test_local_integration.yaml

name: "Local Integration Tests"

env:
  TEST_USERNAME: "test-user"
  TEST_PASSWORD: "P@sswo3d"
  NEBARI_IMAGE_TAG: "main"
  PYTHON_VERSION: "3.11"

on:
  pull_request:
    paths:
      - ".github/workflows/test_local_integration.yaml"
      - "tests/**"
      - "scripts/**"
      - "src/**"
      - "pyproject.toml"
      - "pytest.ini"
      - ".cirun.yml"
  push:
    branches:
      - main
      - release/\d{4}.\d{1,2}.\d{1,2}
    paths:
      - ".github/workflows/test_local_integration.yaml"
      - "tests/**"
      - "scripts/**"
      - "src/**"
      - "pyproject.toml"
      - "pytest.ini"
      - ".cirun.yml"
  workflow_call:
    inputs:
      pr_number:
        required: true
        type: string
  workflow_dispatch:

# When the cancel-in-progress: true option is specified, any concurrent jobs or workflows using the same
# concurrency group will cancel both the pending and currently running jobs or workflows. This allows only
# one job or workflow in the concurrency group to be in progress at a time.
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  test-local-integration:
    runs-on: "cirun-runner--${{ github.run_id }}"
    defaults:
      run:
        shell: bash -l {0}
    steps:
      - name: "Checkout Infrastructure"
        uses: actions/checkout@main
        with:
          fetch-depth: 0

      - name: Setup runner for local deployment
        uses: ./.github/actions/setup-local

      - name: Checkout the branch from the PR that triggered the job
        if: ${{ github.event_name == 'issue_comment' }}
        run: |
          hub version
          hub pr checkout ${{ inputs.pr_number }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Python
        uses: conda-incubator/setup-miniconda@v3
        env:
          CONDA: /home/runnerx/miniconda3
        with:
          auto-update-conda: true
          python-version: ${{ env.PYTHON_VERSION }}
          miniconda-version: "latest"

      - name: Install JQ
        run: |
          sudo apt-get update
          sudo apt-get install jq -y

      - name: Install Nebari and playwright
        run: |
          pip install .[dev]
          playwright install

      - name: Initialize Nebari config for local deployment
        id: init
        uses: ./.github/actions/init-local

      - name: Deploy Nebari
        working-directory: ${{ steps.init.outputs.directory }}
        run: nebari deploy --config ${{ steps.init.outputs.config }} --disable-prompt

      - name: Health check
        uses: ./.github/actions/health-check
        with:
          domain: ${{ steps.init.outputs.domain }}

      - name: Create example-user
        working-directory: ${{ steps.init.outputs.directory }}
        run: |
          nebari keycloak adduser --user "${TEST_USERNAME}" "${TEST_PASSWORD}" --config ${{ steps.init.outputs.config }}
          nebari keycloak listusers --config ${{ steps.init.outputs.config }}

      - name: Await Workloads
        uses: jupyterhub/action-k8s-await-workloads@v3
        with:
          workloads: "" # all
          namespace: "dev"
          timeout: 300
          max-restarts: 3

      ### DEPLOYMENT TESTS
      - name: Deployment Pytests
        env:
          NEBARI_CONFIG_PATH: ${{ steps.init.outputs.config }}
          KEYCLOAK_USERNAME: ${{ env.TEST_USERNAME }}
          KEYCLOAK_PASSWORD: ${{ env.TEST_PASSWORD }}
        run: |
          pytest tests/tests_deployment/ -v -s

      ### USER-JOURNEY TESTS
      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Playwright Tests
        env:
          KEYCLOAK_USERNAME: ${{ env.TEST_USERNAME }}
          KEYCLOAK_PASSWORD: ${{ env.TEST_PASSWORD }}
          NEBARI_FULL_URL: "https://${{ steps.init.outputs.domain }}/"
        working-directory: tests/tests_e2e/playwright
        run: |
          # create environment file
          envsubst < .env.tpl > .env
          # run playwright pytest tests in headed mode with the chromium browser
          xvfb-run pytest --browser chromium --slowmo 300 --headed

      - name: Save Playwright recording artifacts
        if: always()
        uses: actions/upload-artifact@v4.3.1
        with:
          name: e2e-playwright
          path: |
            ./tests/tests_e2e/playwright/videos/

      ### CONDA-STORE TESTS
      - name: "Checkout conda-store"
        uses: actions/checkout@main
        with:
          fetch-depth: 0
          repository: conda-incubator/conda-store
          ref: main
          path: conda-store

      - name: "Set up conda-store conda env"
        uses: conda-incubator/setup-miniconda@v3
        env:
          CONDA: /home/runnerx/miniconda3
        with:
            environment-file: conda-store/conda-store-server/environment-dev.yaml
            miniforge-version: latest
            auto-activate-base: false
            activate-environment: conda-store-server-dev
            python-version: ${{ env.PYTHON_VERSION }}
            conda-remove-defaults: "true"

      - name: Install conda-store dependencies
        run: |
          which python
          # install conda-store-server
          python -m pip install conda-store/conda-store-server

      - name: Get conda-store token from login
        id: conda-store-token
        env:
          KEYCLOAK_USERNAME: ${{ env.TEST_USERNAME }}
          KEYCLOAK_PASSWORD: ${{ env.TEST_PASSWORD }}
          CONDA_STORE_BASE_URL: https://${{ steps.init.outputs.domain }}
        working-directory: ${{ steps.init.outputs.directory }}
        run: |
          LOGIN_URL=$(curl -c /tmp/nebari-session --insecure -Ls   ${CONDA_STORE_BASE_URL}/conda-store/login/\?next= | grep auth/realms/nebari/login-actions/authenticate | grep -oP 'action="([^"]+)"')
          curl -X POST --insecure -b /tmp/nebari-session -H "Content-Type: application/x-www-form-urlencoded"  -vv --data '{"credentialId":"", "username": "${KEYCLOAK_USERNAME}", "password": "${KEYCLOAK_PASSWORD}"}' $LOGIN_URL
          echo "CONDA_STORE_TOKEN=$(curl --insecure -L -X POST -b /tmp/conda-store-cookie ${CONDA_STORE_BASE_URL}/conda-store/api/v1/token | jq --raw-output .data.token)" >> "$GITHUB_OUTPUT"

      - name: Run conda-store-server user_journey tests
        env:
          NEBARI_CONFIG_PATH: ${{ steps.init.outputs.config }}
          KEYCLOAK_USERNAME: ${{ env.TEST_USERNAME }}
          KEYCLOAK_PASSWORD: ${{ env.TEST_PASSWORD }}
          CONDA_STORE_BASE_URL: https://${{ steps.init.outputs.domain }}
          CONDA_STORE_TEST_VERIFY_SSL: 0
          CONDA_STORE_TOKEN: ${{ steps.conda-store-token.outputs.CONDA_STORE_TOKEN }}
        run: |
          curl --insecure --header "Authorization: Bearer ${CONDA_STORE_TOKEN}" ${CONDA_STORE_BASE_URL}/conda-store/api/v1/permission/ | jq
          cd conda-store/conda-store-server
          python -m pytest -m "user_journey"

      - name: Get conda-store-server logs
        if: ${{ failure() }}
        run: |
          kubectl logs -n dev deployment/nebari-conda-store-server

      ### CLEANUP AFTER TESTS
      - name: Cleanup nebari deployment
        # Since this is not critical for most pull requests and takes more than half of the time
        # in the CI, it makes sense to only run on merge to main or workflow_dispatch to speed
        # up feedback cycle
        if: github.ref_name == 'main' || github.event_name == 'workflow_dispatch'
        working-directory: ${{ steps.init.outputs.directory }}
        run: nebari destroy --config ${{ steps.init.outputs.config }} --disable-prompt