oncall-engine/.github/workflows/e2e-tests.yml
Matthew Thorning a991fac43e
chore: update gh workflows with zizmor suggested fixes (#5523)
This pull request updates multiple GitHub Actions workflows to improve
security, stability, and functionality. The most notable changes include
pinning action versions to specific commit SHAs, adding validation for
branch names, and updating dependencies and configurations.

### Security Improvements:
* Added `persist-credentials: false` to `actions/checkout` steps in
`.github/workflows/build-engine-docker-image-and-publish-to-dockerhub.yml`
and `.github/workflows/e2e-tests.yml` to reduce the risk of unauthorized
access to credentials.
[[1]](diffhunk://#diff-f87667d48e22abfbbccf3695a8acc386143e3542286f432e6e3d8330960c76f9R29)
[[2]](diffhunk://#diff-194218c48b9a0cdd03974145733804c2d992ca818529fe2fa69a501d8b5b1cc3R48-R59)
* Validated branch names against a safe pattern in
`.github/workflows/linting-and-tests.yml` to prevent potential misuse of
branch names in subsequent steps.

### Stability Enhancements:
* Pinned all third-party GitHub Actions to specific commit SHAs across
various workflows to ensure consistent and predictable behavior.
Examples include
`grafana/shared-workflows/actions/build-push-to-dockerhub`,
`catchpoint/workflow-telemetry-action`, and
`actions-ecosystem/action-remove-labels`.
[[1]](diffhunk://#diff-f87667d48e22abfbbccf3695a8acc386143e3542286f432e6e3d8330960c76f9L37-R38)
[[2]](diffhunk://#diff-194218c48b9a0cdd03974145733804c2d992ca818529fe2fa69a501d8b5b1cc3R48-R59)
[[3]](diffhunk://#diff-f93a3de9563193d65121683e6383741ac4b6aa18bdb51ba82b80497e700561cdL15-R15)
* Updated Helm-related actions in
`.github/workflows/linting-and-tests.yml` and
`.github/workflows/on-release-published.yml` to specific SHAs for better
reliability.
[[1]](diffhunk://#diff-a70d3d29c45894eeef2036c533385dbc424f9479590aaea01e62c06dc67079a1L147-R170)
[[2]](diffhunk://#diff-e95a5d3f03a1351728732657b6b150cfbbd9a9724b387226b1f99f079b1954b0L91-R91)

### Functional Updates:
* Enhanced `.github/workflows/linting-and-tests.yml` by using validated
branch references in Git commands to avoid errors caused by unsafe
branch names.
* Updated `snyk/actions/setup` in
`.github/workflows/snyk-security-scan.yml` to a specific SHA for
improved compatibility and security.

These changes collectively enhance the security, reliability, and
maintainability of the workflows.
2025-05-01 08:56:34 -04:00

199 lines
7 KiB
YAML

name: e2e tests
on:
workflow_call:
inputs:
grafana_version:
required: true
type: string
browsers:
required: true
type: string
run-expensive-tests:
description: >
Whether or not to run Playwright tests that're annotated as "@expensive"
(ex. tests that incur costs such as sending SMSes via Twilio/Mailslurp)
required: true
type: boolean
secrets:
# NOTE: these are only required for the "expensive" e2e tests, which are only run via
# a daily GitHub Actions cron job (see .github/workflows/daily-e2e-tests.yml)
TWILIO_ACCOUNT_SID:
required: false
TWILIO_AUTH_TOKEN:
required: false
TWILIO_PHONE_NUMBER:
required: false
TWILIO_VERIFY_SID:
required: false
MAILSLURP_API_KEY:
required: false
jobs:
end-to-end-tests:
# default "ubuntu-latest" runners only provide 2 CPU cores + 7GB of RAM. this seems to lead to HTTP 504s from
# the oncall backend, and hence, flaky tests. Let's use CI runners w/ more resources to avoid this (plus
# this will allow us to run more backend containers and parralelize the tests)
runs-on: ubuntu-latest-16-cores
name: "Grafana: ${{ inputs.grafana_version }}"
environment:
name: github-pages
permissions:
id-token: write
pages: write
contents: read
steps:
- name: Checkout
uses: actions/checkout@v4
with:
persist-credentials: false
- name: Collect Workflow Telemetry
uses: catchpoint/workflow-telemetry-action@94c3c3d9567a0205de6da68a76c428ce4e769af1 #v2.0.0
with:
comment_on_pr: false
proc_trace_chart_show: false
proc_trace_table_show: false
- name: Install Kind
uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde #v1.10.0
with:
config: ./dev/kind.yml
install_only: true
- name: Install frontend dependencies
uses: ./.github/actions/install-frontend-dependencies
- name: Install Tilt
run: |
curl -fsSL https://raw.githubusercontent.com/tilt-dev/tilt/master/scripts/install.sh | bash
- name: Install ctlptl
run: |
CTLPTL_VERSION="0.8.20"
CTLPTL_FILE_NAME="ctlptl.$CTLPTL_VERSION.linux.x86_64.tar.gz"
curl -fsSL https://github.com/tilt-dev/ctlptl/releases/download/v$CTLPTL_VERSION/$CTLPTL_FILE_NAME | \
tar -xzv -C /usr/local/bin ctlptl
- name: Use cached plugin frontend build
id: cache-plugin-frontend
uses: actions/cache@v4
with:
path: grafana-plugin/dist
key: ${{ runner.os }}-plugin-frontend-${{ hashFiles('grafana-plugin/src/**/*', 'grafana-plugin/pnpm.lock') }}
- name: Build plugin frontend
if: steps.cache-plugin-frontend.outputs.cache-hit != 'true'
working-directory: grafana-plugin
run: pnpm build:dev
# helpful reference for properly caching the playwright binaries/dependencies
# https://playwrightsolutions.com/playwright-github-action-to-cache-the-browser-binaries/
- name: Get installed Playwright version
id: playwright-version
working-directory: grafana-plugin
run: >
echo "PLAYWRIGHT_VERSION=$(cat ./package.json |
jq -r '.devDependencies["@playwright/test"]')" >> $GITHUB_ENV
- name: Cache Playwright binaries/dependencies
id: playwright-cache
uses: actions/cache@v4
with:
path: "~/.cache/ms-playwright"
key: ${{ runner.os }}-playwright-${{ env.PLAYWRIGHT_VERSION }}-${{ inputs.browsers }}
- name: Create cluster
run: make cluster/up
- name: Install Playwright deps
shell: bash
working-directory: grafana-plugin
run: pnpm playwright install
# ---------- Expensive e2e tests steps start -----------
- name: Install Go
uses: actions/setup-go@v4
with:
go-version: "1.21.5"
- name: Install Mage
run: go install github.com/magefile/mage@v1.15.0
- name: Get Vault secrets
if: inputs.run-expensive-tests
id: get-secrets
uses: grafana/shared-workflows/actions/get-vault-secrets@b7d33d6a98dc9cf332674c6cdebe92b8bcb05670 #v0.3.0
with:
repo_secrets: |
GH_APP_ID=github-app:app-id
GH_APP_INSTALLATION_ID=github-app:app-installation-id
GH_APP_PRIVATE_KEY=github-app:private-key
- name: Generate Github App token
if: inputs.run-expensive-tests
id: generate-token
uses: actions/create-github-app-token@v1
with:
app-id: ${{ env.GH_APP_ID }}
private-key: ${{ env.GH_APP_PRIVATE_KEY }}
owner: grafana
repositories: "ops-devenv,gops-labels"
- name: Clone other repos needed for cross-plugin e2e tests
if: inputs.run-expensive-tests
shell: bash
run: |
cd ..
git clone https://x-access-token:${{ steps.generate-token.outputs.token }}@github.com/grafana/ops-devenv.git
git clone https://x-access-token:${{ steps.generate-token.outputs.token }}@github.com/grafana/gops-labels.git
- name: Tilt CI - Expensive E2E tests
if: inputs.run-expensive-tests
shell: bash
env:
E2E_TESTS_CMD: "cd ../../grafana-plugin && pnpm test:e2e-expensive"
GRAFANA_VERSION: ${{ inputs.grafana_version }}
GF_FEATURE_TOGGLES_ENABLE: "externalServiceAccounts"
ONCALL_API_URL: "http://oncall-dev-engine:8080"
GRAFANA_ADMIN_USERNAME: "irm"
GRAFANA_ADMIN_PASSWORD: "irm"
BROWSERS: ${{ inputs.browsers }}
MAILSLURP_API_KEY: ${{ secrets.MAILSLURP_API_KEY }}
TWILIO_ACCOUNT_SID: ${{ secrets.TWILIO_ACCOUNT_SID }}
TWILIO_AUTH_TOKEN: ${{ secrets.TWILIO_AUTH_TOKEN }}
# wrapping single quotes are required to prevent stripping leading "+" from the number
TWILIO_PHONE_NUMBER: '"${{ secrets.TWILIO_PHONE_NUMBER }}"'
TWILIO_VERIFY_SID: ${{ secrets.TWILIO_VERIFY_SID }}
run: cd ../ops-devenv && tilt ci gops-labels oncall
# ---------- Expensive e2e tests steps end -----------
- name: Tilt CI - standard E2E tests
shell: bash
env:
GRAFANA_VERSION: ${{ inputs.grafana_version }}
BROWSERS: ${{ inputs.browsers }}
run: tilt ci
- name: Setup Pages
if: failure()
uses: actions/configure-pages@v2
- name: Upload artifact
if: failure()
uses: actions/upload-pages-artifact@v3
with:
path: ./grafana-plugin/playwright-report/
- name: Deploy to GitHub Pages
if: failure()
id: deployment
uses: actions/deploy-pages@v3
with:
preview: true
- name: Linked Github Page
if: failure()
run: |
echo "Test report has been deployed to [GitHub Pages](https://grafana.github.io/oncall/) :rocket:" \
>> $GITHUB_STEP_SUMMARY