| 1 | name: Live test |
| 2 | |
| 3 | # End-to-end checks against the real diffinery.com after each deploy: hosted |
| 4 | # Actions jobs in Cloudflare Containers (with Docker builds and services), agent sandboxes, webhooks, scheduled |
| 5 | # workflows and Git LFS. Each run works in a throwaway private repository that it |
| 6 | # deletes at the end. |
| 7 | # |
| 8 | # Needs the repository secret DIFFINERY_LIVE_TOKEN: a Diffinery token (Settings -> |
| 9 | # Tokens) with the admin scope and access to all repositories. |
| 10 | on: |
| 11 | workflow_dispatch: |
| 12 | workflow_run: |
| 13 | workflows: [Deploy] |
| 14 | types: [completed] |
| 15 | branches: [main] |
| 16 | |
| 17 | permissions: |
| 18 | contents: read |
| 19 | |
| 20 | concurrency: |
| 21 | group: live-test |
| 22 | cancel-in-progress: false |
| 23 | |
| 24 | jobs: |
| 25 | live: |
| 26 | name: Containers, sandboxes, webhooks, schedules and LFS |
| 27 | # Runs on the host that deploys production (see the gate in deploy.yml). |
| 28 | if: ${{ github.event_name == 'workflow_dispatch' || (github.server_url == 'https://diffinery.com' && github.event.workflow_run.conclusion == 'success') }} |
| 29 | runs-on: ubuntu-latest |
| 30 | timeout-minutes: 30 |
| 31 | env: |
| 32 | DIFFINERY: https://diffinery.com |
| 33 | TOKEN: ${{ secrets.DIFFINERY_LIVE_TOKEN }} |
| 34 | REPO: live-${{ github.run_id }}-${{ github.run_attempt }} |
| 35 | steps: |
| 36 | - name: Check the token |
| 37 | id: token |
| 38 | run: | |
| 39 | if [ -z "$TOKEN" ]; then |
| 40 | echo "::warning::DIFFINERY_LIVE_TOKEN is not set, so the live test is skipped. Create an admin token at $DIFFINERY/settings/tokens and save it as a repository secret." |
| 41 | echo "skip=true" >> "$GITHUB_OUTPUT" |
| 42 | exit 0 |
| 43 | fi |
| 44 | login=$(curl -fsS "$DIFFINERY/api/v3/user" -H "Authorization: Bearer $TOKEN" | jq -r .login) |
| 45 | echo "OWNER=$login" >> "$GITHUB_ENV" |
| 46 | echo "testing as $login in $login/$REPO" |
| 47 | |
| 48 | - name: Create a throwaway repository with a webhook |
| 49 | if: steps.token.outputs.skip != 'true' |
| 50 | run: | |
| 51 | set -euo pipefail |
| 52 | api() { curl -fsS -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; } |
| 53 | api POST /user/repos "{\"name\":\"$REPO\",\"private\":true}" >/dev/null |
| 54 | api POST "/repos/$OWNER/$REPO/hooks" "{\"config\":{\"url\":\"$DIFFINERY/healthz\"},\"events\":[\"push\"]}" >/dev/null |
| 55 | echo "created $OWNER/$REPO" |
| 56 | |
| 57 | - name: Push workflows and an LFS file |
| 58 | if: steps.token.outputs.skip != 'true' |
| 59 | run: | |
| 60 | set -euo pipefail |
| 61 | mkdir -p src/.github/workflows && cd src |
| 62 | git init -q -b main |
| 63 | git config user.name "Live test" && git config user.email "live-test@diffinery.com" |
| 64 | git lfs install --local >/dev/null |
| 65 | git lfs track "*.bin" >/dev/null |
| 66 | head -c 3145728 /dev/urandom > blob.bin |
| 67 | sha256sum blob.bin | cut -d' ' -f1 > ../blob.sha |
| 68 | echo "# $REPO" > README.md |
| 69 | cat > .github/workflows/ci.yml <<'EOF' |
| 70 | on: push |
| 71 | jobs: |
| 72 | hosted: |
| 73 | runs-on: ubuntu-latest |
| 74 | strategy: |
| 75 | matrix: |
| 76 | n: [1, 2] |
| 77 | steps: |
| 78 | - uses: actions/checkout@v4 |
| 79 | - run: echo "live ok ${{ '${{' }} matrix.n }} $(cat README.md)" |
| 80 | docker: |
| 81 | runs-on: ubuntu-latest |
| 82 | services: |
| 83 | cache: |
| 84 | image: redis:7-alpine |
| 85 | ports: ["6379"] |
| 86 | options: --health-cmd "redis-cli ping" --health-interval 1s --health-retries 30 |
| 87 | steps: |
| 88 | - run: | |
| 89 | printf 'FROM alpine:3.20\nRUN echo built > /msg\nCMD ["cat", "/msg"]\n' > Dockerfile |
| 90 | docker build -q -t live-image . |
| 91 | echo "docker ok $(docker run --rm live-image)" |
| 92 | exec 3<>/dev/tcp/127.0.0.1/${{ '${{' }} job.services.cache.ports['6379'] }} |
| 93 | printf 'PING\r\n' >&3 |
| 94 | read -r line <&3 |
| 95 | echo "service ok ${line%$'\r'}" |
| 96 | EOF |
| 97 | cat > .github/workflows/tick.yml <<'EOF' |
| 98 | on: |
| 99 | schedule: |
| 100 | - cron: "*/5 * * * *" |
| 101 | jobs: |
| 102 | tick: |
| 103 | runs-on: ubuntu-latest |
| 104 | steps: |
| 105 | - run: echo "scheduled ok" |
| 106 | EOF |
| 107 | git add -A && git commit -q -m "Live test" |
| 108 | git push -q "https://x-token:${TOKEN}@${DIFFINERY#https://}/$OWNER/$REPO.git" main |
| 109 | git lfs ls-files |
| 110 | |
| 111 | - name: Hosted Actions jobs (and Docker) run in Cloudflare Containers |
| 112 | if: steps.token.outputs.skip != 'true' |
| 113 | run: | |
| 114 | set -euo pipefail |
| 115 | api() { curl -fsS "$DIFFINERY/api/v3$1" -H "Authorization: Bearer $TOKEN"; } |
| 116 | for i in $(seq 1 90); do |
| 117 | run=$(api "/repos/$OWNER/$REPO/actions/runs?event=push" | jq -c '.workflow_runs[0] // empty') |
| 118 | [ -n "$run" ] && [ "$(jq -r .status <<<"$run")" = completed ] && break |
| 119 | sleep 10 |
| 120 | done |
| 121 | echo "$run" | jq '{id, status, conclusion}' |
| 122 | [ "$(jq -r .conclusion <<<"$run")" = success ] || { echo "::error::the push run did not succeed"; exit 1; } |
| 123 | id=$(jq -r .id <<<"$run") |
| 124 | jobs=$(api "/repos/$OWNER/$REPO/actions/runs/$id/jobs") |
| 125 | for job in $(jq -r '.jobs[] | select(.name | startswith("hosted")) | .id' <<<"$jobs"); do |
| 126 | log=$(api "/repos/$OWNER/$REPO/actions/jobs/$job/logs") |
| 127 | grep -F "live ok" <<<"$log" | grep -F "# $REPO" || { echo "::error::job $job did not print its line (checkout or run step failed)"; exit 1; } |
| 128 | done |
| 129 | job=$(jq -r '.jobs[] | select(.name == "docker") | .id' <<<"$jobs") |
| 130 | log=$(api "/repos/$OWNER/$REPO/actions/jobs/$job/logs") |
| 131 | grep -F "docker ok built" <<<"$log" || { echo "::error::docker build or run failed on a hosted runner"; exit 1; } |
| 132 | grep -F "service ok +PONG" <<<"$log" || { echo "::error::the redis service container was not reachable"; exit 1; } |
| 133 | |
| 134 | - name: Git LFS round trip |
| 135 | if: steps.token.outputs.skip != 'true' |
| 136 | run: | |
| 137 | set -euo pipefail |
| 138 | git clone -q "https://x-token:${TOKEN}@${DIFFINERY#https://}/$OWNER/$REPO.git" clone |
| 139 | [ "$(sha256sum clone/blob.bin | cut -d' ' -f1)" = "$(cat blob.sha)" ] || { echo "::error::the LFS file came back different"; exit 1; } |
| 140 | echo "LFS file matches ($(stat -c %s clone/blob.bin) bytes)" |
| 141 | |
| 142 | - name: Webhook delivered |
| 143 | if: steps.token.outputs.skip != 'true' |
| 144 | run: | |
| 145 | set -euo pipefail |
| 146 | for i in $(seq 1 30); do |
| 147 | hook=$(curl -fsS "$DIFFINERY/api/v3/repos/$OWNER/$REPO/hooks" -H "Authorization: Bearer $TOKEN" | jq -c '.[0]') |
| 148 | [ "$(jq -r '.lastDeliveryAt // empty' <<<"$hook")" != "" ] && break |
| 149 | sleep 5 |
| 150 | done |
| 151 | echo "$hook" | jq '{url, lastStatus, lastDeliveryAt}' |
| 152 | [ "$(jq -r '.lastDeliveryAt // empty' <<<"$hook")" != "" ] || { echo "::error::the push webhook was never delivered"; exit 1; } |
| 153 | |
| 154 | - name: Agent sandbox |
| 155 | if: steps.token.outputs.skip != 'true' |
| 156 | run: | |
| 157 | set -euo pipefail |
| 158 | base="$DIFFINERY/api/v3/repos/$OWNER/$REPO/diffinery/sandboxes" |
| 159 | id=$(curl -fsS -X POST "$base" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{}' | jq -r .id) |
| 160 | echo "sandbox $id" |
| 161 | for i in $(seq 1 40); do |
| 162 | out=$(curl -sS -X POST "$base/$id/exec" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{"cmd":"cat README.md && git lfs ls-files | wc -l"}' || true) |
| 163 | jq -e '.exitCode == 0' >/dev/null 2>&1 <<<"$out" && break |
| 164 | sleep 6 |
| 165 | done |
| 166 | echo "$out" | jq '{exitCode, stdout}' |
| 167 | curl -sS -X POST "$base/$id/close" -H "Authorization: Bearer $TOKEN" >/dev/null || true |
| 168 | jq -e --arg r "# $REPO" '.exitCode == 0 and (.stdout | contains($r))' >/dev/null <<<"$out" || { echo "::error::the sandbox did not run the command in the repository"; exit 1; } |
| 169 | |
| 170 | - name: Scheduled workflow |
| 171 | if: steps.token.outputs.skip != 'true' |
| 172 | run: | |
| 173 | set -euo pipefail |
| 174 | # The cron trigger fires every 5 minutes, so allow two windows. |
| 175 | for i in $(seq 1 75); do |
| 176 | run=$(curl -fsS "$DIFFINERY/api/v3/repos/$OWNER/$REPO/actions/runs?event=schedule" -H "Authorization: Bearer $TOKEN" | jq -c '.workflow_runs[0] // empty') |
| 177 | [ -n "$run" ] && [ "$(jq -r .status <<<"$run")" = completed ] && break |
| 178 | sleep 10 |
| 179 | done |
| 180 | [ -n "$run" ] || { echo "::error::no scheduled run started"; exit 1; } |
| 181 | echo "$run" | jq '{id, event, status, conclusion}' |
| 182 | [ "$(jq -r .conclusion <<<"$run")" = success ] || { echo "::error::the scheduled run did not succeed"; exit 1; } |
| 183 | |
| 184 | - name: Delete the throwaway repository |
| 185 | if: always() && steps.token.outputs.skip != 'true' |
| 186 | run: | |
| 187 | curl -sS -o /dev/null -w '%{http_code}\n' -X DELETE "$DIFFINERY/api/v3/repos/$OWNER/$REPO" -H "Authorization: Bearer $TOKEN" |