James Wampler
1556b486d2
## Summary - Fix a chain of QA CI issues: Docker build/health-check flakiness, NuGet vuln pins, then adds the post-deploy integration + Playwright smoke suite and works through everything needed to make it actually run on the self-hosted `qa` runner (musl/Alpine job container, no node/dotnet/curl preinstalled, docker-outside-of-docker networking). - Adds a fixed dev/QA seed admin user + fixed Development environment API key so integration tests and e2e specs have a stable target. - Pins Aspire's `AppHost.cs` ports/credentials to match the docker-compose local dev defaults. - Adds `tests/api/MicCheck.Api.Tests.Integration` coverage for disabled flags, environment-document bootstrap, identity override precedence, auth login, and unauthorized access; adds a Playwright e2e suite under `src/admin/e2e` (login, nav, context selection, features CRUD/toggle). - Adds a `smoke-qa` CI job that runs both suites against the just-deployed QA stack, working around: no curl/node/dotnet on the bare runner, musl vs glibc (Playwright browsers run via the official `mcr.microsoft.com/playwright` image instead), and the runner's job-container network isolation (reach the QA stack via the docker bridge gateway IP; `docker cp` instead of a bind mount to get files into the playwright container, since paths don't cross the docker-outside-of-docker boundary). ## Test plan - [x] Unit tests pass (dotnet test tests/api/MicCheck.Api.Tests.Unit, 243 passed) - [x] API integration suite passes against the real QA stack in CI - [x] Playwright e2e suite passes against the real QA stack in CI (verified 3/3 locally against a real dev API + vite server for the flakiest spec) - [x] Full CI pipeline (build → deploy-qa → smoke-qa) green end to end on the qa runner Reviewed-on: #3
56 lines
2.8 KiB
Bash
Executable File
56 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Post-deploy validation for the QA environment: runs the API integration
|
|
# suite (real HTTP + real Postgres, seeding/cleaning up its own data) and the
|
|
# Playwright admin e2e suite against the just-deployed QA stack. Intended to
|
|
# run immediately after deploy-qa.sh, on the same self-hosted qa runner. This
|
|
# job runs in its own job container, a sibling of the QA stack's containers
|
|
# on docker's default bridge network - not "localhost" from the host's point
|
|
# of view - so it reaches published ports via the bridge gateway IP, same as
|
|
# deploy-qa.sh binds the db port to.
|
|
set -euo pipefail
|
|
cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
|
|
cd "$CI_ROOT"
|
|
|
|
ensure_dotnet
|
|
ensure_node
|
|
|
|
QA_ADMIN_PORT="${QA_ADMIN_PORT:-3001}"
|
|
CI_HOST="$(docker_bridge_gateway)"
|
|
[[ -n "$CI_HOST" ]] || fail "could not determine docker bridge gateway IP to reach the QA stack"
|
|
BASE_URL="http://${CI_HOST}:${QA_ADMIN_PORT}"
|
|
|
|
log "Resolved docker host as $CI_HOST for reaching the QA stack's published ports"
|
|
|
|
export MICCHECK_API_BASE_URL="$BASE_URL"
|
|
export MICCHECK_DB_CONNECTION_STRING="${MICCHECK_DB_CONNECTION_STRING:-Host=$CI_HOST;Port=55432;Database=miccheck;Username=miccheck;Password=password}"
|
|
|
|
log "Running API integration suite against $BASE_URL"
|
|
dotnet test tests/api/MicCheck.Api.Tests.Integration/MicCheck.Api.Tests.Integration.csproj -c Release --logger trx
|
|
|
|
log "Installing admin e2e dependencies"
|
|
npm --prefix src/admin ci
|
|
|
|
# Playwright's bundled Chromium is a glibc binary and `--with-deps` only knows
|
|
# apt - neither works on this musl/Alpine runner. Run the e2e leg inside
|
|
# Microsoft's official Playwright image instead (glibc, browsers preinstalled
|
|
# at /ms-playwright), as a sibling container reachable at the same bridge
|
|
# gateway IP used above. Pin the image tag to the exact resolved
|
|
# @playwright/test version so the test runner and browser build match.
|
|
#
|
|
# This script itself runs inside the runner's own job container, talking to
|
|
# the host's docker daemon over a mounted socket (docker-outside-of-docker) -
|
|
# `docker run -v "$CI_ROOT:/work"` would ask the *host* daemon to bind-mount a
|
|
# path that only exists inside this job container, which fails. `docker cp`
|
|
# instead copies the files by content, sidestepping the path mismatch.
|
|
PW_VERSION="$(node -p "require('./src/admin/node_modules/@playwright/test/package.json').version")"
|
|
log "Running Playwright admin e2e suite against $BASE_URL (playwright:v$PW_VERSION-noble)"
|
|
|
|
PW_CONTAINER="$(docker create -e "E2E_BASE_URL=$BASE_URL" -w /work/src/admin "mcr.microsoft.com/playwright:v${PW_VERSION}-noble" npm run e2e)"
|
|
docker cp "$CI_ROOT/." "$PW_CONTAINER:/work"
|
|
pw_status=0
|
|
docker start -a "$PW_CONTAINER" || pw_status=$?
|
|
docker rm -f "$PW_CONTAINER" > /dev/null
|
|
[[ "$pw_status" -eq 0 ]] || fail "Playwright e2e suite failed (exit $pw_status)"
|
|
|
|
log "smoke-qa.sh complete - QA environment validated end to end"
|