From ffca436247b99e371be5085add84e31bf86cbb29 Mon Sep 17 00:00:00 2001 From: Duane May Date: Fri, 10 Jul 2026 18:29:31 -0400 Subject: [PATCH 1/4] Add GitHub Actions workflow for PR integration tests against UAA MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ports the Concourse "uaa-singular-tests" job (concourse/pull-requests/pipeline.yml in uaa-ci) to a self-contained GitHub Actions workflow that runs on every pull request: build cloudfoundry/uaa (develop), boot it, create the singular-test-client OAuth client, then run npm test (build + unit + Nightwatch integration) against it. The Concourse version depends on the private uaa-ci repo for its shared task script and on the github-pr-resource for status reporting; neither is needed here — GitHub Actions reports pass/fail natively, so the task logic is inlined directly into the workflow. Chromedriver is installed at runtime to match the runner's Chrome major version, same pattern the existing Concourse task already uses. Co-Authored-By: Claude Sonnet 5 --- .../workflows/pull-request-integration.yml | 99 +++++++++++++++++++ 1 file changed, 99 insertions(+) create mode 100644 .github/workflows/pull-request-integration.yml diff --git a/.github/workflows/pull-request-integration.yml b/.github/workflows/pull-request-integration.yml new file mode 100644 index 0000000..6cf3d11 --- /dev/null +++ b/.github/workflows/pull-request-integration.yml @@ -0,0 +1,99 @@ +name: pull-request-integration-tests + +on: + pull_request: + branches: [main] + +jobs: + uaa-singular-tests: + runs-on: ubuntu-latest + steps: + - name: Checkout uaa-singular + uses: actions/checkout@v4 + + - name: Checkout cloudfoundry/uaa (develop) + uses: actions/checkout@v4 + with: + repository: cloudfoundry/uaa + ref: develop + path: uaa + + - uses: actions/setup-java@v4 + with: + distribution: temurin + java-version: '25' + + - uses: actions/setup-node@v4 + with: + node-version: '20' + + - name: Cache Gradle + uses: actions/cache@v4 + with: + path: | + ~/.gradle/caches + ~/.gradle/wrapper + key: gradle-${{ runner.os }}-${{ hashFiles('uaa/**/*.gradle*', 'uaa/gradle/wrapper/gradle-wrapper.properties') }} + + - name: Build UAA bootWar + working-directory: uaa + run: ./gradlew bootWar + + - name: Start UAA + working-directory: uaa + run: | + nohup java \ + -DCLOUDFOUNDRY_CONFIG_PATH=scripts/boot \ + -DSECRETS_DIR=scripts/boot \ + -Dserver.servlet.context-path=/uaa \ + -Dsmtp.host=localhost \ + -Dsmtp.port=2525 \ + -Dspring.profiles.active=hsqldb \ + -Djava.security.egd=file:/dev/./urandom \ + -jar uaa/build/libs/cloudfoundry-identity-uaa-0.0.0.war > uaa-boot.log 2>&1 & + + echo "Waiting for UAA to be ready..." + for i in $(seq 1 120); do + if curl -sf http://localhost:8080/uaa > /dev/null 2>&1; then + echo "UAA is now running" + exit 0 + fi + sleep 5 + done + echo "UAA failed to start within 600 seconds. Boot log:" + cat uaa-boot.log + exit 1 + + - name: Create singular-test-client + run: | + ACCESS_TOKEN=$(curl -sf http://localhost:8080/uaa/oauth/token -X POST \ + -H 'Content-Type: application/x-www-form-urlencoded' \ + -H 'Accept: application/json' \ + -d 'client_id=admin&client_secret=adminsecret&grant_type=client_credentials&token_format=opaque&response_type=token' \ + | jq -r '.access_token') + + curl -sf http://localhost:8080/uaa/oauth/clients -X POST \ + -H 'Content-Type: application/json' \ + -H "Authorization: Bearer ${ACCESS_TOKEN}" \ + -H 'Accept: application/json' \ + -d '{ + "scope": ["cloud_controller.read", "cloud_controller.write", "openid"], + "client_id": "singular-test-client", + "resource_ids": [], + "authorized_grant_types": ["implicit"], + "redirect_uri": ["http://localhost:8000/**"], + "autoapprove": true, + "name": "Singular Test Client" + }' + + - name: Install dependencies and matching chromedriver + run: | + npm install + CHROME_MAJOR=$(google-chrome --version | grep -oP '\d+' | head -1) + npm install "chromedriver@${CHROME_MAJOR}" + + - name: Start singular app + run: npm run start-singular-app + + - name: Run tests + run: npm test From c094774ab458350b7c53c19f1efad279374307d6 Mon Sep 17 00:00:00 2001 From: Duane May Date: Fri, 10 Jul 2026 18:32:59 -0400 Subject: [PATCH 2/4] Trigger unit-test.yml on pull_request too MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit push-triggered workflows only run in a fork's own Actions context, not upstream, so external contributors' PRs (the normal case for this open-source repo) currently get no build/unit-test check at all. Adding pull_request coverage means every PR gets that fast feedback, alongside the new integration workflow. Same-repo branches will now run the job twice per commit once a PR is open (push + pull_request) — an accepted, minor cost for a job this cheap. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/unit-test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index f9d86e6..88f0781 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -1,6 +1,6 @@ name: unit-test -on: [push] +on: [push, pull_request] jobs: build: From ecde657b8bba9f8ddea8d95babd4f0d77032cfb3 Mon Sep 17 00:00:00 2001 From: Duane May Date: Fri, 10 Jul 2026 18:39:37 -0400 Subject: [PATCH 3/4] Address Copilot review feedback on the PR integration workflow - Add explicit contents: read permissions and persist-credentials: false on both checkouts, since this runs on pull_request (including forks) and doesn't need write access. - Use npm ci for a deterministic install, and --no-save when installing the Chrome-matched chromedriver so it doesn't mutate package-lock.json during the run. - Glob for the built WAR instead of hardcoding its filename, as cheap insurance against UAA's build ever changing its version string (verified it's currently fixed at 0.0.0, so this wasn't an active bug, but the previous run confirmed the working-directory/path itself was already correct). Co-Authored-By: Claude Sonnet 5 --- .github/workflows/pull-request-integration.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pull-request-integration.yml b/.github/workflows/pull-request-integration.yml index 6cf3d11..859e2df 100644 --- a/.github/workflows/pull-request-integration.yml +++ b/.github/workflows/pull-request-integration.yml @@ -4,12 +4,17 @@ on: pull_request: branches: [main] +permissions: + contents: read + jobs: uaa-singular-tests: runs-on: ubuntu-latest steps: - name: Checkout uaa-singular uses: actions/checkout@v4 + with: + persist-credentials: false - name: Checkout cloudfoundry/uaa (develop) uses: actions/checkout@v4 @@ -17,6 +22,7 @@ jobs: repository: cloudfoundry/uaa ref: develop path: uaa + persist-credentials: false - uses: actions/setup-java@v4 with: @@ -42,6 +48,7 @@ jobs: - name: Start UAA working-directory: uaa run: | + WAR_FILE=$(ls uaa/build/libs/*.war | head -1) nohup java \ -DCLOUDFOUNDRY_CONFIG_PATH=scripts/boot \ -DSECRETS_DIR=scripts/boot \ @@ -50,7 +57,7 @@ jobs: -Dsmtp.port=2525 \ -Dspring.profiles.active=hsqldb \ -Djava.security.egd=file:/dev/./urandom \ - -jar uaa/build/libs/cloudfoundry-identity-uaa-0.0.0.war > uaa-boot.log 2>&1 & + -jar "${WAR_FILE}" > uaa-boot.log 2>&1 & echo "Waiting for UAA to be ready..." for i in $(seq 1 120); do @@ -88,9 +95,9 @@ jobs: - name: Install dependencies and matching chromedriver run: | - npm install + npm ci CHROME_MAJOR=$(google-chrome --version | grep -oP '\d+' | head -1) - npm install "chromedriver@${CHROME_MAJOR}" + npm install "chromedriver@${CHROME_MAJOR}" --no-save - name: Start singular app run: npm run start-singular-app From 8690ed42ee473e2ff594df6591c1f6ec248f323f Mon Sep 17 00:00:00 2001 From: Duane May Date: Fri, 10 Jul 2026 18:47:47 -0400 Subject: [PATCH 4/4] Scope workflow triggers to main, add nightly canary, bump checkout to v4 - unit-test.yml: scope push/pull_request to main (avoids redundant runs on every feature-branch commit before/after a PR opens), and bump actions/checkout from v1 to v4. - pull-request-integration.yml: same push/pull_request scoping, plus a daily schedule (07:30 UTC) so drift in cloudfoundry/uaa's develop branch is caught even without an open PR. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/pull-request-integration.yml | 6 +++++- .github/workflows/unit-test.yml | 8 ++++++-- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pull-request-integration.yml b/.github/workflows/pull-request-integration.yml index 859e2df..2e0b419 100644 --- a/.github/workflows/pull-request-integration.yml +++ b/.github/workflows/pull-request-integration.yml @@ -1,8 +1,12 @@ name: pull-request-integration-tests on: + push: + branches: [ "main" ] pull_request: - branches: [main] + branches: [ "main" ] + schedule: + - cron: '30 7 * * *' permissions: contents: read diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index 88f0781..b011024 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -1,12 +1,16 @@ name: unit-test -on: [push, pull_request] +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v1 + - uses: actions/checkout@v4 - run: npm install - name: Build run: npm run build