stack/.github/workflows/prisma-next-e2e.yml at 7404761be9530caec2f797704434ab943caeb429 · cipherstash/stack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
name: Prisma Next E2E

# End-to-end tests for `@cipherstash/prisma-next`: spins up a real
# Postgres container, applies the cipherstash baseline migration
# (EQL bundle install) + the example app's schema, then runs the
# suite at `examples/prisma/test/e2e/` against a live ZeroKMS
# workspace.
#
# Triggers only on changes that affect the package or the example
# (the unit-test suite in `tests.yml` covers everything that doesn't
# need a live workspace).

on:
  push:
    branches:
      - main
    paths:
      - 'packages/prisma-next/**'
      - 'examples/prisma/**'
      - '.github/workflows/prisma-next-e2e.yml'
  pull_request:
    branches:
      - '**'
    paths:
      - 'packages/prisma-next/**'
      - 'examples/prisma/**'
      - '.github/workflows/prisma-next-e2e.yml'

jobs:
  e2e:
    name: Run Prisma Next E2E
    runs-on: blacksmith-4vcpu-ubuntu-2404

    # Skip cleanly on fork PRs where secrets aren't available. The
    # global-setup hook in the suite hard-errors when `CS_WORKSPACE_CRN`
    # is unset; gating at the job level produces a clean "skipped"
    # status instead of a noisy failure.
    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}

    env:
      CS_WORKSPACE_CRN: ${{ vars.CS_WORKSPACE_CRN }}
      CS_CLIENT_ID: ${{ vars.CS_CLIENT_ID }}
      CS_CLIENT_KEY: ${{ secrets.CS_CLIENT_KEY }}
      CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_CLIENT_ACCESS_KEY }}

    steps:
      - name: Checkout Repo
        uses: actions/checkout@v6

      - uses: pnpm/action-setup@v6.0.9
        name: Install pnpm
        with:
          run_install: false

      - name: Install Node.js
        uses: actions/setup-node@v6.4.0
        with:
          node-version: 22
          cache: 'pnpm'

      # node-pty's install hook falls back to `node-gyp rebuild` when no
      # linux-x64 prebuild matches. pnpm/action-setup v6 no longer ships
      # node-gyp on PATH, so install it explicitly.
      - name: Install node-gyp
        run: npm install -g node-gyp

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # The global-setup hook hard-errors without CS_WORKSPACE_CRN, but a
      # missing sibling secret could still degrade coverage silently — assert
      # all four up front so a rotated / fork-PR-absent secret fails loudly.
      - name: Require CipherStash secrets
        uses: ./.github/actions/require-cs-secrets
        with:
          workspace-crn: ${{ vars.CS_WORKSPACE_CRN }}
          client-id: ${{ vars.CS_CLIENT_ID }}
          client-key: ${{ secrets.CS_CLIENT_KEY }}
          client-access-key: ${{ secrets.CS_CLIENT_ACCESS_KEY }}

      # Write the CS_* credentials and the harness DATABASE_URL into the
      # example app's .env so the runtime + the `prisma-next migration
      # apply` invocation in global-setup both pick them up. The harness
      # also overrides DATABASE_URL inside the test process to point at
      # the container, but the migration:apply subprocess relies on
      # prisma-next.config.ts → process.env['DATABASE_URL'] being set
      # before the test runner spawns it.
      - name: Create .env file in examples/prisma
        run: |
          touch ./examples/prisma/.env
          echo "DATABASE_URL=postgres://cipherstash:cipherstash@localhost:54329/cipherstash_e2e" >> ./examples/prisma/.env
          echo "CS_WORKSPACE_CRN=${{ vars.CS_WORKSPACE_CRN }}" >> ./examples/prisma/.env
          echo "CS_CLIENT_ID=${{ vars.CS_CLIENT_ID }}" >> ./examples/prisma/.env
          echo "CS_CLIENT_KEY=${{ secrets.CS_CLIENT_KEY }}" >> ./examples/prisma/.env
          echo "CS_CLIENT_ACCESS_KEY=${{ secrets.CS_CLIENT_ACCESS_KEY }}" >> ./examples/prisma/.env

      # Build via turbo so the `^build` dependency on
      # `@cipherstash/stack` (which `@cipherstash/prisma-next` imports
      # `/schema` from) is honoured. A bare
      # `pnpm --filter @cipherstash/prisma-next build` bypasses the
      # task graph and leaves the upstream dist/ empty, surfacing as
      # `Cannot find module '@cipherstash/stack/schema'` from tsc.
      - name: Build @cipherstash/prisma-next
        run: pnpm exec turbo run build --filter @cipherstash/prisma-next

      - name: Emit example contract
        run: pnpm --filter @cipherstash/prisma-next-example emit

      - name: Start E2E Postgres container
        working-directory: examples/prisma
        run: |
          docker compose -f test/e2e/docker-compose.yml up -d
          # Wait for pg_isready before handing off to the suite — the
          # global-setup hook expects the container to already be up.
          for i in {1..60}; do
            if docker exec cipherstash-e2e-postgres pg_isready -U cipherstash -d cipherstash_e2e >/dev/null 2>&1; then
              echo "Postgres ready"
              break
            fi
            sleep 1
          done

      - name: Run E2E suite
        run: pnpm --filter @cipherstash/prisma-next-example test:e2e

      - name: Stop E2E Postgres container
        if: always()
        working-directory: examples/prisma
        run: docker compose -f test/e2e/docker-compose.yml down -v