test(act): add gcom mock, cd.yml changes for testing (#501)

Author: xnyo

.github/workflows/cd.yml

@@ -342,6 +342,14 @@ on:
         type: boolean
 
       # Options for testing the workflow itself.
+      dist-artifacts-prefix:
+        description: |
+          Prefix to use when uploading the dist artifacts as GitHub artifacts.
+          Can be used if multiple CI jobs can be run in parallel in the same repository, in order to avoid name clashes.
+          For example: `my-plugin-`.
+        type: string
+        required: false
+        default: ""
       DO-NOT-USE-allow-pinned-commit-hashes:
         description: |
           FOR INTERNAL TESTING ONLY, DO NOT USE.
@@ -350,6 +358,14 @@ on:
         type: boolean
         required: false
         default: false
+      DO-NOT-USE-gcom-api-url:
+        description: |
+          FOR INTERNAL TESTING ONLY, DO NOT USE.
+          If set, overrides the GCOM API URL for all publish operations.
+          Used for testing with mock GCOM servers.
+        type: string
+        required: false
+        default: ""
 
 concurrency:
   group: cd-${{ github.head_ref || github.run_id }}
@@ -397,6 +413,7 @@ jobs:
         with:
           script: |
             const fs = require('fs');
+            const path = require('path');
 
             // Helper to get input/env values
             function getInput(name, fallback = '') {
@@ -411,6 +428,7 @@ jobs:
             const DISABLE_DOCS_PUBLISHING = getInput('DISABLE_DOCS_PUBLISHING') === 'true';
             const PLUGIN_VERSION_SUFFIX = getInput('PLUGIN_VERSION_SUFFIX', '');
             const COMMIT_SHA = getInput('COMMIT_SHA');
+            const PLUGIN_DIRECTORY = getInput('PLUGIN_DIRECTORY');
 
             // Determine if the reference is a release one (allowed to publish to prod)
             let isReleaseReference = false;
@@ -426,7 +444,7 @@ jobs:
             // has-backend is also returned by the ci job, but we do the check here again
             // so we don't have to depend on the ci job.
             // The ci workflow uses this same check to determine if the plugin has a backend.
-            const hasBackend = fs.existsSync('Magefile.go');
+            const hasBackend = fs.existsSync(path.join(PLUGIN_DIRECTORY, 'Magefile.go'));
             let platforms = ['any'];
             if (hasBackend) {
               platforms = ['linux', 'darwin', 'windows', 'any'];
@@ -540,6 +558,7 @@ jobs:
           DISABLE_DOCS_PUBLISHING: ${{ inputs.disable-docs-publishing }}
           COMMIT_SHA: ${{ steps.checkout-specified-branch.outputs.commit }}
           PLUGIN_VERSION_SUFFIX: ${{ inputs.plugin-version-suffix }}
+          PLUGIN_DIRECTORY: ${{ inputs.plugin-directory }}
 
   ci:
     name: CI
@@ -588,6 +607,7 @@ jobs:
       allow-unsigned: ${{ inputs.allow-unsigned }}
       signature-type: ${{ inputs.signature-type }}
 
+      dist-artifacts-prefix: ${{ inputs.dist-artifacts-prefix }}
       DO-NOT-USE-allow-pinned-commit-hashes: ${{ inputs.DO-NOT-USE-allow-pinned-commit-hashes }}
 
   build-attestation:
@@ -606,7 +626,7 @@ jobs:
       - name: Download GitHub artifact
         uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
-          name: dist-artifacts
+          name: ${{ inputs.dist-artifacts-prefix }}dist-artifacts
           path: /tmp/dist-artifacts
 
       - name: Generate artifact attestation
@@ -698,15 +718,18 @@ jobs:
           ENVIRONMENT: ${{ matrix.environment }}
 
       - name: Check and create stub
+        id: check-and-create-stub
         uses: grafana/plugin-ci-workflows/actions/internal/plugins/publish/check-and-create-stub@main
         if: ${{ matrix.environment != 'prod' && matrix.environment != 'prod-canary' }}
         with:
           plugin-id: ${{ fromJSON(needs.ci.outputs.plugin).id }}
           environment: ${{ matrix.environment }}
           gcom-publish-token: ${{ env.GCOM_PUBLISH_TOKEN }}
           gcloud-auth-token: ${{ steps.gcloud.outputs.id_token }}
+          gcom-api-url: ${{ inputs.DO-NOT-USE-gcom-api-url }}
 
       - name: Check artifact ZIP(s)
+        id: check-artifact-zips
         uses: grafana/plugin-ci-workflows/actions/internal/plugins/publish/check-artifacts@main
         with:
           zips: ${{ needs.upload-to-gcs-release.outputs.gcs-zip-urls }}
@@ -722,6 +745,7 @@ jobs:
           gcloud-auth-token: ${{ steps.gcloud.outputs.id_token }}
           ignore-conflicts: ${{ steps.determine-continue.outputs.ignore_conflicts }}
           publish-as-pending: ${{ matrix.environment == 'prod-canary' || inputs.publish-to-catalog-as-pending }}
+          gcom-api-url: ${{ inputs.DO-NOT-USE-gcom-api-url }}
 
       - name: Print publish summary
         run: |
@@ -824,7 +848,7 @@ jobs:
       - name: Download GitHub artifact
         uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
-          name: dist-artifacts
+          name: ${{ inputs.dist-artifacts-prefix }}dist-artifacts
           path: /tmp/dist-artifacts
 
       - name: Prepare "latest" artifacts
@@ -843,6 +867,7 @@ jobs:
           service_account: github-plugin-ci-workflows@grafanalabs-workload-identity.iam.gserviceaccount.com
 
       - name: "Set up Cloud SDK"
+        id: gcloud-sdk
         uses: "google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db" # v3.0.1
         with:
           version: ">= 363.0.0"
@@ -1059,7 +1084,7 @@ jobs:
       - name: Download GitHub artifact
         uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
-          name: dist-artifacts
+          name: ${{ inputs.dist-artifacts-prefix }}dist-artifacts
           path: /tmp/dist-artifacts
 
       - name: Parse changelog

actions/internal/plugins/publish/check-and-create-stub/action.yml

@@ -26,6 +26,12 @@ inputs:
       Required only for publishing to dev or ops.
     required: false
     default: ""
+  gcom-api-url:
+    description: |
+      FOR INTERNAL TESTING ONLY.
+      Override the GCOM API URL (used for testing with mock servers).
+    required: false
+    default: ""
 
 runs:
   using: composite
@@ -38,6 +44,7 @@ runs:
       env:
         GCLOUD_AUTH_TOKEN: ${{ inputs.gcloud-auth-token }}
         GCOM_PUBLISH_TOKEN: ${{ inputs.gcom-publish-token }}
+        GCOM_API_URL: ${{ inputs.gcom-api-url }}
 
         ENVIRONMENT: ${{ inputs.environment }}
         PLUGIN_ID: ${{ inputs.plugin-id }}

actions/internal/plugins/publish/check-and-create-stub/check-and-create-stub.sh

@@ -33,20 +33,26 @@ if [ -z $gcom_env ]; then
     exit 1
 fi
 
-# Can only be 'dev' or 'ops'. The prod stub is created manually.
-case $gcom_env in
-    dev)
-        gcom_api_url=https://grafana-dev.com/api
-        ;;
-    ops|staging)
-        gcom_api_url=https://grafana-ops.com/api
-        ;;
-    *)
-        echo "Invalid environment: $gcom_env (supported values: 'dev', 'ops')"
-        usage
-        exit 1
-        ;;
-esac
+# Allow URL override for testing (GCOM_API_URL takes precedence)
+if [ -n "$GCOM_API_URL" ]; then
+    gcom_api_url=$GCOM_API_URL
+    echo "Using GCOM_API_URL override: $gcom_api_url"
+else
+    # Can only be 'dev' or 'ops'. The prod stub is created manually.
+    case $gcom_env in
+        dev)
+            gcom_api_url=https://grafana-dev.com/api
+            ;;
+        ops|staging)
+            gcom_api_url=https://grafana-ops.com/api
+            ;;
+        *)
+            echo "Invalid environment: $gcom_env (supported values: 'dev', 'ops')"
+            usage
+            exit 1
+            ;;
+    esac
+fi
 
 # Build args for curl to GCOM (auth headers)
 curl_args=(

actions/plugins/publish/publish/action.yml

@@ -46,6 +46,12 @@ inputs:
       Default is "false".
     required: false
     default: "false"
+  gcom-api-url:
+    description: |
+      FOR INTERNAL TESTING ONLY.
+      Override the GCOM API URL (used for testing with mock servers).
+    required: false
+    default: ""
 
 runs:
   using: composite
@@ -75,6 +81,7 @@ runs:
       env:
         GCLOUD_AUTH_TOKEN: ${{ inputs.gcloud-auth-token }}
         GCOM_PUBLISH_TOKEN: ${{ inputs.gcom-publish-token }}
+        GCOM_API_URL: ${{ inputs.gcom-api-url }}
 
         ZIPS_FOLDER: ${{ inputs.zips-folder }}
         ZIPS: ${{ inputs.zips }}

actions/plugins/publish/publish/publish.sh

@@ -54,25 +54,32 @@ if [ -z $scopes ]; then
     scopes='["universal"]'
 fi
 
-has_iap=false
-case $gcom_env in
-    dev)
-        gcom_api_url=https://grafana-dev.com/api
-        has_iap=true
-        ;;
-    ops|staging)
-        gcom_api_url=https://grafana-ops.com/api
-        has_iap=true
-        ;;
-    prod)
-        gcom_api_url=https://grafana.com/api
-        ;;
-    *)
-        echo "Invalid environment: $gcom_env (supported values: 'dev', 'ops', 'staging', 'prod')"
-        usage
-        exit 1
-        ;;
-esac
+# Allow URL override for testing (GCOM_API_URL takes precedence)
+if [ -n "$GCOM_API_URL" ]; then
+    gcom_api_url=$GCOM_API_URL
+    has_iap=false
+    echo "Using GCOM_API_URL override: $gcom_api_url"
+else
+    has_iap=false
+    case $gcom_env in
+        dev)
+            gcom_api_url=https://grafana-dev.com/api
+            has_iap=true
+            ;;
+        ops|staging)
+            gcom_api_url=https://grafana-ops.com/api
+            has_iap=true
+            ;;
+        prod)
+            gcom_api_url=https://grafana.com/api
+            ;;
+        *)
+            echo "Invalid environment: $gcom_env (supported values: 'dev', 'ops', 'staging', 'prod')"
+            usage
+            exit 1
+            ;;
+    esac
+fi
 
 # Build args for curl to GCOM (auth headers)
 curl_args=(

tests/act/internal/act/act.go

@@ -12,6 +12,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"runtime"
 	"strings"
 	"testing"
 
@@ -55,6 +56,9 @@ type Runner struct {
 	// GCS is the GCS mock storage used during the workflow run.
 	GCS GCS
 
+	// GCOM is the GCOM API mock used during the workflow run.
+	GCOM *GCOM
+
 	// gitHubToken is the token used to authenticate with GitHub.
 	gitHubToken string
 
@@ -124,6 +128,7 @@ func NewRunner(t *testing.T, opts ...RunnerOption) (*Runner, error) {
 		t:           t,
 		uuid:        uuid.New(),
 		gitHubToken: ghToken,
+		GCOM:        newGCOM(t),
 	}
 	if err := r.checkExecutables(); err != nil {
 		return nil, err
@@ -170,11 +175,8 @@ func (r *Runner) args(eventKind EventKind, actor string, workflowFile string, pa
 		// Required for cloning private repos
 		"--secret", "GITHUB_TOKEN=" + r.gitHubToken,
 
-		// Mounts:
-		// - mockdata: for mocked testdata, dist artifacts
-		// - GCS: for mocked GCS
-		// - /tmp: for temporary files, so the host's /tmp is used
-		"--container-options", `"-v $PWD/tests/act/mockdata:/mockdata -v ` + r.GCS.basePath + `:/gcs -v /tmp:/tmp"`,
+		// Additional Docker flags
+		"--container-options", r.containerOptions(),
 	}
 	if r.actionsCachePath != "" {
 		// Create and use per-runner cache.
@@ -402,6 +404,9 @@ func (r *Runner) parseGHACommand(data logLine, runResult *RunResult) {
 			Title:   data.KvPairs["title"],
 			Message: data.Arg,
 		})
+	case "summary":
+		// Summary
+		runResult.Summary = append(runResult.Summary, data.Content)
 	default:
 		// Nothing special to do
 		if r.Verbose && data.Command != "" {
@@ -477,6 +482,9 @@ type RunResult struct {
 
 	// Annotations contains the GitHub Actions annotations generated during the workflow run.
 	Annotations []Annotation
+
+	// Summary contains the summary of the workflow run.
+	Summary []string
 }
 
 // AnnotationLevel represents the level of a GitHub Actions annotation.
@@ -518,6 +526,64 @@ func (r *RunResult) GetTestingWorkflowRunID() (string, error) {
 	return runID, nil
 }
 
+// containerOptions returns the Docker container options for act.
+// On Linux, it adds --add-host to enable host.docker.internal (already works on Docker Desktop for macOS/Windows).
+func (r *Runner) containerOptions() string {
+
+	opts := []string{
+		// mocked testdata, dist artifacts
+		"-v $PWD/tests/act/mockdata:/mockdata",
+		// mocked GCS
+		"-v " + r.GCS.basePath + ":/gcs",
+	}
+
+	// On Linux, add --add-host for host.docker.internal (Docker Desktop handles this automatically)
+	// This is needed for local mock HTTP servers (e.g.: GCOM)
+	if runtime.GOOS == "linux" {
+		if hostIP := getDockerHostIP(); hostIP != "" {
+			opts = append([]string{"--add-host=host.docker.internal:" + hostIP}, opts...)
+		}
+	}
+
+	return `"` + strings.Join(opts, " ") + `"`
+}
+
+// getDockerHostIP returns the IP address that Docker containers can use to reach the host.
+// On Linux, this is typically the docker0 bridge IP (172.17.0.1) or the IP from the default route.
+// Returns empty string if detection fails (the mock servers won't work, but at least act will start).
+func getDockerHostIP() string {
+	// Try to get the IP from the default route (most reliable method)
+	cmd := exec.Command("ip", "route", "get", "1")
+	output, err := cmd.Output()
+	if err == nil {
+		// Output looks like: "1.0.0.0 via 192.168.1.1 dev eth0 src 192.168.1.100 uid 1000"
+		// We want the "src" IP
+		fields := strings.Fields(string(output))
+		for i, field := range fields {
+			if field == "src" && i+1 < len(fields) {
+				return fields[i+1]
+			}
+		}
+	}
+
+	// Fallback: try docker0 bridge IP (common default)
+	iface, err := net.InterfaceByName("docker0")
+	if err == nil {
+		addrs, err := iface.Addrs()
+		if err == nil && len(addrs) > 0 {
+			// Get the first IPv4 address
+			for _, addr := range addrs {
+				if ipnet, ok := addr.(*net.IPNet); ok && ipnet.IP.To4() != nil {
+					return ipnet.IP.String()
+				}
+			}
+		}
+	}
+
+	// Last resort: use the common docker bridge IP
+	return "172.17.0.1"
+}
+
 // getFreePort asks the kernel for a free open port that is ready to use.
 func getFreePort() (port int, err error) {
 	var a *net.TCPAddr