--openstack-password",
         action="store",
         help="The password to authenticate to Openstack service.",
+        default=os.environ.get("OS_PASSWORD"),
     )
     parser.addoption(
-        "--openstack-project-domain-name-amd64",
+        "--openstack-project-domain-name",
         action="store",
         help="The Openstack project domain name to use.",
+        default=os.environ.get("OS_PROJECT_DOMAIN_NAME"),
     )
     parser.addoption(
-        "--openstack-project-name-amd64",
+        "--openstack-project-name",
         action="store",
         help="The Openstack project name to use.",
+        default=os.environ.get("OS_PROJECT_NAME"),
     )
     parser.addoption(
-        "--openstack-user-domain-name-amd64",
+        "--openstack-user-domain-name",
         action="store",
         help="The Openstack user domain name to use.",
+        default=os.environ.get("OS_USER_DOMAIN_NAME"),
     )
     parser.addoption(
-        "--openstack-username-amd64",
+        "--openstack-username",
         action="store",
         help="The Openstack user to authenticate as.",
+        default=os.environ.get("OS_USERNAME"),
     )
     parser.addoption(
-        "--openstack-region-name-amd64",
-        action="store",
-        help="The Openstack region to authenticate to.",
-    )
-    # Private endpoint options ARM64
-    parser.addoption(
-        "--openstack-network-name-arm64",
-        action="store",
-        help="The Openstack network to create testing instances under.",
-    )
-    parser.addoption(
-        "--openstack-flavor-name-arm64",
-        action="store",
-        help="The Openstack flavor to create testing instances with.",
-    )
-    parser.addoption(
-        "--openstack-auth-url-arm64",
-        action="store",
-        help="The URL to Openstack authentication service, i.e. keystone.",
-    )
-    parser.addoption(
-        "--openstack-password-arm64",
-        action="store",
-        help="The password to authenticate to Openstack service.",
-    )
-    parser.addoption(
-        "--openstack-project-domain-name-arm64",
-        action="store",
-        help="The Openstack project domain name to use.",
-    )
-    parser.addoption(
-        "--openstack-project-name-arm64",
-        action="store",
-        help="The Openstack project name to use.",
-    )
-    parser.addoption(
-        "--openstack-user-domain-name-arm64",
-        action="store",
-        help="The Openstack user domain name to use.",
-    )
-    parser.addoption(
-        "--openstack-username-arm64",
-        action="store",
-        help="The Openstack user to authenticate as.",
-    )
-    parser.addoption(
-        "--openstack-region-name-arm64",
+        "--openstack-region-name",
         action="store",
         help="The Openstack region to authenticate to.",
+        default=os.environ.get("OS_REGION_NAME"),
     )
     # Interface testing args
     parser.addoption(
@@ -186,3 +140,10 @@ def pytest_addoption(parser: Parser):
         help="The flavor for testing openstack interfaces. The resource should be enough to boot the test image.",
         default=None,
     )
+    parser.addoption(
+        "--test-image-id",
+        action="store",
+        help="The image ID to use for testing. If provided, any-charm will be used to mock the "
+        "image builder for faster testing deployment.",
+        default=None,
+    )