prisma-example-readme-e2e.yml

name: Prisma Example README E2E

# Outside-in walkthrough of `examples/prisma/README.md`'s "Run it"
# section: copies .env.example, brings up the bundled Postgres, runs
# `pnpm install`, `pnpm emit`, `pnpm migration:plan --name initial`,
# `pnpm migration:apply`, then `pnpm start`, asserting each command
# exits 0 and that `pnpm start` prints the documented "Expected
# output" lines.
#
# Lives in the root `e2e/` workspace as
# `tests/prisma-example-readme.e2e.test.ts`. Auth-gated: skips
# cleanly on fork PRs where ZeroKMS secrets are unavailable.

on:
  push:
    branches:
      - main
    paths:
      - 'examples/prisma/**'
      - '.github/workflows/prisma-example-readme-e2e.yml'
      # The walkthrough encrypts against the live service, so the native
      # binding and the action that builds it are inputs to this suite. Added
      # with that build step: without them a protect-ffi change would reach main
      # having never run the walkthrough. They are repeated verbatim under
      # `pull_request` below, which is what makes that a gate rather than a
      # report — a PR touching any of these runs the walkthrough before the
      # change lands, not after.
      - '.github/actions/build-ffi-binding/**'
      - 'packages/protect-ffi/crates/**'
      - 'packages/protect-ffi/src/**'
      - 'packages/protect-ffi/Cargo.toml'
      - 'packages/protect-ffi/Cargo.lock'
      - 'packages/protect-ffi/package.json'
      - 'packages/protect-ffi/mise.toml'
  pull_request:
    branches:
      - '**'
    paths:
      - 'examples/prisma/**'
      - '.github/workflows/prisma-example-readme-e2e.yml'
      # The same entries as under `push` above, and the copy that does the
      # work: a PR touching the native binding or the action that builds it
      # runs the walkthrough on the PR, so a protect-ffi change is gated by
      # this suite rather than reaching main unexercised. (GitHub Actions has
      # no YAML anchors, so the list is written twice;
      # scripts/__tests__/workflow-paths-filter-parity.test.mjs compares the
      # two copies.)
      - '.github/actions/build-ffi-binding/**'
      - 'packages/protect-ffi/crates/**'
      - 'packages/protect-ffi/src/**'
      - 'packages/protect-ffi/Cargo.toml'
      - 'packages/protect-ffi/Cargo.lock'
      - 'packages/protect-ffi/package.json'
      - 'packages/protect-ffi/mise.toml'

jobs:
  walkthrough:
    name: Run README walkthrough
    runs-on: blacksmith-4vcpu-ubuntu-2404

    # Skip cleanly on fork PRs where secrets aren't available. The
    # test's `describe.skipIf(!authConfigured)` would also skip, but
    # gating at the job level produces a clean "skipped" status.
    # Every OTHER event runs, which is why this gates on "not a fork PR" rather
    # than listing the event names allowed through: the listing form skipped
    # the job on `workflow_dispatch` in integration-protect-ffi.yml, making a
    # declared manual trigger do nothing. Enforced by
    # scripts/__tests__/workflow-dispatch-job-conditions.test.mjs.
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}

    env:
      CS_WORKSPACE_CRN: ${{ vars.CS_WORKSPACE_CRN }}
      CS_CLIENT_ID: ${{ vars.CS_CLIENT_ID }}
      CS_CLIENT_KEY: ${{ secrets.CS_CLIENT_KEY }}
      CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_CLIENT_ACCESS_KEY }}

    steps:
      - name: Checkout Repo
        uses: actions/checkout@v6

      - uses: pnpm/action-setup@v6.0.9
        name: Install pnpm
        with:
          run_install: false

      - name: Install Node.js
        uses: actions/setup-node@v6.5.0
        with:
          node-version: 22
          cache: 'pnpm'

      # node-pty's install hook falls back to `node-gyp rebuild` when no
      # linux-x64 prebuild matches. pnpm/action-setup v6 no longer ships
      # node-gyp on PATH, so install it explicitly.
      - name: Install node-gyp
        run: npm install -g node-gyp

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # A missing / rotated / fork-PR-absent secret makes the walkthrough skip
      # its live steps silently, hiding regressions behind a green job. Fail loud.
      # First, ahead of the binding build: this costs seconds and that costs
      # minutes on a cold cache.
      - name: Require CipherStash secrets
        uses: ./.github/actions/require-cs-secrets
        with:
          workspace-crn: ${{ vars.CS_WORKSPACE_CRN }}
          client-id: ${{ vars.CS_CLIENT_ID }}
          client-key: ${{ secrets.CS_CLIENT_KEY }}
          client-access-key: ${{ secrets.CS_CLIENT_ACCESS_KEY }}

      # The walkthrough encrypts against the live service, so it needs the
      # native binding — `packages/protect-ffi` is a workspace package now, so
      # `index.node` is a build output rather than tarball contents. This step
      # runs on push to main and on any PR whose diff matches the paths filter
      # above, the absorption PR that introduced the need included: that PR
      # edits this workflow, the build action, and the package itself, and all
      # three are in the filter. The exception is a fork PR — it triggers the
      # workflow, but the job's `if` skips it for want of CS_* credentials.
      - name: Build the protect-ffi binding
        uses: ./.github/actions/build-ffi-binding

      # Build via turbo so `^build` on `@cipherstash/stack-prisma` and
      # its `@cipherstash/stack` peer is honoured. The test's
      # `pnpm install` subprocess inside `examples/prisma/` is a no-op
      # given the lockfile is already in steady state from this step.
      - name: Build @cipherstash/stack-prisma
        run: pnpm exec turbo run build --filter @cipherstash/stack-prisma

      - name: Run README walkthrough e2e
        run: pnpm exec turbo run test:e2e --filter @cipherstash/e2e -- --run tests/prisma-example-readme.e2e.test.ts

      - name: Tear down bundled Postgres (best-effort)
        if: always()
        working-directory: examples/prisma
        run: docker compose down -v || true