add update graph tests

.github/workflows/build-test.yaml

@@ -101,6 +101,25 @@ jobs:
         with:
           version: "latest"
           args: "test:e2e"
+      - name: "Check if validated update graph has changed"
+        uses: "tj-actions/verify-changed-files@v13"
+        id: "verify-changed-graph"
+        with:
+          files: |
+            validated-update-graph.yaml
+      - name: "Commit validated update graph"
+        uses: "EndBug/add-and-commit@v9"
+        if: |
+          steps.verify-changed-graph.outputs.files_changed == 'true'
+        with:
+          author_name: "Authzed, Inc."
+          author_email: "[email protected]"
+          committer_name: "GitHub Actions"
+          committer_email: "41898282+github-actions[bot]@users.noreply.github.com"
+          message: "update validated graph after successful tests"
+          pathspec_error_handling: "exitImmediately"
+          push: true
+          tag: "${{github.ref_name}}"
       - uses: "actions/upload-artifact@v2"
         if: "always()"
         # this upload step is really flaky, don't fail the job if it fails

.gitignore

@@ -4,3 +4,5 @@ release/
 *.kubeconfig
 *.test
 e2e/cluster-state/**
+e2e/*.lck
+e2e/*.lck.*

.golangci.yaml

@@ -6,6 +6,10 @@ output:
 linters-settings:
   goimports:
     local-prefixes: "github.com/authzed/spicedb-operator"
+  stylecheck:
+    dot-import-whitelist:
+      - "github.com/onsi/ginkgo/v2"
+      - "github.com/onsi/gomega"
 linters:
   enable:
     - "bidichk"

.yamllint

@@ -2,7 +2,8 @@
 ---
 ignore: |
   config/
-  default-operator-config.yaml
+  proposed-update-graph.yaml
+  validated-update-graph.yaml
   e2e/
   examples
   pkg/crds

CONTRIBUTING.md

@@ -105,11 +105,11 @@ go get github.com/org/newdependency@version
 
 Continuous integration enforces that `go mod tidy` has been run.
 
-### Regenerating `default-operator-config.yaml`
+### Regenerating `proposed-update-graph.yaml`
 
-The default config can be regenerated whenever there is a new spicedb release.
+The update graph can be regenerated whenever there is a new spicedb release.
+CI will validate all new edges when there are changes to `proposed-update-graph.yaml` and will copy them into `validated-update-graph.yaml` if successful.
 
 ```go
-cd tools
-go generate ./...
+mage gen:graph
 ```

Dockerfile

@@ -10,6 +10,6 @@ RUN go build ./cmd/...
 
 FROM alpine:3.17.0
 
-COPY --from=builder /go/src/app/default-operator-config.yaml /opt/operator/config.yaml
+COPY --from=builder /go/src/app/validated-update-graph.yaml /opt/operator/config.yaml
 COPY --from=builder /go/src/app/spicedb-operator /usr/local/bin/spicedb-operator
 ENTRYPOINT ["spicedb-operator"]

Dockerfile.release

@@ -1,6 +1,6 @@
 # vim: syntax=dockerfile
 FROM gcr.io/distroless/base
-COPY default-operator-config.yaml /opt/operator/config.yaml
+COPY validated-update-graph.yaml /opt/operator/config.yaml
 COPY --from=ghcr.io/grpc-ecosystem/grpc-health-probe:v0.4.12 /ko-app/grpc-health-probe /usr/local/bin/grpc_health_probe
 COPY spicedb-operator /usr/local/bin/spicedb-operator
 ENTRYPOINT ["spicedb-operator"]