api-after-commit.yml

name: Guardian CI API Tests (After commit)
on:
  push:
    branches-ignore:
      - 'dependabot/**'

jobs:
  buildAndTest:
    name: Build and Test
    runs-on: guardian-linux-medium
    env:
      YARN_ENABLE_GLOBAL_CACHE: 'false'
    services:
      cache:
        image: registry.redict.io/redict
        ports:
          - 6379:6379
    strategy:
      matrix:
        node-version: [ 20.20.2 ]
        mongodb-version: [ 7.0.21 ]
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ matrix.node-version }}

      - name: Enable Corepack
        run: corepack enable

      - name: Cache yarn
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: .yarn/cache
          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
          restore-keys: ${{ runner.os }}-yarn-

      - name: Install dependencies
        run: yarn install --immutable

      - name: Build packages
        run: |
          pushd interfaces
          yarn run build
          popd
          pushd common
          yarn run build
          popd
          pushd notification-service
          yarn run build
          popd
          pushd logger-service
          yarn run build
          popd
          pushd auth-service
          yarn run build
          popd
          pushd queue-service
          yarn run build
          popd
          pushd topic-listener-service
          yarn run build
          popd
          pushd guardian-service
          yarn run build
          popd
          pushd policy-service
          yarn run build
          popd
          pushd worker-service
          yarn run build
          popd
          pushd api-gateway
          yarn run build
          popd

      - name: Start NatsMQ
        uses: step-security/nats-action@2254b4cc4958120e36da3a096e8200dac968be1c # v0.1.4
        with:
          port: '4222'

      - name: Set up IPFS
        uses: oduwsdl/setup-ipfs@678755ac20f92d2dfca7e16138e40ae75f7a0f6f # v0.8.0
        with:
          ipfs_version: 0.42.0

      - name: Start IPFS offline
        shell: bash
        run: |
          # setup-ipfs always starts an online daemon (run_daemon is a no-op); stop it before our offline node.
          ipfs shutdown || true
          until ! curl -s -X POST http://127.0.0.1:5001/api/v0/id >/dev/null 2>&1; do sleep 0.5; done
          ipfs config profile apply test    # Routing.Type=none, no bootstrap, mDNS off
          ipfs bootstrap rm --all
          ipfs config Addresses.API /ip4/127.0.0.1/tcp/5001   # test profile randomizes ports; pin RPC for the app and probe
          ipfs config --json Discovery.MDNS.Enabled false
          ipfs daemon --offline &
          until curl -s -X POST http://127.0.0.1:5001/api/v0/id >/dev/null 2>&1; do sleep 0.5; done

      - name: Start MongoDB
        uses: step-security/mongodb-github-action@ca72004b9c8ad6d9ed996c3174edbe62f9f7424a
        with:
          mongodb-version: ${{ matrix.mongodb-version }}

      - name: Run Guardian
        run: |
          start() { for s in "$@"; do (cd "$s" && npm start) & done; }

          start logger-service notification-service
          sleep 5
          start auth-service queue-service
          sleep 5
          start policy-service topic-listener-service
          for _ in {1..5}; do (cd worker-service && npm start) & done
          sleep 5
          start guardian-service
          sleep 5
          start api-gateway

          echo "Waiting for API gateway on :3002..."
          timeout 180 bash -c 'until (exec 3<>/dev/tcp/127.0.0.1/3002) 2>/dev/null; do sleep 2; done'
          sleep 15   # grace for backend NATS subscriptions
        env:
          CI: true
          NODE_OPTIONS: '--openssl-legacy-provider'
          OPERATOR_ID: ${{ secrets.CI_HEDERA_ACCOUNT }}
          OPERATOR_KEY: ${{ secrets.CI_HEDERA_PRIV_KEY }}
          JWT_PRIVATE_KEY: ${{ secrets.CI_JWT_PRIVATE_KEY }}
          JWT_PUBLIC_KEY: ${{ secrets.CI_JWT_PUBLIC_KEY }}
          SERVICE_JWT_PUBLIC_KEY_ALL: ${{ secrets.CI_JWT_PUBLIC_KEY }}
          SERVICE_JWT_SECRET_KEY_ALL: ${{ secrets.CI_JWT_PRIVATE_KEY }}
          IPFS_NODE_ADDRESS: http://127.0.0.1:5001
          IPFS_PROVIDER: local
          IPFS_PUBLIC_GATEWAY: https://ipfs.filebase.io/ipfs/{cid}
          IPFS_STORAGE_KEY: ${{ secrets.E2E_IPFS_STORAGE_KEY }}
          IPFS_STORAGE_PROOF: ${{ secrets.E2E_IPFS_STORAGE_PROOF }}
          IPFS_STORAGE_API_KEY: ${{ secrets.IPFS_STORAGE_API_KEY }}
          ACCESS_TOKEN_UPDATE_INTERVAL: 600000
          MIN_PASSWORD_LENGTH: 4
          PASSWORD_COMPLEXITY: easy
          INITIAL_BALANCE: 2
          INITIAL_STANDARD_REGISTRY_BALANCE: 20

      - name: Set up Docker Buildx
        uses: step-security/setup-buildx-action@f931205d68723ad9589fd2a7e2ece238bf9de341 # v4.0.0

      - name: Build Cypress Docker image
        uses: step-security/docker-build-push-action@846549baaf047e867d038826129a64d81df0f704 # v7.1.0
        with:
          context: ./e2e-tests
          tags: cypress-runner
          load: true
          cache-from: type=local,src=/tmp/buildkit-cache
          cache-to: type=local,dest=/tmp/buildkit-cache,mode=min

      - name: Run Cypress Tests in Docker
        run: |
          docker run --network host --name cypress-test-run \
            -e CYPRESS_portApi=3002 \
            -e CYPRESS_operatorId=${{ secrets.CI_HEDERA_ACCOUNT }} \
            -e CYPRESS_operatorKey=${{ secrets.CI_HEDERA_PRIV_KEY }} \
            -e CYPRESS_grepTags=smoke \
            -e CYPRESS_grepFilterSpecs=true \
            cypress-runner \
            --browser chrome

      - name: Copy test results from Docker container
        if: always()
        run: |
          docker cp cypress-test-run:/e2e/cypress/test_results ./e2e-tests/cypress/test_results || true

      - name: Cleanup Docker resources
        if: always()
        run: |
          docker rm -f cypress-test-run || true

      - name: Publish API Test Results
        uses: step-security/publish-unit-test-result-action@681100d67b09305624c089873f12c545ee7cbc24 # v2.23.0
        if: always()
        with:
          files: e2e-tests/cypress/test_results/**/*.xml