[V0L-5495] Add workflow for sanity-test

Signed-off-by: Eric Ball <eball@linuxfoundation.org>
Change-Id: If03af2aeb2e5eff5632f69f1f0dc10c1342ab7ff
diff --git a/.github/workflows/sanity-test.yaml b/.github/workflows/sanity-test.yaml
new file mode 100644
index 0000000..3d27981
--- /dev/null
+++ b/.github/workflows/sanity-test.yaml
@@ -0,0 +1,169 @@
+---
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The Linux Foundation
+name: Sanity Test
+
+# yamllint disable-line rule:truthy
+on:
+  workflow_call:
+    inputs:
+      GERRIT_BRANCH:
+        description: "Branch that change is against"
+        required: true
+        type: string
+      GERRIT_PROJECT:
+        description: "Project in Gerrit"
+        required: true
+        type: string
+      GERRIT_REFSPEC:
+        description: "Gerrit refspec of change"
+        required: true
+        type: string
+      EC2_INSTANCE_TYPE:
+        description: "EC2 instance type"
+        required: false
+        type: string
+        default: "t2.xlarge"
+      TEST_TARGETS:
+        description: "List of test targets"
+        required: false
+        type: string
+        default: |
+          - target: sanity-kind-att
+            workflow: att
+            flags: ""
+            teardown: true
+            logging: true
+          - target: sanity-kind-dt
+            workflow: dt
+            flags: ""
+            teardown: true
+            logging: true
+          - target: sanity-kind-tt
+            workflow: tt
+            flags: ""
+            teardown: true
+            logging: true
+      EXTRA_HELM_FLAGS:
+        description: "Additional Helm flags for deployment"
+        required: false
+        type: string
+        default: ""
+      LOG_LEVEL:
+        description: "Log level for VOLTHA components (DEBUG, INFO, WARN, ERROR)"
+        required: false
+        type: string
+        default: "INFO"
+      TIMEOUT:
+        description: "Timeout in minutes for the entire action"
+        required: false
+        type: string
+        default: "240"
+      OLTS:
+        description: "Number of OLTs to simulate"
+        required: false
+        type: string
+        default: "1"
+      WITH_MONITORING:
+        description: "Enable monitoring with prometheus"
+        required: false
+        type: string
+        default: "false"
+      ENABLE_MAC_LEARNING:
+        description: "Enable MAC learning in VOLTHA"
+        required: false
+        type: string
+        default: "false"
+      EXTRA_ROBOT_ARGS:
+        description: "Additional arguments for Robot Framework"
+        required: false
+        type: string
+        default: ""
+    secrets:
+      GERRIT_SSH_PRIVKEY:
+        description: "SSH Key for the authorized user account"
+        required: true
+      AWS_ACCESS_KEY_ID:
+        description: "AWS access key ID"
+        required: true
+      AWS_SECRET_ACCESS_KEY:
+        description: "AWS secret access key"
+        required: true
+      EC2_IMAGE_ID:
+        description: "EC2 image ID"
+        required: true
+      EC2_SUBNET_ID:
+        description: "EC2 subnet ID"
+        required: true
+      EC2_SG_ID:
+        description: "EC2 security group ID"
+        required: true
+      GH_TO_AWS_KEY:
+        description: "GitHub to AWS key"
+        required: true
+
+jobs:
+  start-runner:
+    name: Start self-hosted EC2 runner
+    runs-on: ubuntu-latest
+    outputs:
+      label: ${{ steps.start-ec2-runner.outputs.label }}
+      ec2-instance-id: ${{ steps.start-ec2-runner.outputs.ec2-instance-id }}
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+      - name: Start EC2 runner
+        id: start-ec2-runner
+        uses: machulav/ec2-github-runner@v2
+        with:
+          mode: start
+          github-token: ${{ secrets.GH_TO_AWS_KEY }}
+          ec2-image-id: ${{ secrets.EC2_IMAGE_ID }}
+          ec2-instance-type: ${{ inputs.EC2_INSTANCE_TYPE }}
+          subnet-id: ${{ secrets.EC2_SUBNET_ID }}
+          security-group-id: ${{ secrets.EC2_SG_ID }}
+
+  sanity-tests:
+    needs: start-runner
+    runs-on: ${{ needs.start-runner.outputs.label }}
+    steps:
+      - name: Run Sanity Tests
+        uses: opencord/shared-workflows/.github/actions/bbsim-tests@main
+        with:
+          branch: ${{ inputs.GERRIT_BRANCH }}
+          test-targets: ${{ inputs.TEST_TARGETS }}
+          gerrit-project: ${{ inputs.GERRIT_PROJECT }}
+          gerrit-refspec: ${{ inputs.GERRIT_REFSPEC }}
+          extra-helm-flags: ${{ inputs.EXTRA_HELM_FLAGS }}
+          log-level: ${{ inputs.LOG_LEVEL }}
+          timeout: ${{ inputs.TIMEOUT }}
+          olts: ${{ inputs.OLTS }}
+          with-monitoring: ${{ inputs.WITH_MONITORING }}
+          enable-mac-learning: ${{ inputs.ENABLE_MAC_LEARNING }}
+          extra-robot-args: ${{ inputs.EXTRA_ROBOT_ARGS }}
+
+  stop-runner:
+    name: Stop self-hosted EC2 runner
+    needs:
+      - start-runner # required to get output from the start-runner job
+      - sanity-tests
+    runs-on: ubuntu-latest
+    if: ${{ always() }} # required to stop the runner even if the error happened in the previous jobs
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+      - name: Stop EC2 runner
+        uses: machulav/ec2-github-runner@v2
+        with:
+          mode: stop
+          github-token: ${{ secrets.GH_TO_AWS_KEY }}
+          label: ${{ needs.start-runner.outputs.label }}
+          ec2-instance-id: ${{ needs.start-runner.outputs.ec2-instance-id }}