fe02644e1d
Some checks failed
CICD / Build and Publish CICD Base Image (push) Successful in 43m17s
CICD / Build and Push CICD Image (push) Failing after 22m32s
CICD / Backend Tests (push) Has been skipped
CICD / Pre-commit Checks (push) Has been skipped
CICD / Frontend Tests (push) Has been skipped
CICD / Backend Doctests (push) Has been skipped
CICD / Build and Publish Runtime Images (push) Has been skipped
CICD / Runtime Black-Box Integration Tests (push) Has been skipped
CICD / End-to-End Tests (push) Has been skipped
1172 lines
48 KiB
YAML
1172 lines
48 KiB
YAML
name: CICD
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
branches: [main, develop]
|
|
workflow_dispatch:
|
|
inputs:
|
|
head_sha:
|
|
description: Commit SHA to process
|
|
required: false
|
|
base_hash:
|
|
description: Immutable base hash to use for CICD base image
|
|
required: false
|
|
force_rebuild_base:
|
|
description: Force CICD base rebuild
|
|
required: false
|
|
default: "false"
|
|
trace_id:
|
|
description: Correlation id propagated across CICD jobs
|
|
required: false
|
|
|
|
env:
|
|
GITEA_SSH_HOST: kankali.darkhelm.lan
|
|
GITEA_SSH_PORT: "2222"
|
|
GITEA_REPO_SSH_URL: ssh://git@kankali.darkhelm.lan:2222/DarkHelm.org/plex-playlist.git
|
|
GITEA_REGISTRY: kankali.darkhelm.lan:3001
|
|
GITEA_REGISTRY_IP: 10.18.75.2
|
|
GITEA_REGISTRY_HOST: kankali.darkhelm.lan
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
|
|
concurrency:
|
|
group: cicd-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
publish-base:
|
|
name: Build and Publish CICD Base Image
|
|
runs-on: ubuntu-act
|
|
timeout-minutes: 35
|
|
outputs:
|
|
base_hash: ${{ steps.base-state.outputs.base_hash }}
|
|
head_sha: ${{ steps.meta.outputs.head_sha }}
|
|
steps:
|
|
- name: Identify runner
|
|
run: |
|
|
echo "=== Runner Identity ==="
|
|
echo "runner_name=${RUNNER_NAME:-}"
|
|
echo "runner_name_hint=${GITEA_RUNNER_NAME:-${ACT_RUNNER_NAME:-${RUNNER_NAME:-unknown}}}"
|
|
echo "runner_hostname_env=${HOSTNAME:-unknown}"
|
|
echo "runner_uname_n=$(uname -n 2>/dev/null || echo unknown)"
|
|
echo "runner_etc_hostname=$(cat /etc/hostname 2>/dev/null || echo unknown)"
|
|
echo "runner_os=${RUNNER_OS:-unknown}"
|
|
echo "runner_arch=${RUNNER_ARCH:-unknown}"
|
|
echo "timestamp_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
|
|
- name: Resolve head SHA
|
|
id: meta
|
|
env:
|
|
HEAD_SHA_INPUT: ${{ github.event.inputs.head_sha }}
|
|
HEAD_SHA_FALLBACK: ${{ github.sha }}
|
|
run: |
|
|
RESOLVED_HEAD_SHA="${HEAD_SHA_INPUT:-${HEAD_SHA_FALLBACK}}"
|
|
echo "head_sha=${RESOLVED_HEAD_SHA}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Minimal checkout for base inputs
|
|
env:
|
|
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
HEAD_SHA: ${{ steps.meta.outputs.head_sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
umask 077
|
|
trap 'rm -f ~/.ssh/id_rsa' EXIT
|
|
|
|
if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
|
|
echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
|
|
fi
|
|
|
|
mkdir -p ~/.ssh
|
|
echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
|
|
chmod 600 ~/.ssh/id_rsa
|
|
ssh-keyscan -p "${GITEA_SSH_PORT}" "${GITEA_SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
|
|
|
|
GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
|
|
git clone --depth 1 --no-checkout "${GITEA_REPO_SSH_URL}" .
|
|
|
|
if GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
|
|
git fetch --depth 1 origin "${HEAD_SHA}" >/dev/null 2>&1; then
|
|
git checkout FETCH_HEAD -- Dockerfile.cicd-base .dockerignore scripts/compute-cicd-base-hash.sh
|
|
else
|
|
git checkout HEAD -- Dockerfile.cicd-base .dockerignore scripts/compute-cicd-base-hash.sh
|
|
fi
|
|
|
|
chmod +x scripts/compute-cicd-base-hash.sh
|
|
|
|
- name: Compute base hash and inspect registry
|
|
id: base-state
|
|
env:
|
|
PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
|
|
REGISTRY_USER: ${{ github.actor }}
|
|
FORCE_REBUILD: ${{ github.event.inputs.force_rebuild_base }}
|
|
run: |
|
|
set -euo pipefail
|
|
BASE_HASH=$(./scripts/compute-cicd-base-hash.sh)
|
|
BASE_REF_HASH="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd-base:${BASE_HASH}"
|
|
BASE_REF_LATEST="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd-base:latest"
|
|
|
|
echo "base_hash=${BASE_HASH}" >> "$GITHUB_OUTPUT"
|
|
echo "base_ref_hash=${BASE_REF_HASH}" >> "$GITHUB_OUTPUT"
|
|
echo "base_ref_latest=${BASE_REF_LATEST}" >> "$GITHUB_OUTPUT"
|
|
|
|
if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
|
|
echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
|
|
fi
|
|
|
|
echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY}" -u "${REGISTRY_USER}" --password-stdin >/dev/null
|
|
|
|
if [ "${FORCE_REBUILD:-false}" = "true" ]; then
|
|
echo "needs_build=true" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
|
|
if timeout 900 docker pull "${BASE_REF_HASH}" >/dev/null 2>&1; then
|
|
echo "needs_build=false" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "needs_build=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Build and push base image
|
|
if: steps.base-state.outputs.needs_build == 'true'
|
|
env:
|
|
PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
|
|
REGISTRY_USER: ${{ github.actor }}
|
|
BASE_HASH: ${{ steps.base-state.outputs.base_hash }}
|
|
BASE_REF_HASH: ${{ steps.base-state.outputs.base_ref_hash }}
|
|
BASE_REF_LATEST: ${{ steps.base-state.outputs.base_ref_latest }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
|
|
echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
|
|
fi
|
|
|
|
echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
|
|
|
|
PLAYWRIGHT_BROWSERS_MIRROR_TAG="${GITEA_REGISTRY}/darkhelm.org/playwright-browsers:v1.56.1-jammy"
|
|
docker pull "${PLAYWRIGHT_BROWSERS_MIRROR_TAG}"
|
|
|
|
PLAYWRIGHT_BROWSERS_IMAGE=$(docker image inspect --format='{{index .RepoDigests 0}}' "${PLAYWRIGHT_BROWSERS_MIRROR_TAG}")
|
|
|
|
docker build --progress=plain -f Dockerfile.cicd-base \
|
|
--build-arg BASE_IMAGE_VERSION="v1.0.0-${BASE_HASH}" \
|
|
--build-arg BASE_IMAGE_HASH="${BASE_HASH}" \
|
|
--build-arg PLAYWRIGHT_BROWSERS_IMAGE="${PLAYWRIGHT_BROWSERS_IMAGE}" \
|
|
-t cicd-base:latest .
|
|
|
|
docker tag cicd-base:latest "${BASE_REF_HASH}"
|
|
docker tag cicd-base:latest "${BASE_REF_LATEST}"
|
|
docker push "${BASE_REF_HASH}"
|
|
docker push "${BASE_REF_LATEST}"
|
|
|
|
- &failure_diagnostics_step
|
|
name: Failure diagnostics
|
|
if: failure()
|
|
run: |
|
|
echo "=== Failure Diagnostics ==="
|
|
date -u '+timestamp_utc=%Y-%m-%dT%H:%M:%SZ'
|
|
echo "runner_name=${RUNNER_NAME:-unknown}"
|
|
echo "runner_hostname=${HOSTNAME:-unknown}"
|
|
uname -a || true
|
|
cat /etc/os-release 2>/dev/null || true
|
|
df -h || true
|
|
free -h || true
|
|
ps aux --sort=-%mem | head -n 30 || true
|
|
if command -v docker >/dev/null 2>&1; then
|
|
echo "=== Docker Diagnostics ==="
|
|
docker version || true
|
|
docker info || true
|
|
docker ps -a || true
|
|
docker images --digests | head -n 50 || true
|
|
fi
|
|
dmesg | tail -n 120 || true
|
|
|
|
build_cicd:
|
|
name: Build and Push CICD Image
|
|
runs-on: ubuntu-act-8gb
|
|
needs: publish-base
|
|
timeout-minutes: 60
|
|
outputs:
|
|
head_sha: ${{ steps.meta.outputs.head_sha }}
|
|
steps:
|
|
- name: Resolve head SHA
|
|
id: meta
|
|
run: |
|
|
echo "head_sha=${{ needs.publish-base.outputs.head_sha }}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Minimal checkout for CICD build inputs
|
|
env:
|
|
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
HEAD_SHA: ${{ steps.meta.outputs.head_sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
umask 077
|
|
trap 'rm -f ~/.ssh/id_rsa' EXIT
|
|
|
|
if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
|
|
echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
|
|
fi
|
|
|
|
mkdir -p ~/.ssh
|
|
echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
|
|
chmod 600 ~/.ssh/id_rsa
|
|
ssh-keyscan -p "${GITEA_SSH_PORT}" "${GITEA_SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
|
|
|
|
GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
|
|
git clone --depth 1 --no-checkout "${GITEA_REPO_SSH_URL}" .
|
|
|
|
if GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
|
|
git fetch --depth 1 origin "${HEAD_SHA}" >/dev/null 2>&1; then
|
|
git checkout FETCH_HEAD -- .dockerignore Dockerfile.cicd Dockerfile.cicd-base scripts/compute-cicd-base-hash.sh
|
|
else
|
|
git checkout HEAD -- .dockerignore Dockerfile.cicd Dockerfile.cicd-base scripts/compute-cicd-base-hash.sh
|
|
fi
|
|
chmod +x scripts/compute-cicd-base-hash.sh
|
|
|
|
- name: Build and push complete CICD image
|
|
env:
|
|
PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
|
|
REGISTRY_USER: ${{ github.actor }}
|
|
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
HEAD_SHA: ${{ steps.meta.outputs.head_sha }}
|
|
BASE_HASH_INPUT: ${{ github.event.inputs.base_hash }}
|
|
BASE_HASH_FROM_BUILD: ${{ needs.publish-base.outputs.base_hash }}
|
|
run: |
|
|
set -euo pipefail
|
|
umask 077
|
|
trap 'rm -f /tmp/ssh_key' EXIT
|
|
|
|
echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
|
|
|
|
BASE_HASH="${BASE_HASH_INPUT:-${BASE_HASH_FROM_BUILD}}"
|
|
BASE_IMAGE="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd-base:${BASE_HASH}"
|
|
docker pull "${BASE_IMAGE}"
|
|
|
|
echo "${SSH_PRIVATE_KEY}" > /tmp/ssh_key
|
|
chmod 600 /tmp/ssh_key
|
|
|
|
docker build -f Dockerfile.cicd \
|
|
--secret id=ssh_private_key,src=/tmp/ssh_key \
|
|
--add-host "${GITEA_SSH_HOST}:${GITEA_REGISTRY_IP}" \
|
|
--build-arg GITHUB_SHA="${HEAD_SHA}" \
|
|
--build-arg CICD_BASE_IMAGE="${BASE_IMAGE}" \
|
|
-t cicd:latest .
|
|
|
|
docker tag cicd:latest "${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:latest"
|
|
docker tag cicd:latest "${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:${HEAD_SHA}"
|
|
docker push "${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:latest"
|
|
docker push "${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:${HEAD_SHA}"
|
|
|
|
- *failure_diagnostics_step
|
|
|
|
backend-tests:
|
|
name: Backend Tests
|
|
# Use ubuntu-act runner pool for consistent availability.
|
|
runs-on: ubuntu-act
|
|
timeout-minutes: 25
|
|
needs: build_cicd
|
|
steps:
|
|
- name: Identify runner
|
|
run: |
|
|
echo "=== Runner Identity ==="
|
|
echo "runner_name=${RUNNER_NAME:-}"
|
|
echo "runner_name_hint=${GITEA_RUNNER_NAME:-${ACT_RUNNER_NAME:-${RUNNER_NAME:-unknown}}}"
|
|
echo "runner_hostname_env=${HOSTNAME:-unknown}"
|
|
echo "runner_uname_n=$(uname -n 2>/dev/null || echo unknown)"
|
|
echo "runner_etc_hostname=$(cat /etc/hostname 2>/dev/null || echo unknown)"
|
|
echo "runner_os=${RUNNER_OS:-unknown}"
|
|
echo "runner_arch=${RUNNER_ARCH:-unknown}"
|
|
echo "timestamp_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
|
|
- &configure_registry_host_step
|
|
name: Configure registry host resolution
|
|
run: |
|
|
if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
|
|
echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
|
|
fi
|
|
|
|
- &ensure_cicd_image_step
|
|
name: Ensure CICD image is available
|
|
env:
|
|
HEAD_SHA: ${{ needs.build_cicd.outputs.head_sha }}
|
|
run: |
|
|
IMAGE="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:${HEAD_SHA}"
|
|
if docker image inspect "${IMAGE}" >/dev/null 2>&1; then
|
|
echo "Using cached CICD image: ${IMAGE}"
|
|
else
|
|
echo "${{ secrets.PACKAGE_ACCESS_TOKEN }}" | docker login "http://${GITEA_REGISTRY}" -u "${{ github.actor }}" --password-stdin
|
|
pulled=false
|
|
for i in 1 2 3; do
|
|
echo "Pull attempt ${i}/3 for ${IMAGE}"
|
|
if docker pull "${IMAGE}"; then
|
|
pulled=true
|
|
break
|
|
fi
|
|
if [ "${i}" -lt 3 ]; then
|
|
sleep_seconds=$((5 * i))
|
|
echo "Pull failed; retrying in ${sleep_seconds}s"
|
|
sleep "${sleep_seconds}"
|
|
fi
|
|
done
|
|
|
|
if [ "${pulled}" != "true" ]; then
|
|
echo "❌ Failed to pull CICD image after 3 attempts: ${IMAGE}"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
- name: Run backend tests with coverage
|
|
env:
|
|
HEAD_SHA: ${{ needs.build_cicd.outputs.head_sha }}
|
|
run: |
|
|
set -o pipefail
|
|
LOG_FILE="$(mktemp)"
|
|
|
|
docker run --rm "${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:${HEAD_SHA}" bash -c "
|
|
cd /workspace/backend &&
|
|
source .venv/bin/activate &&
|
|
uv run pytest -v --tb=short --cov=src --cov-report=term-missing --cov-fail-under=95
|
|
" 2>&1 | tee "${LOG_FILE}"
|
|
|
|
TEST_STATUS=${PIPESTATUS[0]}
|
|
if [ "${TEST_STATUS}" -ne 0 ]; then
|
|
echo "❌ Backend tests failed (exit=${TEST_STATUS})"
|
|
echo "--- Last 200 lines of backend test output ---"
|
|
tail -n 200 "${LOG_FILE}" || true
|
|
exit "${TEST_STATUS}"
|
|
fi
|
|
|
|
- *failure_diagnostics_step
|
|
|
|
precommit-tests:
|
|
name: Pre-commit Checks
|
|
# Use ubuntu-act runner pool for consistent availability.
|
|
runs-on: ubuntu-act
|
|
timeout-minutes: 30
|
|
needs: build_cicd
|
|
steps:
|
|
- name: Identify runner
|
|
run: |
|
|
echo "=== Runner Identity ==="
|
|
echo "runner_name=${RUNNER_NAME:-}"
|
|
echo "runner_name_hint=${GITEA_RUNNER_NAME:-${ACT_RUNNER_NAME:-${RUNNER_NAME:-unknown}}}"
|
|
echo "runner_hostname_env=${HOSTNAME:-unknown}"
|
|
echo "runner_uname_n=$(uname -n 2>/dev/null || echo unknown)"
|
|
echo "runner_etc_hostname=$(cat /etc/hostname 2>/dev/null || echo unknown)"
|
|
echo "runner_os=${RUNNER_OS:-unknown}"
|
|
echo "runner_arch=${RUNNER_ARCH:-unknown}"
|
|
echo "timestamp_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
|
|
- *configure_registry_host_step
|
|
- *ensure_cicd_image_step
|
|
- name: Run pre-commit checks
|
|
env:
|
|
HEAD_SHA: ${{ needs.build_cicd.outputs.head_sha }}
|
|
run: |
|
|
set -o pipefail
|
|
LOG_FILE="$(mktemp)"
|
|
|
|
docker run --rm "${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:${HEAD_SHA}" bash -c "
|
|
cd /workspace &&
|
|
if [ ! -d .git ]; then
|
|
git init /workspace
|
|
fi &&
|
|
/workspace/backend/.venv/bin/pre-commit run --all-files --show-diff-on-failure --config .pre-commit-config.yaml
|
|
" 2>&1 | tee "${LOG_FILE}"
|
|
|
|
TEST_STATUS=${PIPESTATUS[0]}
|
|
if [ "${TEST_STATUS}" -ne 0 ]; then
|
|
echo "❌ Pre-commit checks failed (exit=${TEST_STATUS})"
|
|
echo "--- Last 200 lines of pre-commit output ---"
|
|
tail -n 200 "${LOG_FILE}" || true
|
|
exit "${TEST_STATUS}"
|
|
fi
|
|
|
|
- *failure_diagnostics_step
|
|
|
|
frontend-tests:
|
|
name: Frontend Tests
|
|
# Use ubuntu-act runner pool for consistent availability.
|
|
runs-on: ubuntu-act
|
|
timeout-minutes: 25
|
|
needs: build_cicd
|
|
steps:
|
|
- name: Identify runner
|
|
run: |
|
|
echo "=== Runner Identity ==="
|
|
echo "runner_name=${RUNNER_NAME:-}"
|
|
echo "runner_name_hint=${GITEA_RUNNER_NAME:-${ACT_RUNNER_NAME:-${RUNNER_NAME:-unknown}}}"
|
|
echo "runner_hostname_env=${HOSTNAME:-unknown}"
|
|
echo "runner_uname_n=$(uname -n 2>/dev/null || echo unknown)"
|
|
echo "runner_etc_hostname=$(cat /etc/hostname 2>/dev/null || echo unknown)"
|
|
echo "runner_os=${RUNNER_OS:-unknown}"
|
|
echo "runner_arch=${RUNNER_ARCH:-unknown}"
|
|
echo "timestamp_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
|
|
- *configure_registry_host_step
|
|
- *ensure_cicd_image_step
|
|
- name: Run frontend tests with coverage
|
|
env:
|
|
HEAD_SHA: ${{ needs.build_cicd.outputs.head_sha }}
|
|
run: |
|
|
set -o pipefail
|
|
LOG_FILE="$(mktemp)"
|
|
|
|
docker run --rm "${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:${HEAD_SHA}" bash -c "
|
|
cd /workspace/frontend &&
|
|
yarn test:coverage --run --reporter=verbose --coverage.reporter=text --coverage.reporter=text-summary --coverage.thresholds.lines=85 --coverage.thresholds.functions=85 --coverage.thresholds.branches=85 --coverage.thresholds.statements=85
|
|
" 2>&1 | tee "${LOG_FILE}"
|
|
|
|
TEST_STATUS=${PIPESTATUS[0]}
|
|
if [ "${TEST_STATUS}" -ne 0 ]; then
|
|
echo "❌ Frontend tests failed (exit=${TEST_STATUS})"
|
|
echo "--- Last 200 lines of frontend test output ---"
|
|
tail -n 200 "${LOG_FILE}" || true
|
|
exit "${TEST_STATUS}"
|
|
fi
|
|
|
|
- *failure_diagnostics_step
|
|
|
|
xdoctest:
|
|
name: Backend Doctests
|
|
# Use ubuntu-act runner pool for consistent availability.
|
|
runs-on: ubuntu-act
|
|
timeout-minutes: 15
|
|
needs: build_cicd
|
|
steps:
|
|
- name: Identify runner
|
|
run: |
|
|
echo "=== Runner Identity ==="
|
|
echo "runner_name=${RUNNER_NAME:-}"
|
|
echo "runner_name_hint=${GITEA_RUNNER_NAME:-${ACT_RUNNER_NAME:-${RUNNER_NAME:-unknown}}}"
|
|
echo "runner_hostname_env=${HOSTNAME:-unknown}"
|
|
echo "runner_uname_n=$(uname -n 2>/dev/null || echo unknown)"
|
|
echo "runner_etc_hostname=$(cat /etc/hostname 2>/dev/null || echo unknown)"
|
|
echo "runner_os=${RUNNER_OS:-unknown}"
|
|
echo "runner_arch=${RUNNER_ARCH:-unknown}"
|
|
echo "timestamp_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
|
|
- *configure_registry_host_step
|
|
- *ensure_cicd_image_step
|
|
- name: Run backend doctests
|
|
env:
|
|
HEAD_SHA: ${{ needs.build_cicd.outputs.head_sha }}
|
|
run: |
|
|
set -o pipefail
|
|
LOG_FILE="$(mktemp)"
|
|
|
|
docker run --rm "${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:${HEAD_SHA}" bash -c "
|
|
cd /workspace/backend &&
|
|
source .venv/bin/activate &&
|
|
uv run xdoctest src/ --quiet
|
|
" 2>&1 | tee "${LOG_FILE}"
|
|
|
|
TEST_STATUS=${PIPESTATUS[0]}
|
|
if [ "${TEST_STATUS}" -ne 0 ]; then
|
|
echo "❌ Backend doctests failed (exit=${TEST_STATUS})"
|
|
echo "--- Last 200 lines of doctest output ---"
|
|
tail -n 200 "${LOG_FILE}" || true
|
|
exit "${TEST_STATUS}"
|
|
fi
|
|
|
|
- *failure_diagnostics_step
|
|
|
|
runtime_images:
|
|
name: Build and Publish Runtime Images
|
|
runs-on: ubuntu-act-8gb
|
|
needs: [build_cicd, precommit-tests, backend-tests, frontend-tests, xdoctest]
|
|
timeout-minutes: 45
|
|
outputs:
|
|
head_sha: ${{ steps.meta.outputs.head_sha }}
|
|
deployable_backend_tag_ref: ${{ steps.deployable_backend_ref.outputs.deployable_backend_tag_ref }}
|
|
deployable_backend_digest_ref: ${{ steps.deployable_backend_ref.outputs.deployable_backend_digest_ref }}
|
|
deployable_frontend_tag_ref: ${{ steps.deployable_frontend_ref.outputs.deployable_frontend_tag_ref }}
|
|
deployable_frontend_digest_ref: ${{ steps.deployable_frontend_ref.outputs.deployable_frontend_digest_ref }}
|
|
steps:
|
|
- name: Identify runner
|
|
run: |
|
|
echo "=== Runner Identity ==="
|
|
echo "runner_name=${RUNNER_NAME:-}"
|
|
echo "runner_name_hint=${GITEA_RUNNER_NAME:-${ACT_RUNNER_NAME:-${RUNNER_NAME:-unknown}}}"
|
|
echo "runner_hostname_env=${HOSTNAME:-unknown}"
|
|
echo "runner_uname_n=$(uname -n 2>/dev/null || echo unknown)"
|
|
echo "runner_etc_hostname=$(cat /etc/hostname 2>/dev/null || echo unknown)"
|
|
echo "runner_os=${RUNNER_OS:-unknown}"
|
|
echo "runner_arch=${RUNNER_ARCH:-unknown}"
|
|
echo "timestamp_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
|
|
- name: Resolve head SHA
|
|
id: meta
|
|
run: |
|
|
echo "head_sha=${{ needs.build_cicd.outputs.head_sha }}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Minimal checkout for runtime image inputs
|
|
env:
|
|
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
HEAD_SHA: ${{ steps.meta.outputs.head_sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
umask 077
|
|
trap 'rm -f ~/.ssh/id_rsa' EXIT
|
|
|
|
if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
|
|
echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
|
|
fi
|
|
|
|
mkdir -p ~/.ssh
|
|
echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
|
|
chmod 600 ~/.ssh/id_rsa
|
|
ssh-keyscan -p "${GITEA_SSH_PORT}" "${GITEA_SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
|
|
|
|
GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
|
|
git clone --depth 1 --no-checkout "${GITEA_REPO_SSH_URL}" .
|
|
|
|
if GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
|
|
git fetch --depth 1 origin "${HEAD_SHA}" >/dev/null 2>&1; then
|
|
git checkout FETCH_HEAD -- \
|
|
.dockerignore \
|
|
Dockerfile.backend \
|
|
Dockerfile.frontend \
|
|
backend \
|
|
frontend \
|
|
scripts/check-dockerfile-boundaries.sh \
|
|
scripts/verify-deployable-image-purity.sh
|
|
else
|
|
git checkout HEAD -- \
|
|
.dockerignore \
|
|
Dockerfile.backend \
|
|
Dockerfile.frontend \
|
|
backend \
|
|
frontend \
|
|
scripts/check-dockerfile-boundaries.sh \
|
|
scripts/verify-deployable-image-purity.sh
|
|
fi
|
|
|
|
- name: Verify deployable runtime boundaries
|
|
run: |
|
|
set -euo pipefail
|
|
bash ./scripts/check-dockerfile-boundaries.sh
|
|
|
|
- name: Build and verify deployable runtime image purity
|
|
env:
|
|
HEAD_SHA: ${{ steps.meta.outputs.head_sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
docker build -f Dockerfile.backend -t deployable-backend:"${HEAD_SHA}" .
|
|
docker build -f Dockerfile.frontend --target production -t deployable-frontend:"${HEAD_SHA}" .
|
|
|
|
bash ./scripts/verify-deployable-image-purity.sh --image deployable-backend:"${HEAD_SHA}" --profile backend
|
|
bash ./scripts/verify-deployable-image-purity.sh --image deployable-frontend:"${HEAD_SHA}" --profile frontend
|
|
|
|
- name: Push deployable backend runtime image
|
|
id: deployable_backend_ref
|
|
env:
|
|
PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
|
|
REGISTRY_USER: ${{ github.actor }}
|
|
HEAD_SHA: ${{ steps.meta.outputs.head_sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
|
|
DEPLOYABLE_BACKEND_REPO="${GITEA_REGISTRY}/darkhelm.org/deployable-backend"
|
|
DEPLOYABLE_BACKEND_TAG_REF="${DEPLOYABLE_BACKEND_REPO}:${HEAD_SHA}"
|
|
docker tag "deployable-backend:${HEAD_SHA}" "${DEPLOYABLE_BACKEND_TAG_REF}"
|
|
docker push "${DEPLOYABLE_BACKEND_TAG_REF}"
|
|
docker pull "${DEPLOYABLE_BACKEND_TAG_REF}" >/dev/null
|
|
DEPLOYABLE_BACKEND_DIGEST_REF="$({ docker image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "${DEPLOYABLE_BACKEND_TAG_REF}" | grep "^${DEPLOYABLE_BACKEND_REPO}@sha256:" | head -n 1; } || true)"
|
|
echo "deployable_backend_tag_ref=${DEPLOYABLE_BACKEND_TAG_REF}" >> "$GITHUB_OUTPUT"
|
|
echo "deployable_backend_digest_ref=${DEPLOYABLE_BACKEND_DIGEST_REF}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Push deployable frontend runtime image
|
|
id: deployable_frontend_ref
|
|
env:
|
|
PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
|
|
REGISTRY_USER: ${{ github.actor }}
|
|
HEAD_SHA: ${{ steps.meta.outputs.head_sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
|
|
DEPLOYABLE_FRONTEND_REPO="${GITEA_REGISTRY}/darkhelm.org/deployable-frontend"
|
|
DEPLOYABLE_FRONTEND_TAG_REF="${DEPLOYABLE_FRONTEND_REPO}:${HEAD_SHA}"
|
|
docker tag "deployable-frontend:${HEAD_SHA}" "${DEPLOYABLE_FRONTEND_TAG_REF}"
|
|
docker push "${DEPLOYABLE_FRONTEND_TAG_REF}"
|
|
docker pull "${DEPLOYABLE_FRONTEND_TAG_REF}" >/dev/null
|
|
DEPLOYABLE_FRONTEND_DIGEST_REF="$({ docker image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "${DEPLOYABLE_FRONTEND_TAG_REF}" | grep "^${DEPLOYABLE_FRONTEND_REPO}@sha256:" | head -n 1; } || true)"
|
|
echo "deployable_frontend_tag_ref=${DEPLOYABLE_FRONTEND_TAG_REF}" >> "$GITHUB_OUTPUT"
|
|
echo "deployable_frontend_digest_ref=${DEPLOYABLE_FRONTEND_DIGEST_REF}" >> "$GITHUB_OUTPUT"
|
|
|
|
- *failure_diagnostics_step
|
|
|
|
integration-tests:
|
|
name: Runtime Black-Box Integration Tests
|
|
# Pin integration tests to high-memory worker to reduce setup-stage runner churn.
|
|
runs-on: ubuntu-act-8gb
|
|
timeout-minutes: 20
|
|
needs: runtime_images
|
|
steps:
|
|
- name: Identify runner
|
|
run: |
|
|
echo "=== Runner Identity ==="
|
|
echo "runner_name=${RUNNER_NAME:-}"
|
|
echo "runner_name_hint=${GITEA_RUNNER_NAME:-${ACT_RUNNER_NAME:-${RUNNER_NAME:-unknown}}}"
|
|
echo "runner_hostname_env=${HOSTNAME:-unknown}"
|
|
echo "runner_uname_n=$(uname -n 2>/dev/null || echo unknown)"
|
|
echo "runner_etc_hostname=$(cat /etc/hostname 2>/dev/null || echo unknown)"
|
|
echo "runner_os=${RUNNER_OS:-unknown}"
|
|
echo "runner_arch=${RUNNER_ARCH:-unknown}"
|
|
echo "timestamp_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
|
|
- *configure_registry_host_step
|
|
- name: Run runtime black-box integration checks via compose
|
|
env:
|
|
HEAD_SHA: ${{ needs.runtime_images.outputs.head_sha }}
|
|
DEPLOYABLE_BACKEND_TAG_REF: ${{ needs.runtime_images.outputs.deployable_backend_tag_ref }}
|
|
DEPLOYABLE_BACKEND_DIGEST_REF: ${{ needs.runtime_images.outputs.deployable_backend_digest_ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
set -o pipefail
|
|
|
|
RUN_ID="${GITHUB_RUN_ID:-local}"
|
|
RUN_ATTEMPT="${GITHUB_RUN_ATTEMPT:-1}"
|
|
LOG_FILE="$(mktemp)"
|
|
COMPOSE_FILE="/tmp/compose.ci.integration.yaml"
|
|
COMPOSE_PROJECT_NAME="plex-int-${RUN_ID}-${RUN_ATTEMPT}"
|
|
DB_PASSWORD="plex_password"
|
|
DB_URL="postgresql://plex_user:${DB_PASSWORD}@database:5432/plex_playlist"
|
|
CICD_IMAGE="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:${HEAD_SHA}"
|
|
|
|
if ! command -v docker >/dev/null 2>&1; then
|
|
echo "❌ Docker is required"
|
|
exit 1
|
|
fi
|
|
if ! docker compose version >/dev/null 2>&1; then
|
|
echo "❌ docker compose plugin is required"
|
|
exit 1
|
|
fi
|
|
|
|
cat >"${COMPOSE_FILE}" <<'EOF'
|
|
services:
|
|
database:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_DB: plex_playlist
|
|
POSTGRES_USER: plex_user
|
|
POSTGRES_PASSWORD: ${DB_PASSWORD}
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U plex_user -d plex_playlist"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 12
|
|
|
|
backend:
|
|
image: ${DEPLOYABLE_BACKEND_IMAGE}
|
|
environment:
|
|
DATABASE_URL: ${DB_URL}
|
|
ENVIRONMENT: production
|
|
depends_on:
|
|
database:
|
|
condition: service_healthy
|
|
|
|
integration-tests:
|
|
image: ${CICD_IMAGE}
|
|
depends_on:
|
|
backend:
|
|
condition: service_started
|
|
environment:
|
|
CI: "true"
|
|
INTEGRATION_BACKEND_URL: http://backend:8000
|
|
EOF
|
|
|
|
fetch_backend_endpoint() {
|
|
endpoint_path="$1"
|
|
output_file="$2"
|
|
probe_tmp="$(mktemp)"
|
|
|
|
if ! docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" exec -T backend python -c "$(printf '%s\n' \
|
|
'import sys' \
|
|
'import urllib.error' \
|
|
'import urllib.request' \
|
|
'endpoint_path = sys.argv[1]' \
|
|
'url = f"http://127.0.0.1:8000{endpoint_path}"' \
|
|
'try:' \
|
|
' with urllib.request.urlopen(url, timeout=2) as response:' \
|
|
' body = response.read().decode("utf-8", errors="replace")' \
|
|
' print(response.status)' \
|
|
' print(body)' \
|
|
'except urllib.error.HTTPError as err:' \
|
|
' body = err.read().decode("utf-8", errors="replace")' \
|
|
' print(err.code)' \
|
|
' print(body)' \
|
|
'except Exception:' \
|
|
' print("000")' \
|
|
' print("")'
|
|
)" "${endpoint_path}" >"${probe_tmp}" 2>/dev/null
|
|
then
|
|
: >"${output_file}"
|
|
rm -f "${probe_tmp}"
|
|
echo "000"
|
|
return 0
|
|
fi
|
|
|
|
http_code="$(head -n 1 "${probe_tmp}")"
|
|
tail -n +2 "${probe_tmp}" >"${output_file}"
|
|
rm -f "${probe_tmp}"
|
|
echo "${http_code}"
|
|
}
|
|
|
|
dump_failure_context() {
|
|
echo "=== Runtime Integration Failure Context ==="
|
|
docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" ps || true
|
|
echo "--- Compose logs (tail 200) ---"
|
|
docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" logs --no-color --tail=200 || true
|
|
}
|
|
|
|
cleanup() {
|
|
docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" down -v --remove-orphans >/dev/null 2>&1 || true
|
|
}
|
|
|
|
trap cleanup EXIT
|
|
|
|
{
|
|
if [ -z "${DEPLOYABLE_BACKEND_TAG_REF}" ] || [ -z "${DEPLOYABLE_BACKEND_DIGEST_REF}" ]; then
|
|
echo "❌ Missing deployable backend image references from dispatch inputs"
|
|
exit 1
|
|
fi
|
|
|
|
echo "${{ secrets.PACKAGE_ACCESS_TOKEN }}" | docker login "http://${GITEA_REGISTRY}" -u "${{ github.actor }}" --password-stdin
|
|
|
|
docker pull "${CICD_IMAGE}"
|
|
docker pull "${DEPLOYABLE_BACKEND_TAG_REF}"
|
|
docker pull "${DEPLOYABLE_BACKEND_DIGEST_REF}"
|
|
|
|
DEPLOYABLE_BACKEND_REPO="${DEPLOYABLE_BACKEND_DIGEST_REF%%@*}"
|
|
EXPECTED_DIGEST_REF="${DEPLOYABLE_BACKEND_DIGEST_REF}"
|
|
ACTUAL_TAG_DIGEST_REF="$({
|
|
docker image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "${DEPLOYABLE_BACKEND_TAG_REF}" \
|
|
| grep "^${DEPLOYABLE_BACKEND_REPO}@sha256:" \
|
|
| head -n 1
|
|
} || true)"
|
|
|
|
if [ -z "${ACTUAL_TAG_DIGEST_REF}" ]; then
|
|
echo "❌ Could not resolve digest from tag reference: ${DEPLOYABLE_BACKEND_TAG_REF}"
|
|
exit 1
|
|
fi
|
|
|
|
if [ "${ACTUAL_TAG_DIGEST_REF}" != "${EXPECTED_DIGEST_REF}" ]; then
|
|
echo "❌ Tag and digest mismatch"
|
|
echo "expected=${EXPECTED_DIGEST_REF}"
|
|
echo "actual=${ACTUAL_TAG_DIGEST_REF}"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Resolved deployable backend tag: ${DEPLOYABLE_BACKEND_TAG_REF}"
|
|
echo "Resolved deployable backend digest: ${EXPECTED_DIGEST_REF}"
|
|
|
|
export DB_PASSWORD DB_URL CICD_IMAGE DEPLOYABLE_BACKEND_IMAGE="${EXPECTED_DIGEST_REF}"
|
|
|
|
docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" up -d database backend
|
|
|
|
db_ready=false
|
|
for i in $(seq 1 30); do
|
|
if docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" exec -T database pg_isready -U plex_user -d plex_playlist >/dev/null 2>&1; then
|
|
db_ready=true
|
|
break
|
|
fi
|
|
sleep 2
|
|
done
|
|
if [ "${db_ready}" != "true" ]; then
|
|
echo "❌ Database did not become ready"
|
|
dump_failure_context
|
|
exit 1
|
|
fi
|
|
|
|
backend_ready=false
|
|
for i in $(seq 1 40); do
|
|
backend_running_count="$(docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" ps --status running --services backend | wc -l)"
|
|
if [ "${backend_running_count}" -eq 0 ]; then
|
|
echo "❌ Backend container exited before becoming healthy"
|
|
dump_failure_context
|
|
exit 1
|
|
fi
|
|
|
|
health_code="$(fetch_backend_endpoint "/health" /tmp/blackbox-health.json)"
|
|
if [ "${health_code}" = "200" ]; then
|
|
backend_ready=true
|
|
break
|
|
fi
|
|
sleep 2
|
|
done
|
|
if [ "${backend_ready}" != "true" ]; then
|
|
echo "❌ Backend did not become healthy"
|
|
cat /tmp/blackbox-health.json 2>/dev/null || true
|
|
dump_failure_context
|
|
exit 1
|
|
fi
|
|
|
|
root_code="$(fetch_backend_endpoint "/" /tmp/blackbox-root.json)"
|
|
if [ "${root_code}" != "200" ] || ! grep -q 'Plex Playlist Backend API' /tmp/blackbox-root.json; then
|
|
echo "❌ Root endpoint validation failed"
|
|
cat /tmp/blackbox-root.json 2>/dev/null || true
|
|
dump_failure_context
|
|
exit 1
|
|
fi
|
|
|
|
compatibility_code="$(fetch_backend_endpoint "/compatibility" /tmp/blackbox-compatibility.json)"
|
|
if [ "${compatibility_code}" != "200" ] || ! grep -q '"ok":true' /tmp/blackbox-compatibility.json; then
|
|
echo "❌ Compatibility endpoint validation failed"
|
|
cat /tmp/blackbox-compatibility.json 2>/dev/null || true
|
|
dump_failure_context
|
|
exit 1
|
|
fi
|
|
|
|
health_code="$(fetch_backend_endpoint "/health" /tmp/blackbox-health.json)"
|
|
if [ "${health_code}" != "200" ] || ! grep -q '"status":"healthy"' /tmp/blackbox-health.json; then
|
|
echo "❌ Health endpoint validation failed"
|
|
cat /tmp/blackbox-health.json 2>/dev/null || true
|
|
dump_failure_context
|
|
exit 1
|
|
fi
|
|
|
|
docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" run --rm integration-tests \
|
|
bash -c "cd /workspace/backend && source .venv/bin/activate && uv run pytest -v --tb=short tests/integration/test_runtime_blackbox.py"
|
|
|
|
echo "✅ Runtime integration checks passed"
|
|
} 2>&1 | tee "${LOG_FILE}"
|
|
|
|
TEST_STATUS=${PIPESTATUS[0]}
|
|
if [ "${TEST_STATUS}" -ne 0 ]; then
|
|
echo "❌ Runtime integration checks failed (exit=${TEST_STATUS})"
|
|
echo "--- Last 200 lines of runtime integration output ---"
|
|
tail -n 200 "${LOG_FILE}" || true
|
|
exit "${TEST_STATUS}"
|
|
fi
|
|
|
|
- *failure_diagnostics_step
|
|
|
|
e2e-tests:
|
|
name: End-to-End Tests
|
|
# Use ubuntu-act runner pool for consistent availability.
|
|
runs-on: ubuntu-act-8gb
|
|
timeout-minutes: 45
|
|
needs: runtime_images
|
|
steps:
|
|
- name: Identify runner
|
|
run: |
|
|
echo "=== Runner Identity ==="
|
|
echo "runner_name=${RUNNER_NAME:-}"
|
|
echo "runner_name_hint=${GITEA_RUNNER_NAME:-${ACT_RUNNER_NAME:-${RUNNER_NAME:-unknown}}}"
|
|
echo "runner_hostname_env=${HOSTNAME:-unknown}"
|
|
echo "runner_uname_n=$(uname -n 2>/dev/null || echo unknown)"
|
|
echo "runner_etc_hostname=$(cat /etc/hostname 2>/dev/null || echo unknown)"
|
|
echo "runner_os=${RUNNER_OS:-unknown}"
|
|
echo "runner_arch=${RUNNER_ARCH:-unknown}"
|
|
echo "timestamp_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
|
|
- *configure_registry_host_step
|
|
- *ensure_cicd_image_step
|
|
- name: Run E2E tests against runtime services via compose
|
|
env:
|
|
HEAD_SHA: ${{ needs.runtime_images.outputs.head_sha }}
|
|
DEPLOYABLE_BACKEND_TAG_REF: ${{ needs.runtime_images.outputs.deployable_backend_tag_ref }}
|
|
DEPLOYABLE_BACKEND_DIGEST_REF: ${{ needs.runtime_images.outputs.deployable_backend_digest_ref }}
|
|
DEPLOYABLE_FRONTEND_TAG_REF: ${{ needs.runtime_images.outputs.deployable_frontend_tag_ref }}
|
|
DEPLOYABLE_FRONTEND_DIGEST_REF: ${{ needs.runtime_images.outputs.deployable_frontend_digest_ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
set -o pipefail
|
|
LOG_FILE="$(mktemp)"
|
|
ARTIFACT_DIR="$(mktemp -d)"
|
|
RUN_ID="${GITHUB_RUN_ID:-local}"
|
|
RUN_ATTEMPT="${GITHUB_RUN_ATTEMPT:-1}"
|
|
COMPOSE_FILE="/tmp/compose.ci.e2e.yaml"
|
|
COMPOSE_PROJECT_NAME="plex-e2e-${RUN_ID}-${RUN_ATTEMPT}"
|
|
DB_PASSWORD="plex_password"
|
|
DB_URL="postgresql://plex_user:${DB_PASSWORD}@database:5432/plex_playlist"
|
|
CICD_IMAGE="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:${HEAD_SHA}"
|
|
FRONTEND_URL_RUNNER="http://frontend:80"
|
|
|
|
if ! command -v docker >/dev/null 2>&1; then
|
|
echo "❌ Docker is required"
|
|
exit 1
|
|
fi
|
|
if ! docker compose version >/dev/null 2>&1; then
|
|
echo "❌ docker compose plugin is required"
|
|
exit 1
|
|
fi
|
|
|
|
cat >"${COMPOSE_FILE}" <<'EOF'
|
|
services:
|
|
database:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_DB: plex_playlist
|
|
POSTGRES_USER: plex_user
|
|
POSTGRES_PASSWORD: ${DB_PASSWORD}
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U plex_user -d plex_playlist"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 12
|
|
|
|
backend:
|
|
image: ${DEPLOYABLE_BACKEND_IMAGE}
|
|
environment:
|
|
DATABASE_URL: ${DB_URL}
|
|
ENVIRONMENT: production
|
|
depends_on:
|
|
database:
|
|
condition: service_healthy
|
|
|
|
frontend:
|
|
image: ${DEPLOYABLE_FRONTEND_IMAGE}
|
|
depends_on:
|
|
backend:
|
|
condition: service_started
|
|
|
|
e2e-tests:
|
|
image: ${CICD_IMAGE}
|
|
depends_on:
|
|
frontend:
|
|
condition: service_started
|
|
environment:
|
|
CI: "true"
|
|
PLAYWRIGHT_BASE_URL: http://frontend:80
|
|
PLAYWRIGHT_OUTPUT_DIR: /tmp/playwright-artifacts
|
|
PLAYWRIGHT_JUNIT_OUTPUT_FILE: /tmp/playwright-artifacts/playwright-results.xml
|
|
volumes:
|
|
- ${E2E_ARTIFACT_DIR}:/tmp/playwright-artifacts
|
|
EOF
|
|
|
|
fetch_http() {
|
|
container_name="$1"
|
|
endpoint_path="$2"
|
|
output_file="$3"
|
|
probe_tmp="$(mktemp)"
|
|
|
|
if ! docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" exec -T "${container_name}" python -c "$(printf '%s\n' \
|
|
'import sys' \
|
|
'import urllib.error' \
|
|
'import urllib.request' \
|
|
'endpoint_path = sys.argv[1]' \
|
|
'url = f\"http://127.0.0.1:8000{endpoint_path}\"' \
|
|
'try:' \
|
|
' with urllib.request.urlopen(url, timeout=2) as response:' \
|
|
' body = response.read().decode(\"utf-8\", errors=\"replace\")' \
|
|
' print(response.status)' \
|
|
' print(body)' \
|
|
'except urllib.error.HTTPError as err:' \
|
|
' body = err.read().decode(\"utf-8\", errors=\"replace\")' \
|
|
' print(err.code)' \
|
|
' print(body)' \
|
|
'except Exception:' \
|
|
' print(\"000\")' \
|
|
' print(\"\")')" "${endpoint_path}" >"${probe_tmp}" 2>/dev/null; then
|
|
: >"${output_file}"
|
|
rm -f "${probe_tmp}"
|
|
echo "000"
|
|
return 0
|
|
fi
|
|
|
|
http_code="$(head -n 1 "${probe_tmp}")"
|
|
tail -n +2 "${probe_tmp}" >"${output_file}"
|
|
rm -f "${probe_tmp}"
|
|
echo "${http_code}"
|
|
}
|
|
|
|
fetch_url_from_backend() {
|
|
target_url="$1"
|
|
output_file="$2"
|
|
probe_tmp="$(mktemp)"
|
|
|
|
if ! docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" exec -T backend python -c "$(printf '%s\n' \
|
|
'import sys' \
|
|
'import urllib.error' \
|
|
'import urllib.request' \
|
|
'target_url = sys.argv[1]' \
|
|
'try:' \
|
|
' with urllib.request.urlopen(target_url, timeout=2) as response:' \
|
|
' body = response.read().decode(\"utf-8\", errors=\"replace\")' \
|
|
' print(response.status)' \
|
|
' print(body)' \
|
|
'except urllib.error.HTTPError as err:' \
|
|
' body = err.read().decode(\"utf-8\", errors=\"replace\")' \
|
|
' print(err.code)' \
|
|
' print(body)' \
|
|
'except Exception:' \
|
|
' print(\"000\")' \
|
|
' print(\"\")')" "${target_url}" >"${probe_tmp}" 2>/dev/null; then
|
|
: >"${output_file}"
|
|
rm -f "${probe_tmp}"
|
|
echo "000"
|
|
return 0
|
|
fi
|
|
|
|
http_code="$(head -n 1 "${probe_tmp}")"
|
|
tail -n +2 "${probe_tmp}" >"${output_file}"
|
|
rm -f "${probe_tmp}"
|
|
echo "${http_code}"
|
|
}
|
|
|
|
dump_failure_context() {
|
|
echo "=== Runtime E2E Failure Context ==="
|
|
docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" ps || true
|
|
echo "--- Compose logs (tail 200) ---"
|
|
docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" logs --no-color --tail=200 || true
|
|
echo "--- Artifact directory ---"
|
|
find "${ARTIFACT_DIR}" -maxdepth 2 -type f | sort || true
|
|
}
|
|
|
|
cleanup() {
|
|
docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" down -v --remove-orphans >/dev/null 2>&1 || true
|
|
}
|
|
|
|
trap cleanup EXIT
|
|
|
|
if [ -z "${DEPLOYABLE_BACKEND_TAG_REF}" ] || [ -z "${DEPLOYABLE_BACKEND_DIGEST_REF}" ] || [ -z "${DEPLOYABLE_FRONTEND_TAG_REF}" ] || [ -z "${DEPLOYABLE_FRONTEND_DIGEST_REF}" ]; then
|
|
echo "❌ Missing deployable runtime image references from dispatch inputs"
|
|
exit 1
|
|
fi
|
|
|
|
echo "${{ secrets.PACKAGE_ACCESS_TOKEN }}" | docker login "http://${GITEA_REGISTRY}" -u "${{ github.actor }}" --password-stdin
|
|
docker pull "${CICD_IMAGE}"
|
|
docker pull "${DEPLOYABLE_BACKEND_TAG_REF}"
|
|
docker pull "${DEPLOYABLE_BACKEND_DIGEST_REF}"
|
|
docker pull "${DEPLOYABLE_FRONTEND_TAG_REF}"
|
|
docker pull "${DEPLOYABLE_FRONTEND_DIGEST_REF}"
|
|
|
|
DEPLOYABLE_BACKEND_REPO="${DEPLOYABLE_BACKEND_DIGEST_REF%%@*}"
|
|
EXPECTED_BACKEND_DIGEST_REF="${DEPLOYABLE_BACKEND_DIGEST_REF}"
|
|
ACTUAL_BACKEND_TAG_DIGEST_REF="$({
|
|
docker image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "${DEPLOYABLE_BACKEND_TAG_REF}" \
|
|
| grep "^${DEPLOYABLE_BACKEND_REPO}@sha256:" \
|
|
| head -n 1
|
|
} || true)"
|
|
|
|
if [ -z "${ACTUAL_BACKEND_TAG_DIGEST_REF}" ]; then
|
|
echo "❌ Could not resolve backend digest from tag reference: ${DEPLOYABLE_BACKEND_TAG_REF}"
|
|
exit 1
|
|
fi
|
|
|
|
if [ "${ACTUAL_BACKEND_TAG_DIGEST_REF}" != "${EXPECTED_BACKEND_DIGEST_REF}" ]; then
|
|
echo "❌ Backend tag and digest mismatch"
|
|
echo "expected=${EXPECTED_BACKEND_DIGEST_REF}"
|
|
echo "actual=${ACTUAL_BACKEND_TAG_DIGEST_REF}"
|
|
exit 1
|
|
fi
|
|
|
|
DEPLOYABLE_FRONTEND_REPO="${DEPLOYABLE_FRONTEND_DIGEST_REF%%@*}"
|
|
EXPECTED_FRONTEND_DIGEST_REF="${DEPLOYABLE_FRONTEND_DIGEST_REF}"
|
|
ACTUAL_FRONTEND_TAG_DIGEST_REF="$({
|
|
docker image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "${DEPLOYABLE_FRONTEND_TAG_REF}" \
|
|
| grep "^${DEPLOYABLE_FRONTEND_REPO}@sha256:" \
|
|
| head -n 1
|
|
} || true)"
|
|
|
|
if [ -z "${ACTUAL_FRONTEND_TAG_DIGEST_REF}" ]; then
|
|
echo "❌ Could not resolve frontend digest from tag reference: ${DEPLOYABLE_FRONTEND_TAG_REF}"
|
|
exit 1
|
|
fi
|
|
|
|
if [ "${ACTUAL_FRONTEND_TAG_DIGEST_REF}" != "${EXPECTED_FRONTEND_DIGEST_REF}" ]; then
|
|
echo "❌ Frontend tag and digest mismatch"
|
|
echo "expected=${EXPECTED_FRONTEND_DIGEST_REF}"
|
|
echo "actual=${ACTUAL_FRONTEND_TAG_DIGEST_REF}"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Resolved deployable backend digest: ${EXPECTED_BACKEND_DIGEST_REF}"
|
|
echo "Resolved deployable frontend digest: ${EXPECTED_FRONTEND_DIGEST_REF}"
|
|
|
|
export DB_PASSWORD DB_URL CICD_IMAGE E2E_ARTIFACT_DIR="${ARTIFACT_DIR}"
|
|
export DEPLOYABLE_BACKEND_IMAGE="${EXPECTED_BACKEND_DIGEST_REF}"
|
|
export DEPLOYABLE_FRONTEND_IMAGE="${EXPECTED_FRONTEND_DIGEST_REF}"
|
|
|
|
docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" up -d database backend frontend
|
|
|
|
db_ready=false
|
|
for i in $(seq 1 30); do
|
|
if docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" exec -T database pg_isready -U plex_user -d plex_playlist >/dev/null 2>&1; then
|
|
db_ready=true
|
|
break
|
|
fi
|
|
sleep 2
|
|
done
|
|
if [ "${db_ready}" != "true" ]; then
|
|
echo "❌ Database did not become ready"
|
|
dump_failure_context
|
|
exit 1
|
|
fi
|
|
|
|
backend_ready=false
|
|
for i in $(seq 1 40); do
|
|
backend_running_count="$(docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" ps --status running --services backend | wc -l)"
|
|
if [ "${backend_running_count}" -eq 0 ]; then
|
|
echo "❌ Backend container exited before becoming healthy"
|
|
dump_failure_context
|
|
exit 1
|
|
fi
|
|
|
|
health_code="$(fetch_http "backend" "/health" /tmp/e2e-backend-health.json)"
|
|
if [ "${health_code}" = "200" ]; then
|
|
backend_ready=true
|
|
break
|
|
fi
|
|
sleep 2
|
|
done
|
|
if [ "${backend_ready}" != "true" ]; then
|
|
echo "❌ Backend did not become healthy"
|
|
cat /tmp/e2e-backend-health.json 2>/dev/null || true
|
|
dump_failure_context
|
|
exit 1
|
|
fi
|
|
|
|
root_code="$(fetch_http "backend" "/" /tmp/e2e-backend-root.json)"
|
|
if [ "${root_code}" != "200" ] || ! grep -q 'Plex Playlist Backend API' /tmp/e2e-backend-root.json; then
|
|
echo "❌ Backend root endpoint validation failed"
|
|
cat /tmp/e2e-backend-root.json 2>/dev/null || true
|
|
dump_failure_context
|
|
exit 1
|
|
fi
|
|
|
|
frontend_ready=false
|
|
for i in $(seq 1 30); do
|
|
frontend_running_count="$(docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" ps --status running --services frontend | wc -l)"
|
|
if [ "${frontend_running_count}" -gt 0 ]; then
|
|
frontend_root_code="$(fetch_url_from_backend "${FRONTEND_URL_RUNNER}" /tmp/e2e-frontend-root.html)"
|
|
if [ "${frontend_root_code}" = "200" ]; then
|
|
frontend_ready=true
|
|
break
|
|
fi
|
|
fi
|
|
sleep 2
|
|
done
|
|
if [ "${frontend_ready}" != "true" ]; then
|
|
echo "❌ Frontend did not become reachable"
|
|
cat /tmp/e2e-frontend-root.html 2>/dev/null || true
|
|
dump_failure_context
|
|
exit 1
|
|
fi
|
|
|
|
docker compose -p "${COMPOSE_PROJECT_NAME}" -f "${COMPOSE_FILE}" run --rm e2e-tests \
|
|
bash -c "cd /workspace/frontend && yarn test:e2e --reporter=list --timeout=90000" \
|
|
2>&1 | tee "${LOG_FILE}"
|
|
|
|
TEST_STATUS=${PIPESTATUS[0]}
|
|
if [ "${TEST_STATUS}" -ne 0 ]; then
|
|
echo "❌ E2E tests failed (exit=${TEST_STATUS})"
|
|
echo "--- Last 200 lines of E2E output ---"
|
|
tail -n 200 "${LOG_FILE}" || true
|
|
echo "--- E2E artifact files ---"
|
|
find "${ARTIFACT_DIR}" -maxdepth 2 -type f | sort || true
|
|
dump_failure_context
|
|
exit "${TEST_STATUS}"
|
|
fi
|
|
|
|
echo "=== E2E artifact files ==="
|
|
find "${ARTIFACT_DIR}" -maxdepth 2 -type f | sort || true
|
|
|
|
- *failure_diagnostics_step
|