workbench/.github/workflows/e2e.yml at master · minspec/workbench · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
name: e2e
# The org's one road test: package -> recipe -> endpoint -> app.
# Canonical here; every repo that can break the road calls this same
# workflow with its own PR slotted into the matching ref, siblings at
# dev. Never weaken it; extend it.
on:
  pull_request:
  push:
    branches: [dev, master]
  workflow_call:
    inputs:
      skeleton_ref:
        type: string
        default: dev
      recipes_ref:
        type: string
        default: dev
      fixtures_ref:
        type: string
        default: dev
      workbench_ref:
        type: string
        default: ''
permissions:
  contents: read
jobs:
  e2e:
    runs-on: ubuntu-latest
    steps:
      - name: checkout workbench (own run)
        if: ${{ inputs.workbench_ref == '' }}
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
          path: wb
      - name: checkout workbench (called)
        if: ${{ inputs.workbench_ref != '' }}
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          repository: minspec/workbench
          ref: ${{ inputs.workbench_ref }}
          persist-credentials: false
          path: wb
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          repository: minspec/skeleton
          ref: ${{ inputs.skeleton_ref || 'dev' }}
          persist-credentials: false
          path: .e2e/skeleton
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          repository: minspec/workbench-fixtures
          ref: ${{ inputs.fixtures_ref || 'dev' }}
          persist-credentials: false
          path: .e2e/fixtures
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          repository: minspec/recipes
          ref: ${{ inputs.recipes_ref || 'dev' }}
          persist-credentials: false
          path: .e2e/recipes
      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
        with:
          php-version: '8.4'

      - name: serve the recipes endpoint locally (clean arm)
        run: |
          cd .e2e/recipes
          jq '._links.recipe_template = "http://127.0.0.1:8099/{package_dotted}.{version}.json" | .recipe_template = "http://127.0.0.1:8099/{package_dotted}.{version}.json"' index.json > index.tmp && mv index.tmp index.json
          php -S 127.0.0.1:8099 &
          sleep 1
          curl -fsS http://127.0.0.1:8099/index.json | jq -e '.recipes["minspec/fixture-hello"]'

      - name: compose the app from the skeleton
        run: |
          composer create-project minspec/skeleton .e2e/app --repository="{\"type\":\"path\",\"url\":\"$GITHUB_WORKSPACE/.e2e/skeleton\"}" --stability=dev --no-interaction

      - name: require fixture-hello through the endpoint
        run: |
          cd .e2e/app
          composer config secure-http false
          composer config repositories.fixtures "{\"type\":\"path\",\"url\":\"$GITHUB_WORKSPACE/.e2e/fixtures/packages/fixture-hello\"}"
          composer config extra.symfony.endpoint --json "[\"http://127.0.0.1:8099/index.json\",\"flex://defaults\"]"
          composer require minspec/fixture-hello:1.0.0 --no-interaction

      - name: assertions (independent test author)
        run: bash wb/tests/e2e/assert.sh .e2e/app

      - name: planted fault must fire
        run: |
          # Corrupt the served recipe (parameter renamed, ref changed so no
          # cache can launder the plant), serve it on its own port, prove
          # the plant landed and did not leak, then a fresh app build must
          # fail. The clean arm above is the stay-quiet half.
          mkdir -p .e2e/recipes-broken
          cp .e2e/recipes/index.json .e2e/recipes-broken/
          sed 's/fixture_hello.greeting/fixture_hello.wrong/' \
            .e2e/recipes/minspec.fixture-hello.1.0.json > .e2e/recipes-broken/minspec.fixture-hello.1.0.json
          sed -i 's/e2e-fixture-1.0/e2e-broken-1.0/' .e2e/recipes-broken/minspec.fixture-hello.1.0.json
          grep -q 'fixture_hello.wrong' .e2e/recipes-broken/minspec.fixture-hello.1.0.json || { echo "plant did not land"; exit 1; }
          ! grep -q 'fixture_hello.wrong' .e2e/recipes/minspec.fixture-hello.1.0.json || { echo "plant leaked into clean fixture"; exit 1; }
          jq '._links.recipe_template = "http://127.0.0.1:8098/{package_dotted}.{version}.json" | .recipe_template = "http://127.0.0.1:8098/{package_dotted}.{version}.json"' .e2e/recipes-broken/index.json > .e2e/recipes-broken/index.tmp && mv .e2e/recipes-broken/index.tmp .e2e/recipes-broken/index.json
          (cd .e2e/recipes-broken && php -S 127.0.0.1:8098 &)
          sleep 1
          composer create-project minspec/skeleton .e2e/app-broken --repository="{\"type\":\"path\",\"url\":\"$GITHUB_WORKSPACE/.e2e/skeleton\"}" --stability=dev --no-interaction
          cd .e2e/app-broken
          composer config secure-http false
          composer config repositories.fixtures "{\"type\":\"path\",\"url\":\"$GITHUB_WORKSPACE/.e2e/fixtures/packages/fixture-hello\"}"
          composer config extra.symfony.endpoint --json "[\"http://127.0.0.1:8098/index.json\",\"flex://defaults\"]"
          if composer require minspec/fixture-hello:1.0.0 --no-interaction >/dev/null 2>&1 && php bin/console list >/dev/null 2>&1; then
            echo "planted fault did NOT fire — the oracle is blind"
            exit 1
          fi
          echo "planted fault fired as required"