integration-tests.yaml

name: Integration Tests

# ==============================================================================
# Integration Testing Workflow
# ==============================================================================
#
# PURPOSE:
#   Run integration tests that validate infrastructure interactions
#   using isolated test infrastructure (docker-compose.test.yml)
#
# WHEN TO RUN:
#   - On pull requests to main/develop
#   - On push to main/develop
#   - Manual workflow dispatch
#
# TEST INFRASTRUCTURE:
#   - Isolated services on offset ports (9000+ range)
#   - PostgreSQL (9432), Redis (9379, 9380), OpenFGA (9080), Keycloak (9082), Qdrant (9333)
#   - Ephemeral storage (tmpfs) for speed
#   - No conflicts with development environment
#
# PARALLELIZATION:
#   - Uses pytest-xdist for parallel test execution within each job
#   - Matrix strategy with test categories for faster execution
#   - Replaced pytest-split (2025-11-28) to enable pytest 9.x upgrade
#
# ==============================================================================

on:
  push:
    branches: [main, develop]
    paths-ignore:
      - 'docs/**'
      - '**.md'
      - '**.mdx'
      - 'adr/**'
  pull_request:
    branches: [main, develop]
    paths-ignore:
      - 'docs/**'
      - '**.md'
      - '**.mdx'
      - 'adr/**'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read
  pull-requests: write
  id-token: write  # Required for Workload Identity Federation with Vertex AI

env:
  # Prevent BlockingIOError when capturing large test output
  PYTHONUNBUFFERED: "1"

jobs:
  # ============================================================================
  # Integration Tests with Test Infrastructure
  # ============================================================================

  integration-tests:
    name: Integration Py${{ matrix.python-version }} (${{ matrix.test-category }})
    runs-on: ubuntu-latest
    timeout-minutes: 30

    strategy:
      fail-fast: false
      matrix:
        # PRs: Only test on 3.12 for fast feedback (~10 min savings)
        # Push to main/develop: Full matrix for compatibility validation
        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["3.12"]') || fromJSON('["3.11", "3.12", "3.13"]') }}
        # Matrix strategy with test categories for parallel execution
        # Each category runs its tests with pytest-xdist for intra-job parallelism
        # This replaces pytest-split (2025-11-28) to enable pytest 9.x upgrade
        test-category: [auth, api, database, infrastructure]
        include:
          - test-category: auth
            markers: "integration and auth"
            label: "auth"
          - test-category: api
            markers: "integration and api"
            label: "api"
          - test-category: database
            markers: "integration and (database or gdpr)"
            label: "database"
          - test-category: infrastructure
            # Exclude deployment tests - they require Helm CLI and dependencies
            # Helm template tests run in ci.yaml which has proper Helm setup
            markers: "integration and not auth and not api and not database and not gdpr and not deployment"
            label: "infra"

    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Set up Python and dependencies
      uses: ./.github/actions/setup-python-deps
      with:
        python-version: ${{ matrix.python-version }}
        extras: 'dev'

    - name: Run Integration Tests via Script (${{ matrix.test-category }})
      run: |
        # Use the orchestration script to manage infrastructure and execution
        # This ensures 100% parity between local and CI execution
        # Passing arguments after '--' injects them into the pytest command
        # Generate both .coverage file (for combining) and XML (for upload)
        # Using pytest-xdist (-n auto) for parallel execution within this category
        ./scripts/test-integration.sh -- \
          -n auto \
          --dist loadgroup \
          -m "${{ matrix.markers }}" \
          -v --tb=short \
          --cov=src/mcp_server_langgraph \
          --cov-report=xml:coverage-integration-${{ matrix.label }}.xml \
          --cov-fail-under=0

        # Rename .coverage to include category for combining
        if [ -f .coverage ]; then
          mv .coverage .coverage.${{ matrix.label }}
        fi

    - name: Upload integration coverage artifact
      if: always() && matrix.python-version == '3.12'
      uses: actions/upload-artifact@v5
      with:
        name: coverage-integration-${{ matrix.label }}-py${{ matrix.python-version }}
        path: |
          coverage-integration-${{ matrix.label }}.xml
          .coverage.${{ matrix.label }}
        retention-days: 1

    - name: Cleanup infrastructure
      if: always()
      run: |
        echo "Ensuring infrastructure cleanup..."
        docker compose -f docker-compose.test.yml down -v || true
        echo "✓ Cleanup complete"

  # ============================================================================
  # Merge Coverage Reports
  # ============================================================================

  merge-coverage:
    name: Merge Integration Coverage
    runs-on: ubuntu-latest
    needs: integration-tests
    if: always()

    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Set up Python and dependencies
      uses: ./.github/actions/setup-python-deps
      with:
        python-version: '3.12'
        extras: 'dev'

    - name: Download all coverage artifacts
      uses: actions/download-artifact@v6
      with:
        pattern: coverage-integration-*-py3.12
        path: coverage-reports/
        merge-multiple: true

    - name: List downloaded artifacts
      run: |
        echo "=== Downloaded coverage artifacts ==="
        find coverage-reports/ -type f || echo "No files found"

    - name: Combine coverage reports
      run: |
        echo "Combining coverage reports from all splits..."

        # Find and move .coverage.* files to current directory for combining
        find coverage-reports/ -name '.coverage.*' -exec cp {} . \; 2>/dev/null || true

        # List what we have to combine
        echo "=== Coverage files to combine ==="
        ls -la .coverage.* 2>/dev/null || echo "No .coverage files found"

        # Combine .coverage files (coverage combine looks for .coverage.* pattern)
        if ls .coverage.* 1> /dev/null 2>&1; then
          coverage combine
          echo "✅ Combined coverage data successfully"

          # Generate reports from combined data
          coverage xml -o coverage-integration-combined.xml
          coverage report --skip-covered || echo "Coverage report generated"
        else
          echo "⚠️  No .coverage files to combine"
          echo "Creating empty coverage file for downstream steps"
          # Create minimal valid .coverage file
          echo '{"format": "none"}' > .coverage
          # Create minimal valid coverage XML (using echo to avoid YAML linting issues with heredoc)
          echo '<?xml version="1.0" encoding="UTF-8"?>' > coverage-integration-combined.xml
          echo '<coverage version="7.0" timestamp="0" lines-valid="0" lines-covered="0" line-rate="0" branches-covered="0" branches-valid="0" branch-rate="0" complexity="0">' >> coverage-integration-combined.xml
          echo '  <packages/>' >> coverage-integration-combined.xml
          echo '</coverage>' >> coverage-integration-combined.xml
        fi

    - name: Upload combined coverage
      if: always()
      uses: actions/upload-artifact@v5
      with:
        name: coverage-integration-combined
        path: |
          coverage-integration-combined.xml
          .coverage
        retention-days: 7

    - name: Comment coverage on PR
      if: github.event_name == 'pull_request' && always()
      uses: py-cov-action/python-coverage-comment-action@v3
      with:
        GITHUB_TOKEN: ${{ github.token }}
        COVERAGE_DATA_BRANCH: coverage-data-integration
        MINIMUM_GREEN: 80
        MINIMUM_ORANGE: 70
      continue-on-error: true  # Don't fail PR if coverage comment fails

  # ============================================================================
  # Vertex AI Integration Tests (Claude + Gemini via Workload Identity Federation)
  # ============================================================================
  # These tests require GCP Workload Identity Federation to access Vertex AI APIs.
  # They only run on the main repository (not forks) due to secret requirements.
  # Uses keyless authentication via google-github-actions/auth@v3.

  vertex-ai-tests:
    name: Integration Tests (Vertex AI)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # Only run on main repository (forks don't have access to GCP secrets)
    if: github.repository == 'vishnu2kmohan/mcp-server-langgraph'

    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Authenticate to Google Cloud (Workload Identity Federation)
      uses: google-github-actions/auth@v3
      with:
        workload_identity_provider: ${{ secrets.GCP_WIF_PROVIDER }}
        service_account: ${{ secrets.GCP_VERTEX_AI_SA_EMAIL }}
        token_format: access_token

    - name: Set up Python and dependencies
      uses: ./.github/actions/setup-python-deps
      with:
        python-version: '3.12'
        extras: 'dev cloud'

    - name: Run Vertex AI Integration Tests
      env:
        # Vertex AI configuration for Anthropic Claude models
        VERTEX_PROJECT: ${{ vars.GCP_PROJECT_ID }}
        VERTEX_LOCATION: us-east5
        CLOUD_ML_REGION: us-east5
        ANTHROPIC_VERTEX_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
        # Vertex AI configuration for Google Gemini models
        GOOGLE_CLOUD_PROJECT: ${{ vars.GCP_PROJECT_ID }}
        GOOGLE_CLOUD_LOCATION: global
        # Enable Vertex AI mode (uses WIF instead of API keys)
        CLAUDE_CODE_USE_VERTEX: "1"
      run: |
        echo "🤖 Running Vertex AI integration tests..."
        echo "   Project: $VERTEX_PROJECT"
        echo "   Claude Region: $CLOUD_ML_REGION"
        echo "   Gemini Region: $GOOGLE_CLOUD_LOCATION"

        # Run tests with vertex_ai marker
        uv run --frozen pytest tests/integration/test_vertex_ai_anthropic.py \
          tests/integration/test_vertex_ai_google.py \
          tests/integration/test_vertex_ai_auth_methods.py \
          -v --tb=short \
          -x \
          --timeout=120

        echo "✅ Vertex AI tests completed"