nicktrn
7529c33a5e
## What Three corrections to the pre-pull lists, each verified against what the suites actually use. ## Changes **`ryuk:0.11.0` -> `0.14.0`** in `e2e-webapp.yml` and `e2e-webapp-auth-full.yml`. The installed testcontainers hardcodes the image it starts: ```js // testcontainers@11.14.0 build/reaper/reaper.js : ImageName.fromString("testcontainers/ryuk:0.14.0").string; ``` So those two lines were pre-pulling an image nothing starts, and the one actually used was never pre-pulled. The other three workflows already say 0.14.0. **`postgres:17` added** to `unit-tests-webapp.yml`. The webapp suite references `docker.io/postgres:17` across 10 files but only `postgres:14` was pre-pulled. `unit-tests-internal.yml` already pulls both. **Electric pinned to its digest** in `unit-tests-webapp.yml`. The tests run `electricsql/electric:1.2.4@sha256:20da...` while the pre-pull asked for the bare tag, so the pre-pull did not necessarily populate the manifest the tests then request. ## Not changed The otel collector and s2 images are pulled by other workflows but are not used by the webapp suite, so they are deliberately not added here. `postgresAndRedisTest` uses per-test containers by design and needs nothing pre-pulled.
120 lines
4.0 KiB
YAML
120 lines
4.0 KiB
YAML
name: "🛡️ E2E Tests: Webapp Auth (full)"
|
|
|
|
# Comprehensive RBAC auth test suite — see TRI-8731. Runs separately from
|
|
# the smoke e2e-webapp.yml because it covers every route family with a
|
|
# pass/fail matrix and would otherwise dominate per-PR CI time.
|
|
#
|
|
# Triggered:
|
|
# - Manually via workflow_dispatch.
|
|
# - Nightly via schedule.
|
|
# - On pull requests touching auth-relevant files only (paths filter).
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: "0 4 * * *" # 04:00 UTC daily
|
|
pull_request:
|
|
paths:
|
|
- "apps/webapp/app/services/routeBuilders/**"
|
|
- "apps/webapp/app/services/rbac.server.ts"
|
|
- "apps/webapp/app/services/apiAuth.server.ts"
|
|
- "apps/webapp/app/services/personalAccessToken.server.ts"
|
|
- "apps/webapp/app/services/sessionStorage.server.ts"
|
|
- "apps/webapp/app/routes/api.v*.**"
|
|
- "apps/webapp/app/routes/realtime.v*.**"
|
|
- "apps/webapp/test/**/*.e2e.full.test.ts"
|
|
- "apps/webapp/test/setup/global-e2e-full-setup.ts"
|
|
- "apps/webapp/test/helpers/sharedTestServer.ts"
|
|
- "apps/webapp/test/helpers/seedTestSession.ts"
|
|
- "apps/webapp/vitest.e2e.full.config.ts"
|
|
- "internal-packages/rbac/**"
|
|
- "packages/plugins/**"
|
|
- ".github/workflows/e2e-webapp-auth-full.yml"
|
|
|
|
jobs:
|
|
e2eAuthFull:
|
|
name: "🛡️ E2E Auth Tests (full)"
|
|
runs-on: warp-ubuntu-latest-x64-8x
|
|
timeout-minutes: 30
|
|
env:
|
|
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
steps:
|
|
- name: 🔧 Disable IPv6
|
|
run: |
|
|
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
|
|
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
|
|
sudo sysctl -w net.ipv6.conf.lo.disable_ipv6=1
|
|
|
|
- name: 🔧 Configure docker address pool
|
|
run: |
|
|
CONFIG='{
|
|
"default-address-pools" : [
|
|
{
|
|
"base" : "172.17.0.0/12",
|
|
"size" : 20
|
|
},
|
|
{
|
|
"base" : "192.168.0.0/16",
|
|
"size" : 24
|
|
}
|
|
]
|
|
}'
|
|
mkdir -p /etc/docker
|
|
echo "$CONFIG" | sudo tee /etc/docker/daemon.json
|
|
|
|
- name: 🔧 Restart docker daemon
|
|
run: sudo systemctl restart docker
|
|
|
|
- name: ⬇️ Checkout repo
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
fetch-depth: 0
|
|
# Don't leave the GITHUB_TOKEN in .git/config — this job
|
|
# doesn't need to push and the persisted creds would be
|
|
# readable from any subsequent step (zizmor/artipacked).
|
|
persist-credentials: false
|
|
|
|
- name: ⎔ Setup pnpm
|
|
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
|
|
with:
|
|
version: 10.33.2
|
|
|
|
- name: ⎔ Setup node
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version: 24.18.0
|
|
cache: "pnpm"
|
|
|
|
- name: 🐳 Login to DockerHub
|
|
if: ${{ env.DOCKERHUB_USERNAME }}
|
|
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
- name: 🐳 Skipping DockerHub login (no secrets available)
|
|
if: ${{ !env.DOCKERHUB_USERNAME }}
|
|
run: echo "DockerHub login skipped because secrets are not available."
|
|
|
|
- name: 🐳 Pre-pull testcontainer images
|
|
run: |
|
|
docker pull postgres:14
|
|
docker pull redis:7.2
|
|
docker pull testcontainers/ryuk:0.14.0
|
|
|
|
- name: 📥 Download deps
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: 📀 Generate Prisma Client
|
|
run: pnpm run generate
|
|
|
|
- name: 🏗️ Build Webapp
|
|
run: pnpm run build --filter webapp
|
|
|
|
- name: 🛡️ Run Webapp Full Auth E2E Tests
|
|
run: cd apps/webapp && pnpm exec vitest run --config vitest.e2e.full.config.ts --reporter=default
|
|
env:
|
|
WEBAPP_TEST_VERBOSE: "1"
|