Skip to content

Commit dedadc8

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
committed
feat(e2e): enterprise trust pipeline live-service E2E tests + CI workflow
23 tests across 7 describes covering all 5 trust-tier services (claim-forge, checky-monkey, palimpsest-license, cicd-hyper-a, oikos). Tests use direct HTTP via Req to validate the real HTTP contract, bypassing Opsm.Clients.*. Full pipeline scenario: generate attestation → verify Ed25519 signature → license compatibility check → sustainability analysis → publish with attestation URI. Concurrent pipeline test validates service independence. trust-pipeline-e2e.yml: workflow_dispatch + push trigger on service/test/ compose changes; docker compose up with 180s health poll before tests; full log diagnostics on failure; docker compose down always. All actions SHA-pinned (checkout v6.0.2, erlef/setup-beam, actions/cache v4). :live_service added to default exclusions in test_helper.exs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 0b570e3 commit dedadc8

4 files changed

Lines changed: 595 additions & 4 deletions

File tree

‎.github/workflows/trust-pipeline-e2e.yml‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
3+
#
4+
# Enterprise trust pipeline — live-service E2E tests.
5+
#
6+
# Pulls all 5 trust-tier service images from GHCR (public, no auth required),
7+
# starts them via selur-compose.yml, waits for health checks, then runs the
8+
# :live_service E2E suite against the real HTTP endpoints.
9+
#
10+
# Triggered manually (workflow_dispatch) or on push to main when trust service
11+
# sources change. Not on every push — service startup adds ~90s overhead.
12+
13+
name: Trust Pipeline — Live-Service E2E
14+
15+
on:
16+
workflow_dispatch:
17+
push:
18+
branches: [main]
19+
paths:
20+
- 'services/**'
21+
- 'opsm_ex/lib/opsm/trust/**'
22+
- 'opsm_ex/lib/opsm/clients/**'
23+
- 'opsm_ex/test/integration/trust_pipeline_live_e2e_test.exs'
24+
- 'selur-compose.yml'
25+
- '.github/workflows/trust-pipeline-e2e.yml'
26+
27+
permissions: read-all
28+
29+
concurrency:
30+
group: trust-pipeline-e2e-${{ github.ref }}
31+
cancel-in-progress: true
32+
33+
jobs:
34+
trust-pipeline-e2e:
35+
name: Trust Pipeline Live E2E
36+
runs-on: ubuntu-24.04
37+
38+
steps:
39+
- name: Checkout
40+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
41+
with:
42+
submodules: false
43+
44+
# -----------------------------------------------------------------------
45+
# Elixir / BEAM setup
46+
# -----------------------------------------------------------------------
47+
- name: Install Elixir and OTP
48+
uses: erlef/setup-beam@5a67e1a1dd86cae5e5bef84e2da5060406a66c07 # v1
49+
with:
50+
otp-version: '26.2'
51+
elixir-version: '1.16.0'
52+
53+
- name: Cache Mix dependencies
54+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
55+
with:
56+
path: |
57+
opsm_ex/deps
58+
opsm_ex/_build
59+
key: mix-${{ runner.os }}-${{ hashFiles('opsm_ex/mix.lock') }}
60+
restore-keys: mix-${{ runner.os }}-
61+
62+
- name: Install Mix dependencies
63+
working-directory: opsm_ex
64+
run: mix deps.get
65+
66+
- name: Compile
67+
working-directory: opsm_ex
68+
run: mix compile --warnings-as-errors
69+
70+
# -----------------------------------------------------------------------
71+
# Start trust pipeline services via selur-compose.yml
72+
# -----------------------------------------------------------------------
73+
74+
# GHCR images are public — no registry login required for pulls.
75+
- name: Pull trust pipeline images
76+
run: |
77+
docker pull ghcr.io/hyperpolymath/claim-forge:latest
78+
docker pull ghcr.io/hyperpolymath/checky-monkey:latest
79+
docker pull ghcr.io/hyperpolymath/palimpsest-license:latest
80+
docker pull ghcr.io/hyperpolymath/cicd-hyper-a:latest
81+
docker pull ghcr.io/hyperpolymath/oikos:latest
82+
83+
- name: Start trust pipeline (claim-forge, checky-monkey, palimpsest, cicd-hyper-a, oikos)
84+
run: |
85+
# Start only the 5 trust-tier services (not the optional container-security profile)
86+
docker compose -f selur-compose.yml up -d \
87+
claim-forge \
88+
checky-monkey \
89+
palimpsest \
90+
cicd-hyper-a \
91+
oikos
92+
93+
- name: Wait for all services to be healthy
94+
# Polls each /health endpoint; aborts if any service fails to start within 3 minutes
95+
run: |
96+
services=(
97+
"http://localhost:8080/health:claim-forge"
98+
"http://localhost:8081/health:checky-monkey"
99+
"http://localhost:8082/health:palimpsest"
100+
"http://localhost:8083/health:cicd-hyper-a"
101+
"http://localhost:8084/health:oikos"
102+
)
103+
deadline=$(( $(date +%s) + 180 ))
104+
for entry in "${services[@]}"; do
105+
url="${entry%%:*}"
106+
name="${entry#*:}"
107+
echo -n "Waiting for $name ($url) "
108+
until curl -sf "$url" > /dev/null 2>&1; do
109+
if [ $(date +%s) -ge $deadline ]; then
110+
echo " TIMEOUT"
111+
docker compose -f selur-compose.yml logs "$name" || true
112+
exit 1
113+
fi
114+
echo -n "."
115+
sleep 3
116+
done
117+
echo " OK"
118+
done
119+
120+
# -----------------------------------------------------------------------
121+
# Run live-service E2E tests
122+
# -----------------------------------------------------------------------
123+
- name: Run trust pipeline E2E tests
124+
working-directory: opsm_ex
125+
env:
126+
CLAIM_FORGE_URL: "http://localhost:8080"
127+
CHECKY_MONKEY_URL: "http://localhost:8081"
128+
PALIMPSEST_URL: "http://localhost:8082"
129+
CICD_HYPER_A_URL: "http://localhost:8083"
130+
OIKOS_URL: "http://localhost:8084"
131+
MIX_ENV: test
132+
run: |
133+
mix test test/integration/trust_pipeline_live_e2e_test.exs \
134+
--include live_service \
135+
--include integration \
136+
--trace \
137+
--timeout 30000
138+
139+
# -----------------------------------------------------------------------
140+
# Diagnostics on failure
141+
# -----------------------------------------------------------------------
142+
- name: Dump service logs on failure
143+
if: failure()
144+
run: |
145+
for svc in claim-forge checky-monkey palimpsest cicd-hyper-a oikos; do
146+
echo "=== $svc logs ==="
147+
docker compose -f selur-compose.yml logs "$svc" --tail=50 || true
148+
done
149+
150+
- name: Stop services
151+
if: always()
152+
run: docker compose -f selur-compose.yml down --remove-orphans --volumes

‎.machine_readable/6a2/STATE.a2ml‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ status = "first-class system active"
1010

1111
[project-context]
1212
name = "odds-and-sods-package-manager"
13-
completion-percentage = 98
14-
phase = "CRG-B achieved; trust pipeline E2E remaining"
13+
completion-percentage = 100
14+
phase = "session complete — CRG-B + trust pipeline E2E done"
1515

1616
[testing]
1717
status = "COMPLETE"
@@ -158,6 +158,19 @@ evidence-file = "READINESS.md"
158158
- Fuzz harness: 14 properties in test/opsm/fuzz_harness_test.exs ✅
159159
- glib Dependabot alert: moot (Tauri deleted) ✅
160160

161+
[completed-2026-04-25g]
162+
- Trust pipeline live-service E2E test: test/integration/trust_pipeline_live_e2e_test.exs ✅
163+
- 23 tests across 7 describes: health (5), attestation (4), checky-monkey (4),
164+
palimpsest (5), cicd-hyper-a (4), oikos (2), full pipeline (3)
165+
- Direct HTTP via Req (no Opsm.Clients.* wrapper) — tests real HTTP contract
166+
- @moduletag :live_service excluded from default run; included in trust-pipeline-e2e.yml
167+
- :live_service added to test_helper.exs exclusion list
168+
- .github/workflows/trust-pipeline-e2e.yml ✅
169+
- Triggers: workflow_dispatch + push to main on service/test/compose changes
170+
- SHA-pinned actions: checkout (v6.0.2), erlef/setup-beam, actions/cache (v4)
171+
- docker compose up -d claim-forge checky-monkey palimpsest cicd-hyper-a oikos
172+
- Health poll loop (180s deadline, 3s interval) before running tests
173+
- Full diagnostics (service logs) on failure; docker compose down always
174+
161175
[next-actions]
162-
- Enterprise trust pipeline live-service E2E: real tests + selur-compose CI workflow
163176
- Grade A: requires external user confirmation outside hyperpolymath

0 commit comments

Comments
 (0)