feat: run PR acceptance tests with OrgManager role in shared CF org

.github/workflows/acceptance_tests_mta.yaml

@@ -18,5 +18,14 @@ jobs:
     with:
       deployment_name: "autoscaler-mta-${{ github.event.pull_request.number || 'main' }}"
       use_metricsgateway: ${{ github.event_name == 'pull_request' }}
+      system_domain: "${{ vars.SYSTEM_DOMAIN }}"
+      autoscaler_org: "${{ vars.ACCEPTANCE_TESTS_EXISTING_ORG }}"
+      autoscaler_org_manager_user: "${{ vars.AUTOSCALER_ORG_MANAGER_USER }}"
+      autoscaler_other_user: "${{ vars.AUTOSCALER_OTHER_USER }}"
+      infrastructure: "${{ vars.INFRASTRUCTURE }}"
+      postgres_service_offering: "${{ vars.POSTGRES_SERVICE_OFFERING }}"
+      postgres_service_plan: "${{ vars.POSTGRES_SERVICE_PLAN }}"
     secrets:
       bbl_ssh_key: "${{ secrets.BBL_SSH_KEY }}"
+      autoscaler_org_manager_password: "${{ secrets.AUTOSCALER_ORG_MANAGER_PASSWORD }}"
+      autoscaler_other_user_password: "${{ secrets.AUTOSCALER_OTHER_USER_PASSWORD }}"

.github/workflows/acceptance_tests_reusable.yaml

@@ -13,9 +13,41 @@ on:
         required: false
         type: boolean
         default: false
+      system_domain:
+        required: false
+        type: string
+        default: ""
+      autoscaler_org:
+        required: false
+        type: string
+        default: ""
+      autoscaler_org_manager_user:
+        required: false
+        type: string
+        default: ""
+      autoscaler_other_user:
+        required: false
+        type: string
+        default: ""
+      infrastructure:
+        required: false
+        type: string
+        default: "OSS"
+      postgres_service_offering:
+        required: false
+        type: string
+        default: ""
+      postgres_service_plan:
+        required: false
+        type: string
+        default: ""
     secrets:
       bbl_ssh_key:
         required: true
+      autoscaler_org_manager_password:
+        required: false
+      autoscaler_other_user_password:
+        required: false
 
 defaults:
   run:
@@ -54,14 +86,44 @@ jobs:
         with:
           ssh-key: ${{ secrets.bbl_ssh_key}}
 
+      - name: Create Acceptance Space
+        shell: bash
+        env:
+          SYSTEM_DOMAIN: ${{ inputs.system_domain }}
+          AUTOSCALER_ORG: ${{ inputs.autoscaler_org }}
+          AUTOSCALER_ORG_MANAGER_USER: ${{ inputs.autoscaler_org_manager_user }}
+          AUTOSCALER_ORG_MANAGER_PASSWORD: ${{ secrets.autoscaler_org_manager_password }}
+          INFRASTRUCTURE: ${{ inputs.infrastructure }}
+        run: make --directory="${AUTOSCALER_DIR}" create-acceptance-space
+
       - name: Provision DB
+        if: inputs.infrastructure == 'OSS'
         shell: bash
         run: make --directory="${AUTOSCALER_DIR}" provision-db
 
+      - name: Provision DB Service
+        if: inputs.infrastructure != 'OSS'
+        shell: bash
+        env:
+          SYSTEM_DOMAIN: ${{ inputs.system_domain }}
+          AUTOSCALER_ORG: ${{ inputs.autoscaler_org }}
+          AUTOSCALER_ORG_MANAGER_USER: ${{ inputs.autoscaler_org_manager_user }}
+          AUTOSCALER_ORG_MANAGER_PASSWORD: ${{ secrets.autoscaler_org_manager_password }}
+          POSTGRES_SERVICE_OFFERING: ${{ inputs.postgres_service_offering }}
+          POSTGRES_SERVICE_PLAN: ${{ inputs.postgres_service_plan }}
+        run: make --directory="${AUTOSCALER_DIR}" provision-db-service
+
       - name: Deploy Apps
         shell: bash
         env:
           USE_METRICSGATEWAY: ${{ inputs.use_metricsgateway }}
+          SYSTEM_DOMAIN: ${{ inputs.system_domain }}
+          AUTOSCALER_ORG: ${{ inputs.autoscaler_org }}
+          AUTOSCALER_ORG_MANAGER_USER: ${{ inputs.autoscaler_org_manager_user }}
+          AUTOSCALER_ORG_MANAGER_PASSWORD: ${{ secrets.autoscaler_org_manager_password }}
+          AUTOSCALER_OTHER_USER: ${{ inputs.autoscaler_other_user }}
+          AUTOSCALER_OTHER_USER_PASSWORD: ${{ secrets.autoscaler_other_user_password }}
+          INFRASTRUCTURE: ${{ inputs.infrastructure }}
         run: |
           make --directory="${AUTOSCALER_DIR}" build-extension-file
           make --directory="${AUTOSCALER_DIR}" mta-build
@@ -98,6 +160,11 @@ jobs:
         shell: bash
         env:
           SUITES: ${{ matrix.suite }}
+          SYSTEM_DOMAIN: ${{ inputs.system_domain }}
+          AUTOSCALER_ORG_MANAGER_USER: ${{ inputs.autoscaler_org_manager_user }}
+          AUTOSCALER_ORG_MANAGER_PASSWORD: ${{ secrets.autoscaler_org_manager_password }}
+          AUTOSCALER_OTHER_USER: ${{ inputs.autoscaler_other_user }}
+          AUTOSCALER_OTHER_USER_PASSWORD: ${{ secrets.autoscaler_other_user_password }}
         run: make --directory="${AUTOSCALER_DIR}" mta-acceptance-tests
 
   deployment_cleanup:
@@ -125,6 +192,12 @@ jobs:
         with:
           ssh-key: ${{ secrets.bbl_ssh_key}}
       - name: Perform deployment cleanup
+        env:
+          SYSTEM_DOMAIN: ${{ inputs.system_domain }}
+          AUTOSCALER_ORG: ${{ inputs.autoscaler_org }}
+          AUTOSCALER_ORG_MANAGER_USER: ${{ inputs.autoscaler_org_manager_user }}
+          AUTOSCALER_ORG_MANAGER_PASSWORD: ${{ secrets.autoscaler_org_manager_password }}
+          INFRASTRUCTURE: ${{ inputs.infrastructure }}
         run: |
           make --directory="${AUTOSCALER_DIR}" deploy-cleanup
 

.github/workflows/create-org-manager-user.yaml → .github/workflows/setup-acceptance-tests.yaml

@@ -1,13 +1,17 @@
-name: Create CI Test Users
+name: Setup Acceptance Tests
 
 on:
   workflow_dispatch:
     inputs:
-      org:
+      autoscaler_org:
+        required: true
+        type: string
+        description: "CF org to grant OrgManager role in"
+      existing_organization:
         required: false
         type: string
-        default: "SAP_autoscaler_tests_OSS"
-        description: "CF org to create the CI test users in"
+        default: ""
+        description: "Additional CF org to grant OrgManager role in (if different from autoscaler_org)"
 
 defaults:
   run:
@@ -16,12 +20,11 @@ defaults:
 env:
   AUTOSCALER_DIR: "${{ github.workspace }}/app-autoscaler"
   BBL_STATE_PATH: "${{ github.workspace }}/bbl/bbl-state"
-  AUTOSCALER_ORG: "${{ inputs.org }}"
-  DEPLOYMENT_NAME: "autoscaler-mta-main"
+  AUTOSCALER_ORG: "${{ inputs.autoscaler_org }}"
 
 jobs:
-  create_ci_test_users:
-    name: Create CI Test Users
+  setup_acceptance_tests:
+    name: Setup Acceptance Tests
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -39,15 +42,16 @@ jobs:
         run: |
           cd "${AUTOSCALER_DIR}"
           eval "$(devbox shellenv)"
-          printenv >> "$GITHUB_ENV"
+          printenv | grep -v '^GH_TOKEN=' >> "$GITHUB_ENV"
 
       - name: Setup environment
         uses: ./app-autoscaler/.github/actions/setup-environment
         with:
           ssh-key: ${{ secrets.BBL_SSH_KEY }}
 
-      - name: Create CI test users and store credentials
+      - name: Setup acceptance tests (create users, org, space)
         env:
-          GH_TOKEN: ${{ secrets.APP_AUTOSCALER_CI_TOKEN }}
+          EXISTING_ORGANIZATION: ${{ inputs.existing_organization }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          make --directory="${AUTOSCALER_DIR}" create-org-manager-user
+          make --directory="${AUTOSCALER_DIR}" setup-acceptance-tests

Makefile

@@ -230,10 +230,18 @@ target/init-db-${db_type}:
 	@mkdir -p target
 	@touch $@
 
+.PHONY: create-acceptance-space
+create-acceptance-space: ## Create the CF org/space for acceptance tests
+	@./scripts/create-acceptance-space.sh
+
 .PHONY: provision-db
 provision-db: ## Provision a database on a remote Postgres server (requires POSTGRES_IP)
 	@./scripts/provision_db.sh
 
+.PHONY: provision-db-service
+provision-db-service: ## Provision a CF service instance as the database (non-OSS)
+	@./scripts/provision-db-service.sh
+
 .PHONY: deprovision-db
 deprovision-db: ## Deprovision a database on a remote Postgres server (requires POSTGRES_IP)
 	@./scripts/deprovision_db.sh
@@ -382,6 +390,10 @@ cf-login:
 		  'The necessary changes to the environment get lost when make exits its process.'
 	@${MAKEFILE_DIR}/scripts/os-infrastructure-login.sh
 
+.PHONY: deploy-cleanup
+deploy-cleanup:
+	DEBUG="${DEBUG}" ./scripts/cleanup-autoscaler.sh
+
 
 .PHONY: start-db
 start-db: check-db_type target/start-db-${db_type}_CI_${CI} waitfor_${db_type}_CI_${CI}
@@ -495,9 +507,6 @@ build-test-app:
 acceptance.build_tests:
 	@make --directory=acceptance build_tests
 
-.PHONY: acceptance.tests-cleanup
-acceptance.tests-cleanup:
-	@make --directory=acceptance acceptance-tests-cleanup
 
 # This target is defined here rather than directly in the component “scheduler” itself, because it depends on targets outside that component. In the future, it will be moved back to that component and reference a dependency to a Makefile on the same level – the one for the component it depends on.
 .PHONY: scheduler.test
@@ -537,9 +546,6 @@ build-acceptance-tests:
 acceptance-tests: build-test-app acceptance-tests-config ## Run acceptance tests against OSS dev environment (requrires a previous deployment of the autoscaler)
 	@make --directory='acceptance' run-acceptance-tests
 
-.PHONY: acceptance-cleanup
-acceptance-cleanup:
-	@make --directory='acceptance' acceptance-tests-cleanup
 
 .PHONY: acceptance-tests-config
 acceptance-tests-config:
@@ -556,9 +562,9 @@ mta-acceptance-tests: ## Run MTA acceptance tests in parallel via CF tasks
 deploy-cleanup:
 	DEBUG="${DEBUG}" ./scripts/cleanup-autoscaler.sh
 
-.PHONY: create-org-manager-user
-create-org-manager-user:
-	DEBUG="${DEBUG}" ./scripts/create-org-manager-user.sh
+.PHONY: setup-acceptance-tests
+setup-acceptance-tests:
+	DEBUG="${DEBUG}" ./scripts/setup-acceptance-tests.sh
 
 .PHONY: deploy-apps
 deploy-apps:

acceptance/Makefile

@@ -20,8 +20,7 @@ export GOWORK := off
 
 .PHONY: clean
 clean:
-	rm --recursive --force './build' './vendor' './ginkgo_v2' './results'
-	@make --directory='./assets/app/go_app' clean
+	rm --recursive --force './vendor'
 
 
 .PHONY: go-mod-tidy
@@ -86,6 +85,3 @@ run-acceptance-tests: acceptance-tests-config
 	@${MAKEFILE_DIR}/../scripts/run-acceptance-tests.sh
 
 
-.PHONY: acceptance-tests-cleanup
-acceptance-tests-cleanup: acceptance-tests-config
-	@${MAKEFILE_DIR}/../scripts/cleanup-acceptance.sh

acceptance/assets/app/go_app/internal/app/disk_test.go

@@ -247,7 +247,6 @@ var _ = Describe("Disk write timing", func() {
 		It("completes within 25 seconds", func() {
 			filePath := filepath.Join(GinkgoT().TempDir(), "disk-timing-test")
 			occupier := app.NewDefaultDiskOccupier(filePath)
-			DeferCleanup(occupier.Stop)
 
 			spaceInBytes := int64(650) * 1000 * 1000 // matches acceptance test: 650 * 1000 * 1000
 
@@ -263,6 +262,7 @@ var _ = Describe("Disk write timing", func() {
 			Expect(err).ToNot(HaveOccurred())
 			Expect(fStat.Size()).To(Equal(spaceInBytes))
 
+			occupier.Stop()
 			GinkgoWriter.Printf("650MB write completed in %v\n", elapsed)
 		})
 	})

acceptance/broker/broker_test.go

@@ -352,21 +352,19 @@ type ServicePlans []ServicePlan
 type BoolOrInt bool
 
 func (b *BoolOrInt) UnmarshalJSON(data []byte) error {
-	if len(data) > 0 && (data[0] == 't' || data[0] == 'f') {
-		var boolVal bool
-		if err := json.Unmarshal(data, &boolVal); err != nil {
-			return err
-		}
+	var boolVal bool
+	if err := json.Unmarshal(data, &boolVal); err == nil {
 		*b = BoolOrInt(boolVal)
 		return nil
 	}
 
 	var intVal int
-	if err := json.Unmarshal(data, &intVal); err != nil {
-		return fmt.Errorf("cannot unmarshal %s into BoolOrInt", string(data))
+	if err := json.Unmarshal(data, &intVal); err == nil {
+		*b = BoolOrInt(intVal != 0)
+		return nil
 	}
-	*b = BoolOrInt(intVal != 0)
-	return nil
+
+	return fmt.Errorf("cannot unmarshal %s into BoolOrInt", string(data))
 }
 
 type (
@@ -411,7 +409,7 @@ func GetServicePlans(cfg *config.Config) ServicePlans {
 }
 
 func (p ServicePlan) isUpdatable() bool {
-	return p.BrokerCatalog.Features.PlanUpdateable.Bool()
+	return bool(p.BrokerCatalog.Features.PlanUpdateable)
 }
 
 func (b BoolOrInt) Bool() bool { return bool(b) }

cf/cfclient_wrapper.go

@@ -114,6 +114,13 @@ func (w *CFClientWrapper) Login(ctx context.Context) error {
 }
 
 func (w *CFClientWrapper) IsUserAdmin(ctx context.Context, userToken string) (bool, error) {
+	// Password grant uses the public "cf" client (no secret). UAA /introspect requires
+	// confidential client credentials, so it would always fail. On password-grant deployments
+	// (PR environments) the caller is an OrgManager, never a CC admin, so returning false is correct.
+	if w.conf.IsPasswordGrant() {
+		return false, nil
+	}
+
 	resp, err := w.introspectToken(ctx, userToken)
 	if err != nil {
 		return false, err

cf/cfclient_wrapper_test.go

@@ -203,6 +203,22 @@ var _ = Describe("CFClientWrapper", func() {
 			Expect(err).NotTo(HaveOccurred())
 			Expect(isAdmin).To(BeFalse())
 		})
+
+		Context("when using password grant", func() {
+			BeforeEach(func() {
+				conf.GrantType = cf.GrantTypePassword
+				conf.Username = "test-user"
+				conf.Password = "test-password"
+				conf.Secret = ""
+			})
+
+			It("returns false without calling introspect", func() {
+				// No mockServer.Add().Introspect() — any introspect call would fail the test
+				isAdmin, err := client.IsUserAdmin(ctx, "user-token")
+				Expect(err).NotTo(HaveOccurred())
+				Expect(isAdmin).To(BeFalse())
+			})
+		})
 	})
 
 	Describe("IsUserSpaceDeveloper", func() {

ci/infrastructure/pipeline.yml

@@ -52,7 +52,7 @@ resources:
   source:
     uri: git@github.com:cloudfoundry/app-autoscaler
     private_key: ((autoscaler-deploy-key-private))
-    branch: worktree-APPAUTOSCALER-1033-move-ci-pipelines
+    branch: main
     fetch_tags: true
     paths:
       - ci/infrastructure

ci/infrastructure/scripts/deploy-metricsgateway.sh

@@ -75,6 +75,15 @@ EOF
   echo "${ext_file}"
 }
 
+function setup_security_group() {
+  local sg_file
+  sg_file="$(dirname "${BASH_SOURCE[0]}")/../security-groups/metricsgateway.json"
+  log "Binding metricsgateway security group to org '${cf_org}'"
+  cf create-security-group metricsgateway "${sg_file}" || true
+  cf update-security-group metricsgateway "${sg_file}"
+  cf bind-security-group metricsgateway "${cf_org}"
+}
+
 function deploy_metricsgateway() {
   local ext_file
   ext_file="$(build_extension_file)"
@@ -94,6 +103,7 @@ cf_login "${system_domain}"
 cf target -o "${cf_org}" -s "${cf_space}"
 generate_secrets
 deploy_metricsgateway
+setup_security_group
 
 log "metricsgateway deployed:"
 cf app metricsgateway