feat(workflow): refactor E2E test workflow to use security checks for PR approvals

pauldotyu · pauldotyu · commit e9089dd5a6e0 · 2025-06-11T15:29:30.000-07:00
diff --git a/.github/workflows/test-e2e-pr.yaml b/.github/workflows/test-e2e-pr.yaml
@@ -1,119 +1,59 @@
-# E2E test workflow triggered by authorized PR comments
-# Users with write access can comment "/test" or "/run-e2e" to trigger tests
+# composite workflow to test the azd deployment of the app
+# uses a github federated identity
 name: test-e2e-pr
 
 on:
-  issue_comment:
-    types: [created]
+  pull_request_target:
+    branches:
+      - main
+    types: [opened, synchronize, reopened, labeled]
 
 permissions:
   id-token: write
   contents: read
-  pull-requests: write
-  issues: write
 
 jobs:
-  # Check if the comment should trigger E2E tests
-  check-authorization:
-    if: |
-      github.event.issue.pull_request &&
-      (contains(github.event.comment.body, '/test') || contains(github.event.comment.body, '/run-e2e'))
+  # Security check - only run for trusted contributors or with explicit approval
+  security-check:
     runs-on: ubuntu-latest
     outputs:
-      authorized: ${{ steps.auth-check.outputs.authorized }}
-      pr-number: ${{ steps.pr-info.outputs.pr-number }}
-      pr-sha: ${{ steps.pr-info.outputs.pr-sha }}
+      approved: ${{ steps.check.outputs.approved }}
     steps:
-      - name: Check user authorization
-        id: auth-check
-        uses: actions/github-script@v7
-        with:
-          script: |
-            try {
-              // Check if user has write access to the repository
-              const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                username: context.actor
-              });
-              
-              const hasWriteAccess = ['admin', 'write'].includes(permission.permission);
-              
-              if (hasWriteAccess) {
-                console.log(`User ${context.actor} has ${permission.permission} access - authorized`);
-                core.setOutput('authorized', 'true');
-                
-                // React with 👀 to show the command was received
-                await github.rest.reactions.createForIssueComment({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  comment_id: context.payload.comment.id,
-                  content: 'eyes'
-                });
-              } else {
-                console.log(`User ${context.actor} has ${permission.permission} access - not authorized`);
-                core.setOutput('authorized', 'false');
-                
-                // React with ❌ to show unauthorized
-                await github.rest.reactions.createForIssueComment({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  comment_id: context.payload.comment.id,
-                  content: 'confused'
-                });
-                
-                // Comment explaining the requirement
-                await github.rest.issues.createComment({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: context.issue.number,
-                  body: '❌ Only users with write access can trigger E2E tests. Please ask a maintainer to run the tests.'
-                });
-              }
-            } catch (error) {
-              console.log(`Error checking permissions: ${error}`);
-              core.setOutput('authorized', 'false');
-            }
-
-      - name: Get PR information
-        id: pr-info
-        if: steps.auth-check.outputs.authorized == 'true'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const { data: pr } = await github.rest.pulls.get({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.issue.number
-            });
-
-            core.setOutput('pr-number', pr.number);
-            core.setOutput('pr-sha', pr.head.sha);
+      - name: Check if PR is from trusted source
+        id: check
+        run: |
+          # Allow if PR author is a maintainer/collaborator
+          if [[ "${{ github.event.pull_request.author_association }}" == "MEMBER" || 
+                "${{ github.event.pull_request.author_association }}" == "COLLABORATOR" || 
+                "${{ github.event.pull_request.author_association }}" == "OWNER" ]]; then
+            echo "approved=true" >> "$GITHUB_OUTPUT"
+            echo "✅ PR from trusted contributor"
+          # Allow if PR has 'safe-to-test' label (requires manual review)
+          elif [[ "${{ contains(github.event.pull_request.labels.*.name, 'safe-to-test') }}" == "true" ]]; then
+            echo "approved=true" >> "$GITHUB_OUTPUT"
+            echo "✅ PR manually approved with 'safe-to-test' label"
+          else
+            echo "approved=false" >> "$GITHUB_OUTPUT"
+            echo "❌ PR requires manual approval - add 'safe-to-test' label after review"
+            exit 1
+          fi
 
-  # Run the E2E tests
   deploy:
-    needs: check-authorization
-    if: needs.check-authorization.outputs.authorized == 'true'
+    needs: security-check
+    if: needs.security-check.outputs.approved == 'true'
+    concurrency:
+      group: pr-testing-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
     outputs:
       storeAdminIp: ${{ steps.kubectl_get_service.outputs.STORE_ADMIN_IP }}
       storeFrontIp: ${{ steps.kubectl_get_service.outputs.STORE_FRONT_IP }}
     runs-on: ubuntu-latest
     steps:
-      - name: Add starting comment
-        uses: actions/github-script@v7
-        with:
-          script: |
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: ${{ needs.check-authorization.outputs.pr-number }},
-              body: '🚀 Starting E2E tests for PR #${{ needs.check-authorization.outputs.pr-number }}...\n\n📊 [View workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})'
-            });
-
-      - name: Checkout PR code
+      - name: Checkout base repository (secure)
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
-          ref: ${{ needs.check-authorization.outputs.pr-sha }}
+          # Checkout the base branch, not the PR branch for security
+          ref: ${{ github.event.repository.default_branch }}
 
       - name: Install Terraform
         uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
@@ -147,22 +87,22 @@ jobs:
         id: provision_deploy
         continue-on-error: true
         run: |
-          # Create unique environment name for PR
-          export PR_ENV_NAME="${{ vars.AZURE_ENV_NAME }}-pr-${{ needs.check-authorization.outputs.pr-number }}"
-          azd env new $PR_ENV_NAME
+          # Set resource limits for security
+          azd env new ${{ vars.AZURE_ENV_NAME }}
           azd env set AKS_NODE_POOL_VM_SIZE Standard_D2_v4
-          azd env set BUILD_CONTAINERS true
+          azd env set BUILD_CONTAINERS false
           azd env set DEPLOY_AZURE_CONTAINER_REGISTRY true
           azd env set DEPLOY_AZURE_OPENAI true
-          azd env set AZURE_OPENAI_LOCATION ${{ vars.AZURE_LOCATION }}
           azd env set DEPLOY_AZURE_OPENAI_DALL_E_MODEL false
           azd env set DEPLOY_AZURE_SERVICE_BUS true
           azd env set DEPLOY_AZURE_COSMOSDB true
           azd env set AZURE_COSMOSDB_ACCOUNT_KIND MongoDB
           azd env set DEPLOY_OBSERVABILITY_TOOLS true
+          azd env set SOURCE_REGISTRY "ghcr.io/${{ github.repository_owner }}"
+
           azd up --no-prompt
         env:
-          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME }}-pr-${{ needs.check-authorization.outputs.pr-number }}
+          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME }}
           AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
           AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
@@ -172,7 +112,7 @@ jobs:
         with:
           path: |
             .azure/
-          key: ${{ runner.os }}-azd-pr-${{ needs.check-authorization.outputs.pr-number }}-${{ github.run_id }}
+          key: ${{ runner.os }}-azd-${{ github.run_id }}-${{ github.sha }}
 
       - name: Check provision and deploy result
         if: steps.provision_deploy.outcome == 'failure'
@@ -200,44 +140,23 @@ jobs:
           echo "STORE_FRONT_IP=${storeFrontIp}"
           echo "STORE_FRONT_IP=${storeFrontIp}" >> "$GITHUB_OUTPUT"
 
-      - name: Comment on deployment status
-        if: always()
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const success = '${{ steps.provision_deploy.outcome }}' === 'success';
-            const emoji = success ? '✅' : '❌';
-            const status = success ? 'succeeded' : 'failed';
-
-            let body = `${emoji} Deployment ${status} for PR #${{ needs.check-authorization.outputs.pr-number }}`;
-
-            if (success) {
-              body += `\n\n🔗 **Test URLs:**\n- Store Admin: http://${{ steps.kubectl_get_service.outputs.STORE_ADMIN_IP }}\n- Store Front: http://${{ steps.kubectl_get_service.outputs.STORE_FRONT_IP }}`;
-            }
-
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: ${{ needs.check-authorization.outputs.pr-number }},
-              body: body
-            });
-
   playwright-tests:
-    needs: [check-authorization, deploy]
-    if: needs.check-authorization.outputs.authorized == 'true' && needs.deploy.result == 'success'
+    needs: deploy
     uses: ./.github/workflows/test-playwright.yaml
     secrets: inherit
     with:
       storeAdminUrl: "http://${{ needs.deploy.outputs.storeAdminIp }}"
       storeFrontUrl: "http://${{ needs.deploy.outputs.storeFrontIp }}"
 
   teardown:
-    if: always() && needs.check-authorization.outputs.authorized == 'true'
-    needs: [check-authorization, playwright-tests]
+    if: always()
+    needs: [deploy, playwright-tests]
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
+      - name: Checkout base repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          ref: ${{ github.event.repository.default_branch }}
 
       - name: Install Terraform
         uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
@@ -250,7 +169,7 @@ jobs:
         with:
           path: |
             .azure/
-          key: ${{ runner.os }}-azd-pr-${{ needs.check-authorization.outputs.pr-number }}-${{ github.run_id }}
+          key: ${{ runner.os }}-azd-${{ github.run_id }}-${{ github.sha }}
 
       - name: Azure CLI login
         uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
@@ -267,27 +186,22 @@ jobs:
             --tenant-id ${{ secrets.AZURE_TENANT_ID }}
 
       - name: Destroy environment
-        run: azd down --force --purge
+        run: |
+          # Force cleanup with multiple attempts
+          azd down --force --purge || true
+          sleep 30
+          azd down --force --purge || true
         env:
-          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME }}-pr-${{ needs.check-authorization.outputs.pr-number }}
+          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME }}
           AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
           AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
+      - name: Emergency cleanup (if azd fails)
+        if: failure()
+        run: |
+          # Last resort: delete resource group directly
+          az group delete --name "rg-${{ vars.AZURE_ENV_NAME }}" --yes --no-wait || true
+          echo "Emergency cleanup attempted"
+
       - name: Remove azd folder
         run: rm -rf .azure
-
-      - name: Final comment on test results
-        if: always()
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const testResult = '${{ needs.playwright-tests.result }}';
-            const emoji = testResult === 'success' ? '✅' : '❌';
-            const status = testResult === 'success' ? 'passed' : 'failed';
-
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: ${{ needs.check-authorization.outputs.pr-number }},
-              body: `${emoji} E2E tests ${status} for PR #${{ needs.check-authorization.outputs.pr-number }}. Environment has been cleaned up.\n\n📊 [View full workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})`
-            });
