app-db.yml

name: App DB Tests

on:
  workflow_call:
    inputs:
      skip:
        type: boolean
        default: false

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-app-db
  cancel-in-progress: true

jobs:
  be-tests-mariadb:
    if: ${{ !inputs.skip }}
    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
    timeout-minutes: 40
    strategy:
      fail-fast: false
      matrix:
        version:
          - name: MariaDB 10.6
            junit-name: be-tests-mariadb-10-6-ee
            image: metabase/mariadb:10.6 # https://github.com/metabase/metabase-mariadb-docker-image
            env:
              enable-ssl-tests: 'false'
          - name: MariaDB Latest
            junit-name: be-tests-mariadb-latest-ee
            image: mariadb:latest
            env:
              enable-ssl-tests: 'false'
        job:
          - name: Enterprise Tests
            build-static-viz: false
            test-args: >-
              :only '"enterprise/backend/test"'
            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
          - name: EE App DB Tests (Part 1)
            build-static-viz: true
            test-args: >-
              :only '"test"'
              :partition/total 2
              :partition/index 0
            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
          - name: EE App DB Tests (Part 2)
            build-static-viz: true
            test-args: >-
              :only '"test"'
              :partition/total 2
              :partition/index 1
            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'

    services:
      mysql:
        image: ${{ matrix.version.image }}
        ports:
          - "3306:3306"
        env:
          MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: true
          MARIADB_DATABASE: mb_test
    env:
      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
      # it in to the command below.
      __ADDITIONAL_EXCLUDED_TAG__: >-
        ${{
          (
            github.event_name == 'push' &&
            (
              github.ref_name == 'master' ||
              startsWith(github.ref_name, 'release-')
            ) &&
            ''
          ) ||
          ':mb/old-migrations-test'
        }}
      # actual serious env vars below
      CI: 'true'
      DRIVERS: mysql
      MB_DB_TYPE: mysql
      MB_DB_HOST: localhost
      MB_DB_PORT: 3306
      MB_DB_DBNAME: mb_test
      MB_DB_USER: root
      MB_MYSQL_TEST_USER: root
      #
      # SSL config: only for mysql latest tests.
      #
      # set up env vars for something named "MYSQL_SSL" to run MySQL SSL tests verifying connectivity with PEM cert
      # they are deliberately given a different name to prevent them from affecting the regular test run against
      # the configured MySQL instance, but there is one particular test (mysql-connect-with-ssl-and-pem-cert-test)
      # that overrides the MB_MYSQL_TEST_* values with them
      # the MYSQL_RDS_SSL_INSTANCE vars are defined as secrets and can be altered
      MB_MYSQL_SSL_TEST_SSL: ${{ matrix.version.env.enable-ssl-tests }}
      MB_MYSQL_SSL_TEST_HOST: ${{ secrets.MYSQL_RDS_SSL_INSTANCE_HOST }}
      MB_MYSQL_SSL_TEST_ADDITIONAL_OPTIONS: 'verifyServerCertificate=true'
      # the contents of the ./resources/certificates/rds-combined-ca-bundle.pem file
      MB_MYSQL_SSL_TEST_SSL_CERT: ${{ secrets.MB_MYSQL_SSL_TEST_SSL_CERT }}
      MB_MYSQL_SSL_TEST_USER: metabase
      MB_MYSQL_SSL_TEST_PASSWORD: ${{ secrets.MYSQL_RDS_SSL_INSTANCE_PASSWORD }}
    # for historic reasons (I don't want to mess around with required jobs) the job name should be something like
    # "be-tests-mariadb-10-6-ee (0)"
    name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
    steps:
      - uses: actions/checkout@v6
      - name: Test ${{ matrix.version.name }}
        id: test-driver
        uses: ./.github/actions/test-driver
        with:
          build-static-viz: ${{ matrix.job.build-static-viz }}
          junit-name: ${{ matrix.version.junit-name }}
          test-args: >-
            ${{ matrix.job.test-args }}
            :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
      - name: Upload Test Results
        uses: ./.github/actions/upload-test-results
        if: always()
        with:
          input-path: ./target/junit/
          output-name: ${{ github.job }}
          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
          aws-region: ${{ vars.AWS_REGION }}
          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}

  be-tests-mysql:
    if: ${{ !inputs.skip }}
    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
    timeout-minutes: 40
    strategy:
      fail-fast: false
      matrix:
        version:
          - name: MySQL 8.0
            junit-name: be-tests-mysql-8-0-ee
            image: mysql:8.0
            env:
              enable-ssl-tests: 'false'
              enable-aws-iam-tests: 'false'
          - name: MySQL Latest
            junit-name: be-tests-mysql-latest-ee
            image: mysql:latest
            env:
              enable-ssl-tests: 'true'
              enable-aws-iam-tests: 'true'
        job:
          - name: Enterprise Tests
            build-static-viz: false
            test-args: >-
              :only '"enterprise/backend/test"'
            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
          - name: EE App DB Tests (Part 1)
            build-static-viz: true
            test-args: >-
              :only '"test"'
              :partition/total 2
              :partition/index 0
            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
          - name: EE App DB Tests (Part 2)
            build-static-viz: true
            test-args: >-
              :only '"test"'
              :partition/total 2
              :partition/index 1
            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'

    services:
      mysql:
        image: ${{ matrix.version.image }}
        ports:
          - "3306:3306"
        env:
          MYSQL_ALLOW_EMPTY_PASSWORD: true
          MYSQL_DATABASE: mb_test
    env:
      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
      # it in to the command below.
      __ADDITIONAL_EXCLUDED_TAG__: >-
        ${{
          (
            github.event_name == 'push' &&
            (
              github.ref_name == 'master' ||
              startsWith(github.ref_name, 'release-')
            ) &&
            ''
          ) ||
          ':mb/old-migrations-test'
        }}
      # actual serious env vars below
      CI: 'true'
      DRIVERS: mysql
      MB_DB_TYPE: mysql
      MB_DB_HOST: localhost
      MB_DB_PORT: 3306
      MB_DB_DBNAME: mb_test
      MB_DB_USER: root
      MB_MYSQL_TEST_USER: root
      #
      # SSL config: only for mysql latest tests.
      #
      # set up env vars for something named "MYSQL_SSL" to run MySQL SSL tests verifying connectivity with PEM cert
      # they are deliberately given a different name to prevent them from affecting the regular test run against
      # the configured MySQL instance, but there is one particular test (mysql-connect-with-ssl-and-pem-cert-test)
      # that overrides the MB_MYSQL_TEST_* values with them
      # the MYSQL_RDS_SSL_INSTANCE vars are defined as secrets and can be altered
      MB_MYSQL_SSL_TEST_SSL: ${{ matrix.version.env.enable-ssl-tests }}
      MB_MYSQL_SSL_TEST_HOST: ${{ secrets.MYSQL_RDS_SSL_INSTANCE_HOST }}
      MB_MYSQL_SSL_TEST_ADDITIONAL_OPTIONS: 'verifyServerCertificate=true'
      # the contents of the ./resources/certificates/rds-combined-ca-bundle.pem file
      MB_MYSQL_SSL_TEST_SSL_CERT: ${{ secrets.MB_MYSQL_SSL_TEST_SSL_CERT }}
      MB_MYSQL_SSL_TEST_USER: metabase
      MB_MYSQL_SSL_TEST_PASSWORD: ${{ secrets.MYSQL_RDS_SSL_INSTANCE_PASSWORD }}
      MB_MYSQL_AWS_IAM_TEST: ${{ matrix.version.env.enable-aws-iam-tests }}
      MB_MYSQL_AWS_IAM_TEST_HOST: ${{ secrets.MYSQL_AURORA_IAM_INSTANCE_HOST }}
      MB_MYSQL_AWS_IAM_TEST_PORT: 3306
      MB_MYSQL_AWS_IAM_TEST_USER: my_iam_user
      MB_MYSQL_AWS_IAM_TEST_DBNAME: test_db
      MB_MYSQL_AWS_IAM_TEST_SSL_CERT: trust
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_AURORA_IAM_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_AURORA_IAM_SECRET_ACCESS_KEY }}
    # for historic reasons (I don't want to mess around with required jobs) the job name should be something like
    # "be-tests-mariadb-10-6-ee (0)"
    name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
    steps:
      - uses: actions/checkout@v6
      - name: Test ${{ matrix.version.name }}
        id: test-driver
        uses: ./.github/actions/test-driver
        with:
          build-static-viz: ${{ matrix.job.build-static-viz }}
          junit-name: ${{ matrix.version.junit-name }}
          test-args: >-
            ${{ matrix.job.test-args }}
            :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
      - name: Upload Test Results
        uses: ./.github/actions/upload-test-results
        if: always()
        with:
          input-path: ./target/junit/
          output-name: ${{ github.job }}
          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
          aws-region: ${{ vars.AWS_REGION }}
          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}

  be-tests-postgres:
    if: ${{ !inputs.skip }}
    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
    timeout-minutes: 40
    strategy:
      fail-fast: false
      matrix:
        version:
          - name: Postgres 14.x
            junit-name: postgres-ee
            docker-image: postgres:14-alpine
            env:
              enable-ssl-tests: 'false'
              enable-aws-iam-tests: 'false'
          - name: Postgres Latest
            junit-name: postgres-latest-ee
            docker-image: postgres:latest
            env:
              enable-ssl-tests: 'true'
              enable-aws-iam-tests: 'true'
        job:
          - name: Enterprise Tests
            build-static-viz: false
            test-args: >-
              :only '"enterprise/backend/test"'
            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
          - name: EE App DB Tests (Part 1)
            build-static-viz: true
            test-args: >-
              :only '"test"'
              :exclude-tags [:mb/driver-tests]
              :partition/total 2
              :partition/index 0
            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
          - name: EE App DB Tests (Part 2)
            build-static-viz: true
            test-args: >-
              :only '"test"'
              :partition/total 2
              :partition/index 1
            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
    name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
    env:
      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
      # it in to the command below.
      __ADDITIONAL_EXCLUDED_TAG__: >-
        ${{
          (
            github.event_name == 'push' &&
            (
              github.ref_name == 'master' ||
              startsWith(github.ref_name, 'release-')
            ) &&
            ''
          ) ||
          ':mb/old-migrations-test'
        }}
      # actual serious env vars below
      CI: 'true'
      DRIVERS: postgres
      MB_DB_TYPE: postgres
      MB_DB_PORT: 5432
      MB_DB_HOST: localhost
      MB_DB_DBNAME: mb_test
      MB_DB_USER: mb_test
      MB_POSTGRESQL_TEST_USER: mb_test
      # SSL tests are only enabled for the postgres-latest job.
      MB_POSTGRES_SSL_TEST_SSL: ${{ matrix.version.env.enable-ssl-tests }}
      MB_POSTGRES_SSL_TEST_SSL_MODE: verify-full
      MB_POSTGRES_SSL_TEST_SSL_ROOT_CERT_PATH: 'test-resources/certificates/us-east-2-bundle.pem'
      MB_POSTGRES_AWS_IAM_TEST: ${{ matrix.version.env.enable-aws-iam-tests }}
      MB_POSTGRES_AWS_IAM_TEST_HOST: ${{ secrets.POSTGRES_AURORA_IAM_INSTANCE_HOST }}
      MB_POSTGRES_AWS_IAM_TEST_PORT: 5432
      MB_POSTGRES_AWS_IAM_TEST_USER: my_iam_user
      MB_POSTGRES_AWS_IAM_TEST_DBNAME: test_db
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_AURORA_IAM_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_AURORA_IAM_SECRET_ACCESS_KEY }}
    services:
      postgres:
        image: ${{ matrix.version.docker-image }}
        ports:
          - "5432:5432"
        env:
          POSTGRES_USER: mb_test
          POSTGRES_DB: mb_test
          POSTGRES_HOST_AUTH_METHOD: trust
    steps:
      - uses: actions/checkout@v6
      - name: Test ${{ matrix.version.name }} (${{ matrix.job.name }})
        id: test-driver
        uses: ./.github/actions/test-driver
        with:
          build-static-viz: ${{ matrix.job.build-static-viz }}
          junit-name: 'be-tests-${{ matrix.version.junit-name }}'
          test-args: >-
            ${{ matrix.job.test-args }}
            :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
      - name: Upload Test Results
        uses: ./.github/actions/upload-test-results
        if: always()
        with:
          input-path: ./target/junit/
          output-name: ${{ github.job }}
          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
          aws-region: ${{ vars.AWS_REGION }}
          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}

  app-db-tests-result:
    needs:
      - be-tests-mariadb
      - be-tests-mysql
      - be-tests-postgres
    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
    timeout-minutes: 5
    name: app-db-tests-result
    if: always() && !cancelled()
    steps:
      - name: Check job status
        uses: actions/github-script@v9
        env:
          needs: ${{ toJson(needs) }}
        with:
          script: | # js
            const needs = JSON.parse(process.env.needs);

            const jobs = Object.entries(needs).map(
              ([jobName, jobValues]) => ({
                name: jobName,
                result: jobValues.result
              }));

            // are all jobs skipped or successful?
            if (jobs.every(job => (job.result === 'skipped' || job.result === 'success'))) {
                console.log("");
                console.log("        _------.        ");
                console.log("       /  ,     \_      ");
                console.log("     /   /  /{}\ |o\_   ");
                console.log("    /    \  `--' /-' \  ");
                console.log("   |      \      \    | ");
                console.log("  |              |`-, | ");
                console.log("  /              /__/)/ ");
                console.log(" |              |       ");
                console.log("");
                console.log("All app db tests have passed (or have been skipped). Cam is very proud of you.");
              process.exit(0);
            }

            // otherwise, something failed
            console.log("");
            console.log("       .::::::::::.                          .::::::::::.       ");
            console.log("     .::::''''''::::.                      .::::''''''::::.     ");
            console.log("   .:::'          `::::....          ....::::'          `:::.   ");
            console.log("  .::'             `:::::::|        |:::::::'             `::.  ");
            console.log(" .::|               |::::::|_ ___ __|::::::|               |::. ");
            console.log(" `--'               |::::::|_()__()_|::::::|               `--' ");
            console.log("  :::               |::-o::|        |::o-::|               :::  ");
            console.log("  `::.             .|::::::|        |::::::|.             .::'  ");
            console.log("   `:::.          .::\-----'        `-----/::.          .:::'   ");
            console.log("     `::::......::::'                      `::::......::::'     ");
            console.log("       `::::::::::'                          `::::::::::'       ");
            console.log("");
            console.log("App db tests have failed. You have been sentenced to MetaJail.");

            jobs.forEach((job) => {
              if (job.result !== 'success') {
                console.log(`${job.name} - ${job.result}`);
              }
            });

            process.exit(1);