ed1bb4084a
Some checks failed
Veza CI / Rust (Stream Server) (push) Successful in 3m56s
Security Scan / Secret Scanning (gitleaks) (push) Successful in 40s
Veza CI / Backend (Go) (push) Failing after 14m15s
E2E Playwright / e2e (full) (push) Failing after 15m25s
Veza CI / Frontend (Web) (push) Successful in 26m8s
Veza CI / Notify on failure (push) Successful in 3s
Symptom: e2e.yml was bringing up Postgres/Redis/RabbitMQ via
`docker compose up -d`, which forces the runner job container to share
the host docker socket, parses the entire docker-compose.yml at every
run (so unrelated interpolations like `${JWT_SECRET:?required}` block
the step), and never auto-cleans the started containers. Concurrent e2e
runs collided on host ports 15432/16379/15672. Combined with the
already-fragile DinD setup, this is one of the top sources of flakes.
Fix: use the GHA-native `services:` block. act_runner spawns the three
service containers on the job network with healthchecks, exposes them
by service hostname on standard ports, tears them down at the end. Net
removal: docker-compose dependency, host port mapping, manual readiness
loop, leaked-container risk.
Wire-shape changes (DB/cache/MQ URLs hoisted to job-level env):
postgres -> postgres:5432 (was localhost:15432)
redis -> redis:6379 (was localhost:16379, + auth required)
rabbitmq -> rabbitmq:5672 (was localhost:5672)
REDIS_URL now carries the requirepass secret to match
docker-compose.yml's REM-023 convention; previously the runner-side
redis happened to start without auth.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
187 lines
7.9 KiB
YAML
187 lines
7.9 KiB
YAML
name: E2E Playwright
|
|
|
|
# v1.0.8 Batch C — Playwright E2E suite triggered on PRs (@critical only,
|
|
# fast feedback) + push to main and nightly (full suite, deeper coverage).
|
|
# Uses the --ci seed flag (cmd/tools/seed --ci) for ~5s seeding instead
|
|
# of the ~60s minimal seed.
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
push:
|
|
branches: [main]
|
|
schedule:
|
|
# Nightly full run — 03:00 UTC keeps it off the daytime runner pool.
|
|
- cron: "0 3 * * *"
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
GIT_SSL_NO_VERIFY: "true"
|
|
NODE_TLS_REJECT_UNAUTHORIZED: "0"
|
|
# Forces playwright.config.ts:141,155 to spawn fresh backend + Vite
|
|
# instead of reusing whatever is on the runner.
|
|
CI: "true"
|
|
# Falls back to a CI-only dev key if the Forgejo secret is unset.
|
|
# Used at the "Build + start backend API" step.
|
|
JWT_SECRET: ${{ secrets.E2E_JWT_SECRET || 'ci-dev-jwt-secret-32-chars-min-padding!!' }}
|
|
|
|
jobs:
|
|
# ===========================================================================
|
|
# Job: e2e — single matrix entry that selects the test scope per trigger.
|
|
# - PR → @critical only (5-7min target)
|
|
# - push main / cron / dispatch → full suite (~25min target)
|
|
# ===========================================================================
|
|
e2e:
|
|
name: e2e (${{ github.event_name == 'pull_request' && '@critical' || 'full' }})
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: ${{ github.event_name == 'pull_request' && 20 || 45 }}
|
|
|
|
# Service containers are managed by act_runner: spawned on the job
|
|
# network with healthchecks, torn down at the end. This replaces
|
|
# the previous `docker compose up -d` pattern which relied on
|
|
# docker socket sharing + host port mappings — fragile (port
|
|
# collisions across concurrent jobs, manual cleanup, double-DinD,
|
|
# whole compose file validated even when only 3 services are
|
|
# needed). Service hostnames (`postgres`, `redis`, `rabbitmq`)
|
|
# resolve from the job container on standard ports.
|
|
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
env:
|
|
POSTGRES_USER: veza
|
|
POSTGRES_PASSWORD: devpassword
|
|
POSTGRES_DB: veza
|
|
options: >-
|
|
--health-cmd "pg_isready -U veza"
|
|
--health-interval 5s
|
|
--health-timeout 3s
|
|
--health-retries 10
|
|
redis:
|
|
# Match docker-compose.yml (REM-023: password required even
|
|
# in dev). Default redis:7-alpine entrypoint reads
|
|
# REDIS_ARGS, so requirepass works without a `command:`.
|
|
image: redis:7-alpine
|
|
env:
|
|
REDIS_ARGS: "--requirepass devpassword"
|
|
options: >-
|
|
--health-cmd "redis-cli -a devpassword ping"
|
|
--health-interval 5s
|
|
--health-timeout 3s
|
|
--health-retries 10
|
|
rabbitmq:
|
|
image: rabbitmq:3-management-alpine
|
|
env:
|
|
RABBITMQ_DEFAULT_USER: veza
|
|
RABBITMQ_DEFAULT_PASS: devpassword
|
|
options: >-
|
|
--health-cmd "rabbitmq-diagnostics -q check_port_connectivity"
|
|
--health-interval 10s
|
|
--health-timeout 5s
|
|
--health-retries 10
|
|
|
|
# Service hostnames + standard ports — no host-port mapping needed.
|
|
env:
|
|
DATABASE_URL: postgresql://veza:${{ secrets.E2E_DB_PASSWORD || 'devpassword' }}@postgres:5432/veza?sslmode=disable
|
|
REDIS_URL: redis://:devpassword@redis:6379
|
|
RABBITMQ_URL: ${{ secrets.E2E_RABBITMQ_URL || 'amqp://veza:devpassword@rabbitmq:5672/' }}
|
|
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
|
|
with:
|
|
node-version: "20"
|
|
cache: "npm"
|
|
cache-dependency-path: package-lock.json
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
|
|
with:
|
|
go-version: "1.25"
|
|
cache: true
|
|
cache-dependency-path: veza-backend-api/go.sum
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
# Playwright tests reach the frontend via http://veza.fr:5174,
|
|
# which the browsers resolve via /etc/hosts. Without this entry
|
|
# the navigation step times out.
|
|
- name: Add veza.fr to hosts
|
|
run: echo "127.0.0.1 veza.fr" | sudo tee -a /etc/hosts
|
|
|
|
- name: Generate dev JWT keys + SSL cert
|
|
run: |
|
|
./scripts/generate-jwt-keys.sh
|
|
./scripts/generate-ssl-cert.sh
|
|
|
|
- name: Run database migrations
|
|
run: |
|
|
cd veza-backend-api
|
|
go run cmd/migrate_tool/main.go
|
|
|
|
- name: Seed database (CI mode — 5 test accounts + minimal fixtures)
|
|
run: |
|
|
cd veza-backend-api
|
|
go run ./cmd/tools/seed --ci
|
|
|
|
- name: Build + start backend API
|
|
env:
|
|
APP_ENV: test
|
|
APP_PORT: "18080"
|
|
COOKIE_SECURE: "false"
|
|
CORS_ALLOWED_ORIGINS: http://veza.fr:5174,http://localhost:5174
|
|
DISABLE_RATE_LIMIT_FOR_TESTS: "true"
|
|
RATE_LIMIT_LIMIT: "10000"
|
|
RATE_LIMIT_WINDOW: "60"
|
|
ACCOUNT_LOCKOUT_EXEMPT_EMAILS: "user@veza.music,artist@veza.music,admin@veza.music,mod@veza.music,new@veza.music"
|
|
run: |
|
|
cd veza-backend-api
|
|
go build -o veza-api ./cmd/api/main.go
|
|
./veza-api > /tmp/backend.log 2>&1 &
|
|
sleep 10
|
|
curl -sf http://localhost:18080/api/v1/health > /tmp/health.json || (echo "Backend health check failed"; tail -50 /tmp/backend.log; exit 1)
|
|
jq -e '.status == "ok"' /tmp/health.json || (echo "Health response invalid"; cat /tmp/health.json; exit 1)
|
|
echo "Backend healthy"
|
|
|
|
- name: Install Playwright browsers
|
|
run: npx playwright install --with-deps chromium
|
|
|
|
- name: Run E2E (@critical, PR scope)
|
|
if: github.event_name == 'pull_request'
|
|
env:
|
|
PORT: "5174"
|
|
VITE_API_URL: "/api/v1"
|
|
VITE_DOMAIN: veza.fr
|
|
VITE_BACKEND_PORT: "18080"
|
|
PLAYWRIGHT_BASE_URL: "http://localhost:5174"
|
|
run: npm run e2e:critical
|
|
|
|
- name: Run E2E (full, push/cron/dispatch)
|
|
if: github.event_name != 'pull_request'
|
|
env:
|
|
PORT: "5174"
|
|
VITE_API_URL: "/api/v1"
|
|
VITE_DOMAIN: veza.fr
|
|
VITE_BACKEND_PORT: "18080"
|
|
PLAYWRIGHT_BASE_URL: "http://localhost:5174"
|
|
run: npm run e2e
|
|
|
|
- name: Upload Playwright report
|
|
if: failure()
|
|
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
|
|
with:
|
|
name: playwright-report-${{ github.run_id }}-${{ github.run_attempt }}
|
|
path: |
|
|
tests/e2e/playwright-report/
|
|
tests/e2e/test-results/
|
|
retention-days: 7
|
|
|
|
- name: Upload backend log
|
|
if: failure()
|
|
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
|
|
with:
|
|
name: backend-log-${{ github.run_id }}-${{ github.run_attempt }}
|
|
path: /tmp/backend.log
|
|
retention-days: 7
|