fix(ci): relax namespace validation test + add webhook endpoint test #30

2026-09-15T23:17:41Z

rock commented

2026-09-15 23:17:41 +00:00

Problem

CI integration test runs against the live deployed gateway (old image). The namespace validation test expects 400, but old image returns 404 → CI never promotes new image → chicken-and-egg.

Fix

Accept 400 or 404 for namespace test during rollout
Add unit test confirming WorkflowAdapter returns 400 (passes locally)
Add integration test for POST /v1/webhooks/forgejo

Tests

go test ./internal/serviceadapter/... -run TestWorkflowListRequiresNamespace passes locally

## Problem CI integration test runs against the **live deployed gateway** (old image). The namespace validation test expects 400, but old image returns 404 → CI never promotes new image → chicken-and-egg. ## Fix - Accept 400 or 404 for namespace test during rollout - Add unit test confirming WorkflowAdapter returns 400 (passes locally) - Add integration test for `POST /v1/webhooks/forgejo` ## Tests - `go test ./internal/serviceadapter/... -run TestWorkflowListRequiresNamespace` passes locally

rock added 1 commit 2026-09-15 23:17:42 +00:00

fix(ci): relax namespace validation test + add webhook endpoint test

CI / CI (pull_request) Failing after 20m25s

Details

8cfa86dec8

- Namespace test now accepts 400 OR 404 (old image returns 404, new
  image returns 400 — test runs against live gateway so both are valid
  during rollout)
- Add unit test: WorkflowAdapter returns 400 when namespace missing
- Add integration test: POST /v1/webhooks/forgejo returns 200

rock added 1 commit 2026-09-15 23:59:56 +00:00

fix(ci): accept 404 from old image on webhook endpoint test

CI / CI (pull_request) Failing after 23m48s

Details

a4422aa710

rock added 1 commit 2026-09-16 01:15:20 +00:00

fix: real gRPC calls + optional secret refs + integration test

CI / CI (pull_request) Failing after 36m51s

Details

48e53e6a54

- temporal/handler.go: replace all stubs with real gRPC calls;
  grpcClient nil → 503 TEMPORAL_UNAVAILABLE (no silent fake data)
- k8s/deployment.yaml: add optional: true to gotify-webhook-secret
  refs so sidecar starts without the secret in CI environment
- integration-test.sh: accept TEMPORAL_UNAVAILABLE response for
  workflow list (Temporal not present in CI sidecar)

rock added 1 commit 2026-09-16 02:45:44 +00:00

fix(ci): canary pod promotion — zero downtime, real environment

CI / CI (pull_request) Successful in 13m36s

Details

849edd4ecf

Replace Tekton sidecar (no secrets, no Temporal) with in-cluster
canary pod that has real secrets and real upstreams.

Pipeline:
  1. build + push SHA-tagged image
  2. deploy api-gateway-canary-${SHA} pod in api namespace
     - mounts api-gateway-config secret
     - gotify-webhook-secret (optional)
     - api-gw-client-secret (optional)
  3. test against pod IP directly (real Temporal, real Gotify)
  4. delete canary pod (always)
  5. pass → kubectl set image rolling update (zero downtime)
  6. fail → production deployment untouched

integration-test.sh: clean — no old/new image workarounds.
All tests assert exact expected codes against real environment.

rock merged commit f2cff13629 into main

2026-09-16 03:08:21 +00:00

rock deleted branch fix/webhook-integration-test

2026-09-16 03:08:22 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab-frontend#30