prisma-next-e2e.yml

name: Prisma Next E2E

# End-to-end tests for `@cipherstash/stack-prisma`: spins up a real
# Postgres container, applies the cipherstash baseline migration
# (EQL bundle install) + the example app's schema, then runs the
# suite at `examples/prisma/test/e2e/` against a live ZeroKMS
# workspace.
#
# Triggers only on changes that affect the package or the example
# (the unit-test suite in `tests.yml` covers everything that doesn't
# need a live workspace).

on:
  push:
    branches:
      - main
    paths:
      - 'packages/stack-prisma/**'
      - 'examples/prisma/**'
      - '.github/workflows/prisma-next-e2e.yml'
      # This suite encrypts against the live service, so the native binding and
      # the action that builds it are inputs to it. Added with that build step:
      # without them a protect-ffi change would reach main having never run this
      # suite. They are repeated verbatim under `pull_request` below, which is
      # what makes that a gate rather than a report — a PR touching any of these
      # runs the suite before the change lands, not after.
      - '.github/actions/build-ffi-binding/**'
      - 'packages/protect-ffi/crates/**'
      - 'packages/protect-ffi/src/**'
      - 'packages/protect-ffi/Cargo.toml'
      - 'packages/protect-ffi/Cargo.lock'
      - 'packages/protect-ffi/package.json'
      - 'packages/protect-ffi/mise.toml'
  pull_request:
    branches:
      - '**'
    paths:
      - 'packages/stack-prisma/**'
      - 'examples/prisma/**'
      - '.github/workflows/prisma-next-e2e.yml'
      # The same entries as under `push` above, and the copy that does the
      # work: a PR touching the native binding or the action that builds it
      # runs this suite on the PR, so a protect-ffi change is gated by it
      # rather than reaching main unexercised. (GitHub Actions has no YAML
      # anchors, so the list is written twice;
      # scripts/__tests__/workflow-paths-filter-parity.test.mjs compares the
      # two copies.)
      - '.github/actions/build-ffi-binding/**'
      - 'packages/protect-ffi/crates/**'
      - 'packages/protect-ffi/src/**'
      - 'packages/protect-ffi/Cargo.toml'
      - 'packages/protect-ffi/Cargo.lock'
      - 'packages/protect-ffi/package.json'
      - 'packages/protect-ffi/mise.toml'

jobs:
  e2e:
    name: Run Prisma Next E2E
    runs-on: blacksmith-4vcpu-ubuntu-2404

    # Skip cleanly on fork PRs where secrets aren't available. The
    # global-setup hook in the suite hard-errors when `CS_WORKSPACE_CRN`
    # is unset; gating at the job level produces a clean "skipped"
    # status instead of a noisy failure.
    # Every OTHER event runs, which is why this gates on "not a fork PR" rather
    # than listing the event names allowed through: the listing form skipped
    # the job on `workflow_dispatch` in integration-protect-ffi.yml, making a
    # declared manual trigger do nothing. Enforced by
    # scripts/__tests__/workflow-dispatch-job-conditions.test.mjs.
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}

    env:
      CS_WORKSPACE_CRN: ${{ vars.CS_WORKSPACE_CRN }}
      CS_CLIENT_ID: ${{ vars.CS_CLIENT_ID }}
      CS_CLIENT_KEY: ${{ secrets.CS_CLIENT_KEY }}
      CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_CLIENT_ACCESS_KEY }}

    steps:
      - name: Checkout Repo
        uses: actions/checkout@v6

      - uses: pnpm/action-setup@v6.0.9
        name: Install pnpm
        with:
          run_install: false

      - name: Install Node.js
        uses: actions/setup-node@v6.5.0
        with:
          node-version: 22
          cache: 'pnpm'

      # node-pty's install hook falls back to `node-gyp rebuild` when no
      # linux-x64 prebuild matches. pnpm/action-setup v6 no longer ships
      # node-gyp on PATH, so install it explicitly.
      - name: Install node-gyp
        run: npm install -g node-gyp

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # The global-setup hook hard-errors without CS_WORKSPACE_CRN, but a
      # missing sibling secret could still degrade coverage silently — assert
      # all four up front so a rotated / fork-PR-absent secret fails loudly.
      # First, ahead of the binding build: this costs seconds and that costs
      # minutes on a cold cache.
      - name: Require CipherStash secrets
        uses: ./.github/actions/require-cs-secrets
        with:
          workspace-crn: ${{ vars.CS_WORKSPACE_CRN }}
          client-id: ${{ vars.CS_CLIENT_ID }}
          client-key: ${{ secrets.CS_CLIENT_KEY }}
          client-access-key: ${{ secrets.CS_CLIENT_ACCESS_KEY }}

      # This suite encrypts against the live service, so it needs the native
      # binding — `packages/protect-ffi` is a workspace package now, so
      # `index.node` is a build output rather than tarball contents. This step
      # runs on push to main and on any PR whose diff matches the paths filter
      # above, the absorption PR that introduced the need included: that PR
      # edits this workflow, the build action, and the package itself, and all
      # three are in the filter. The exception is a fork PR — it triggers the
      # workflow, but the job's `if` skips it for want of CS_* credentials.
      - name: Build the protect-ffi binding
        uses: ./.github/actions/build-ffi-binding

      # Write the CS_* credentials and the harness DATABASE_URL into the
      # example app's .env so the runtime + the `prisma-next migration
      # apply` invocation in global-setup both pick them up. The harness
      # also overrides DATABASE_URL inside the test process to point at
      # the container, but the migration:apply subprocess relies on
      # prisma-next.config.ts → process.env['DATABASE_URL'] being set
      # before the test runner spawns it.
      - name: Create .env file in examples/prisma
        run: |
          touch ./examples/prisma/.env
          echo "DATABASE_URL=postgres://cipherstash:cipherstash@localhost:54329/cipherstash_e2e" >> ./examples/prisma/.env
          echo "CS_WORKSPACE_CRN=${{ vars.CS_WORKSPACE_CRN }}" >> ./examples/prisma/.env
          echo "CS_CLIENT_ID=${{ vars.CS_CLIENT_ID }}" >> ./examples/prisma/.env
          echo "CS_CLIENT_KEY=${{ secrets.CS_CLIENT_KEY }}" >> ./examples/prisma/.env
          echo "CS_CLIENT_ACCESS_KEY=${{ secrets.CS_CLIENT_ACCESS_KEY }}" >> ./examples/prisma/.env

      # Build via turbo so the `^build` dependency on
      # `@cipherstash/stack` (which `@cipherstash/stack-prisma` imports
      # `/schema` from) is honoured. A bare
      # `pnpm --filter @cipherstash/stack-prisma build` bypasses the
      # task graph and leaves the upstream dist/ empty, surfacing as
      # `Cannot find module '@cipherstash/stack/schema'` from tsc.
      - name: Build @cipherstash/stack-prisma
        run: pnpm exec turbo run build --filter @cipherstash/stack-prisma

      - name: Emit example contract
        run: pnpm --filter @cipherstash/prisma-example emit

      - name: Start E2E Postgres container
        working-directory: examples/prisma
        run: |
          docker compose -f test/e2e/docker-compose.yml up -d
          # Wait for pg_isready before handing off to the suite — the
          # global-setup hook expects the container to already be up.
          for i in {1..60}; do
            if docker exec cipherstash-e2e-postgres pg_isready -U cipherstash -d cipherstash_e2e >/dev/null 2>&1; then
              echo "Postgres ready"
              break
            fi
            sleep 1
          done

      - name: Run E2E suite
        run: pnpm exec turbo run test:e2e --filter @cipherstash/prisma-example --env-mode=loose

      - name: Stop E2E Postgres container
        if: always()
        working-directory: examples/prisma
        run: docker compose -f test/e2e/docker-compose.yml down -v