Files
poimen-memory/.gitea/workflows/integration-test.yaml
T
rock 6499dae6e5
CI / CI (pull_request) Successful in 16m41s
test: K8s Job-based integration testing with migrations
Add proper integration test infrastructure:

migrations/run_migrations.sh:
  - Database migration runner (used by K8s Job)
  - Applies all SQL migrations in order
  - Waits for DB to be ready
  - Verifies schema creation
  - Reports success/failure

k8s/test/integration-test-job.yaml:
  - Kubernetes Job manifest for E2E testing
  - Two-stage execution:
    1. migrate: Apply database migrations
    2. test: Run integration test against new pod
  - Uses new image SHA from CI build
  - Proper secret management via K8s secretKeyRef
    (passwords stored in cluster, not in manifests)
  - Resource limits and liveness probes
  - Cleanup after 1 hour (ttlSecondsAfterFinished)

.gitea/workflows/integration-test.yaml:
  - CI workflow that runs after image build
  - Validates image exists in registry
  - Deploys Job with correct image SHA
  - Waits for job completion (10 min timeout)
  - Collects pod logs on failure
  - Automatic cleanup

Security:
  • No plaintext credentials in manifests
  • Uses K8s secretKeyRef for DB password
  • All secrets encrypted with SOPS/Age (ArgoCD plugin)
  • Never embed credentials in git

Usage:
  - Automatic: Runs after each CI build on main
  - Manual: Trigger with specific image SHA via workflow_dispatch
  - Tests: Full E2E ingest + persistence + query

URGENT: Rotate memory-db-app password
  (was visible in debugging shell history)
2026-09-14 22:44:53 +09:00

134 lines
4.0 KiB
YAML

name: Integration Test
on:
workflow_run:
workflows: [CI]
types: [completed]
branches: [main]
workflow_dispatch:
inputs:
image_sha:
description: 'Image SHA to test (defaults to latest on main)'
required: false
env:
REGISTRY: forgejo.riotpiao.com
IMAGE: forgejo.riotpiao.com/riotpiao-poimen/poimen-memory
NAMESPACE: poimen
jobs:
integration-test:
name: K8s Integration Test
runs-on: rust
if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Get image SHA
id: image
run: |
if [ -n "${{ github.event.inputs.image_sha }}" ]; then
SHA="${{ github.event.inputs.image_sha }}"
else
SHA="$(git rev-parse --short HEAD)"
fi
echo "sha=$SHA" >> $GITHUB_OUTPUT
echo "Image SHA: $SHA"
- name: Install kubectl
run: |
apt-get update
apt-get install -y kubectl postgresql-client
- name: Setup kubeconfig
run: |
mkdir -p ~/.kube
echo "${{ secrets.KUBECONFIG_B64 }}" | base64 -d > ~/.kube/config
chmod 600 ~/.kube/config
# Verify cluster access
kubectl cluster-info
kubectl get nodes
- name: Verify image exists in registry
run: |
IMAGE="${{ env.IMAGE }}:${{ steps.image.outputs.sha }}"
echo "Checking if image exists: $IMAGE"
# Use registry API to verify image exists
if docker pull "$IMAGE" 2>/dev/null; then
echo "✓ Image found in registry"
else
echo "✗ Image not found"
exit 1
fi
env:
DOCKER_CONFIG: /tmp/docker
continue-on-error: true
- name: Apply integration test Job
run: |
IMAGE_SHA="${{ steps.image.outputs.sha }}"
echo "Creating integration test Job with image: $IMAGE_SHA"
echo ""
# Substitute image SHA in manifest
cat k8s/test/integration-test-job.yaml | \
sed "s|IMAGE_SHA|$IMAGE_SHA|g" | \
kubectl apply -f - -n ${{ env.NAMESPACE }}
echo "✓ Job submitted"
echo ""
# Wait for job to complete
kubectl wait --for=condition=complete job/poimen-memory-integration-test \
-n ${{ env.NAMESPACE }} \
--timeout=600s || {
echo ""
echo "✗ Job did not complete in time"
echo ""
echo "Pod logs:"
kubectl logs -l test=integration -n ${{ env.NAMESPACE }} --all-containers=true --tail=100
exit 1
}
- name: Collect test results
if: always()
run: |
echo "=========================================="
echo "Integration Test Results"
echo "=========================================="
echo ""
echo "Job status:"
kubectl describe job poimen-memory-integration-test -n ${{ env.NAMESPACE }} | tail -20
echo ""
echo "Pod logs:"
kubectl logs -l test=integration -n ${{ env.NAMESPACE }} --all-containers=true || true
echo ""
# Get job status
STATUS=$(kubectl get job poimen-memory-integration-test \
-n ${{ env.NAMESPACE }} \
-o jsonpath='{.status.succeeded}')
if [ "$STATUS" = "1" ]; then
echo "✓ Integration test PASSED"
exit 0
else
echo "✗ Integration test FAILED"
exit 1
fi
- name: Cleanup test Job
if: always()
run: |
echo "Cleaning up test resources..."
kubectl delete job poimen-memory-integration-test \
-n ${{ env.NAMESPACE }} \
--ignore-not-found=true
echo "✓ Cleanup complete"