Skip to content

Commit 2e13dcc

Browse files
marcel-diasmarcel-dias
committed
feat: add playwright helm chart execution #752
Signed-off-by: Marcel Dias <marcel.dias@camunda.com>
1 parent ac9a812 commit 2e13dcc

File tree

3 files changed

+295
-5
lines changed

3 files changed

+295
-5
lines changed

‎.github/actions/internal-camunda-chart-tests/README.md‎

Lines changed: 48 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,17 @@
33
## Description
44

55
Run the Camunda Helm chart tests. Already requires the Helm chart to be deployed and cluster access granted.
6-
This action integrates multiple testing layers: 1. Helm chart integration tests (from camunda-platform-helm) 2. C8 Self-Managed checks (from c8-sm-checks repository):
6+
This action integrates multiple testing layers: 1. Helm chart integration tests (Venom-based, from camunda-platform-helm) 2. C8 Self-Managed checks (from c8-sm-checks repository):
77
- Deployment verification (checks pods and containers status)
88
- Kubernetes connectivity checks (services and ingress resolution)
99
- AWS IRSA configuration checks (for EKS clusters with IRSA)
1010
- Zeebe token generation and connectivity checks
11+
3. Helm Playwright integration tests (optional, from camunda-platform-helm):
12+
- Service connectivity tests (Identity, Console, Operate, etc.)
13+
- Authentication flow tests (Keycloak, Basic, Hybrid)
14+
- API and gRPC connectivity tests
1115

12-
All C8 SM checks can be individually enabled/disabled via inputs.
16+
All checks can be individually enabled/disabled via inputs.
1317

1418

1519
## Inputs
@@ -50,6 +54,12 @@ All C8 SM checks can be individually enabled/disabled via inputs.
5054
| `enable-c8sm-zeebe-connectivity-check` | <p>Whether the C8 SM Zeebe connectivity check should be run</p> | `false` | `true` |
5155
| `local-domain-mode` | <p>Enable local domain mode. When true, /etc/hosts entries will be added to resolve camunda.example.com and zeebe-camunda.example.com to 127.0.0.1. This is required for local Kind clusters with domain-based access where the runner needs to access the ingress via localhost.</p> | `false` | `false` |
5256
| `local-domain-ip` | <p>The IP address to use for local domain resolution in /etc/hosts. Defaults to 127.0.0.1 for standard local development.</p> | `false` | `127.0.0.1` |
57+
| `enable-helm-playwright-tests` | <p>Whether to run the Helm chart Playwright integration tests. These tests run against the deployed Camunda platform and test service connectivity, authentication, and basic functionality.</p> | `false` | `false` |
58+
| `helm-playwright-test-auth-type` | <p>Authentication type for Helm Playwright tests. Options: keycloak, basic, hybrid - keycloak: Use Keycloak/OIDC authentication for all tests - basic: Use basic auth (demo:demo) for all tests - hybrid: Run OIDC tests (identity, console) with keycloak, then basic auth tests (connectors, core-rest, core-grpc)</p> | `false` | `keycloak` |
59+
| `helm-playwright-test-project` | <p>Playwright test project to run. Options: full-suite, smoke-tests - full-suite: Run all integration tests - smoke-tests: Run only smoke tests (faster, for quick validation)</p> | `false` | `smoke-tests` |
60+
| `helm-playwright-test-exclude` | <p>Test suites to exclude from Helm Playwright tests. Example: 'identity.spec.ts' or 'console.spec.ts|identity.spec.ts'</p> | `false` | `""` |
61+
| `helm-playwright-upload-artifacts` | <p>Whether to upload Playwright test artifacts on failure</p> | `false` | `true` |
62+
| `helm-playwright-artifact-retention-days` | <p>Number of days to retain Playwright test artifacts</p> | `false` | `10` |
5363

5464

5565
## Runs
@@ -264,4 +274,40 @@ This action is a `composite` action.
264274
#
265275
# Required: false
266276
# Default: 127.0.0.1
277+
278+
enable-helm-playwright-tests:
279+
# Whether to run the Helm chart Playwright integration tests. These tests run against the deployed Camunda platform and test service connectivity, authentication, and basic functionality.
280+
#
281+
# Required: false
282+
# Default: false
283+
284+
helm-playwright-test-auth-type:
285+
# Authentication type for Helm Playwright tests. Options: keycloak, basic, hybrid - keycloak: Use Keycloak/OIDC authentication for all tests - basic: Use basic auth (demo:demo) for all tests - hybrid: Run OIDC tests (identity, console) with keycloak, then basic auth tests (connectors, core-rest, core-grpc)
286+
#
287+
# Required: false
288+
# Default: keycloak
289+
290+
helm-playwright-test-project:
291+
# Playwright test project to run. Options: full-suite, smoke-tests - full-suite: Run all integration tests - smoke-tests: Run only smoke tests (faster, for quick validation)
292+
#
293+
# Required: false
294+
# Default: smoke-tests
295+
296+
helm-playwright-test-exclude:
297+
# Test suites to exclude from Helm Playwright tests. Example: 'identity.spec.ts' or 'console.spec.ts|identity.spec.ts'
298+
#
299+
# Required: false
300+
# Default: ""
301+
302+
helm-playwright-upload-artifacts:
303+
# Whether to upload Playwright test artifacts on failure
304+
#
305+
# Required: false
306+
# Default: true
307+
308+
helm-playwright-artifact-retention-days:
309+
# Number of days to retain Playwright test artifacts
310+
#
311+
# Required: false
312+
# Default: 10
267313
```

‎.github/actions/internal-camunda-chart-tests/action.yml‎

Lines changed: 240 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,18 @@ description: >
66
Already requires the Helm chart to be deployed and cluster access granted.
77
88
This action integrates multiple testing layers:
9-
1. Helm chart integration tests (from camunda-platform-helm)
9+
1. Helm chart integration tests (Venom-based, from camunda-platform-helm)
1010
2. C8 Self-Managed checks (from c8-sm-checks repository):
1111
- Deployment verification (checks pods and containers status)
1212
- Kubernetes connectivity checks (services and ingress resolution)
1313
- AWS IRSA configuration checks (for EKS clusters with IRSA)
1414
- Zeebe token generation and connectivity checks
15+
3. Helm Playwright integration tests (optional, from camunda-platform-helm):
16+
- Service connectivity tests (Identity, Console, Operate, etc.)
17+
- Authentication flow tests (Keycloak, Basic, Hybrid)
18+
- API and gRPC connectivity tests
1519
16-
All C8 SM checks can be individually enabled/disabled via inputs.
20+
All checks can be individually enabled/disabled via inputs.
1721
1822
inputs:
1923
tests-camunda-helm-chart-repo-ref:
@@ -124,6 +128,38 @@ inputs:
124128
The IP address to use for local domain resolution in /etc/hosts.
125129
Defaults to 127.0.0.1 for standard local development.
126130
default: 127.0.0.1
131+
enable-helm-playwright-tests:
132+
description: >
133+
Whether to run the Helm chart Playwright integration tests.
134+
These tests run against the deployed Camunda platform and test
135+
service connectivity, authentication, and basic functionality.
136+
default: 'false'
137+
helm-playwright-test-auth-type:
138+
description: >
139+
Authentication type for Helm Playwright tests.
140+
Options: keycloak, basic, hybrid
141+
- keycloak: Use Keycloak/OIDC authentication for all tests
142+
- basic: Use basic auth (demo:demo) for all tests
143+
- hybrid: Run OIDC tests (identity, console) with keycloak, then basic auth tests (connectors, core-rest, core-grpc)
144+
default: keycloak
145+
helm-playwright-test-project:
146+
description: >
147+
Playwright test project to run.
148+
Options: full-suite, smoke-tests
149+
- full-suite: Run all integration tests
150+
- smoke-tests: Run only smoke tests (faster, for quick validation)
151+
default: smoke-tests
152+
helm-playwright-test-exclude:
153+
description: >
154+
Test suites to exclude from Helm Playwright tests.
155+
Example: 'identity.spec.ts' or 'console.spec.ts|identity.spec.ts'
156+
default: ''
157+
helm-playwright-upload-artifacts:
158+
description: Whether to upload Playwright test artifacts on failure
159+
default: 'true'
160+
helm-playwright-artifact-retention-days:
161+
description: Number of days to retain Playwright test artifacts
162+
default: '10'
127163

128164
runs:
129165
using: composite
@@ -723,3 +759,205 @@ runs:
723759
-s "$ZEEBE_CLIENT_SECRET" \
724760
-u "$ZEEBE_TOKEN_AUDIENCE" \
725761
-q grpc
762+
763+
- name: 🎭 HELM PLAYWRIGHT - Verify prerequisites
764+
id: playwright-prereqs
765+
if: ${{ inputs.enable-helm-playwright-tests == 'true' && inputs.camunda-domain != '' }}
766+
shell: bash
767+
env:
768+
CAMUNDA_VERSION: ${{ inputs.camunda-version }}
769+
TESTS_CAMUNDA_HELM_CHART_REPO_PATH: ${{ inputs.tests-camunda-helm-chart-repo-path }}
770+
run: |
771+
set -euo pipefail
772+
773+
echo "🔍 Verifying Helm Playwright test prerequisites..."
774+
775+
TEST_SUITE_PATH="${TESTS_CAMUNDA_HELM_CHART_REPO_PATH}/charts/camunda-platform-${CAMUNDA_VERSION}/test/integration/testsuites"
776+
777+
# Export paths to GITHUB_ENV for subsequent steps
778+
echo "HELM_PLAYWRIGHT_TEST_SUITE_PATH=$TEST_SUITE_PATH" >> "$GITHUB_ENV"
779+
echo "test-suite-path=$TEST_SUITE_PATH" >> "$GITHUB_OUTPUT"
780+
781+
# Verify test suite exists
782+
if [[ ! -d "$TEST_SUITE_PATH" ]]; then
783+
echo "⚠️ Test suite path not found: $TEST_SUITE_PATH"
784+
echo " Helm Playwright tests will be skipped."
785+
echo "test-suite-exists=false" >> "$GITHUB_OUTPUT"
786+
exit 0
787+
fi
788+
789+
echo "test-suite-exists=true" >> "$GITHUB_OUTPUT"
790+
791+
# Verify required tools are available
792+
echo "Checking required tools..."
793+
for tool in node npm kubectl; do
794+
if ! command -v "$tool" &> /dev/null; then
795+
echo "❌ Required tool not found: $tool"
796+
exit 1
797+
fi
798+
echo " ✅ $tool: $(command -v $tool)"
799+
done
800+
801+
echo "✅ All prerequisites verified"
802+
echo " Test suite path: $TEST_SUITE_PATH"
803+
804+
- name: 🎭 HELM PLAYWRIGHT - Cache npm dependencies
805+
if: ${{ inputs.enable-helm-playwright-tests == 'true' && inputs.camunda-domain != '' }}
806+
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
807+
with:
808+
path: |
809+
~/.npm
810+
${{ env.HELM_PLAYWRIGHT_TEST_SUITE_PATH }}/node_modules
811+
key: npm-playwright-${{ inputs.camunda-version }}-${{ hashFiles(format('{0}/charts/camunda-platform-{1}/test/integration/testsuites/package-lock.json',
812+
inputs.tests-camunda-helm-chart-repo-path, inputs.camunda-version)) }}
813+
restore-keys: |
814+
npm-playwright-${{ inputs.camunda-version }}-
815+
816+
- name: 🎭 HELM PLAYWRIGHT - Install Node.js dependencies
817+
if: ${{ inputs.enable-helm-playwright-tests == 'true' && inputs.camunda-domain != '' }}
818+
shell: bash
819+
working-directory: ${{ env.HELM_PLAYWRIGHT_TEST_SUITE_PATH }}
820+
run: |
821+
set -euo pipefail
822+
823+
echo "📦 Installing Node.js dependencies for Playwright tests..."
824+
npm ci
825+
826+
echo "🎭 Installing Playwright browsers..."
827+
npx playwright install --with-deps chromium
828+
829+
- name: 🎭 HELM PLAYWRIGHT - Setup environment file
830+
id: playwright-env
831+
if: ${{ inputs.enable-helm-playwright-tests == 'true' && inputs.camunda-domain != '' }}
832+
shell: bash
833+
env:
834+
CAMUNDA_DOMAIN: ${{ inputs.camunda-domain }}
835+
CAMUNDA_DOMAIN_GRPC: ${{ inputs.camunda-domain-grpc }}
836+
TEST_NAMESPACE: ${{ inputs.test-namespace }}
837+
CAMUNDA_RELEASE_NAME: ${{ inputs.test-release-name }}
838+
TEST_AUTH_TYPE: ${{ inputs.helm-playwright-test-auth-type }}
839+
TEST_CLIENT_ID: ${{ inputs.test-client-id }}
840+
TEST_CLIENT_SECRET: ${{ inputs.test-client-secret }}
841+
run: |
842+
set -euo pipefail
843+
844+
TEST_SUITE_PATH="$HELM_PLAYWRIGHT_TEST_SUITE_PATH"
845+
ENV_FILE="${TEST_SUITE_PATH}/.env"
846+
847+
echo "📝 Setting up Playwright environment file..."
848+
849+
# Base URLs
850+
cat > "$ENV_FILE" << EOF
851+
# Camunda Platform URLs
852+
AUTH_URL=https://${CAMUNDA_DOMAIN}/auth/realms/camunda-platform/protocol/openid-connect/token
853+
CONSOLE_BASE_URL=https://${CAMUNDA_DOMAIN}/console
854+
KEYCLOAK_BASE_URL=https://${CAMUNDA_DOMAIN}/auth
855+
IDENTITY_BASE_URL=https://${CAMUNDA_DOMAIN}/identity
856+
OPERATE_BASE_URL=https://${CAMUNDA_DOMAIN}/operate
857+
OPTIMIZE_BASE_URL=https://${CAMUNDA_DOMAIN}/optimize
858+
TASKLIST_BASE_URL=https://${CAMUNDA_DOMAIN}/tasklist
859+
CONNECTORS_BASE_URL=https://${CAMUNDA_DOMAIN}/connectors
860+
ZEEBE_GATEWAY_GRPC=${CAMUNDA_DOMAIN_GRPC:-${CAMUNDA_DOMAIN}:443}
861+
ZEEBE_GATEWAY_REST=https://${CAMUNDA_DOMAIN}/zeebe
862+
863+
# Login paths
864+
CONSOLE_LOGIN_PATH=/login
865+
IDENTITY_LOGIN_PATH=/login
866+
OPERATE_LOGIN_PATH=/login
867+
OPTIMIZE_LOGIN_PATH=/api/authentication/callback
868+
TASKLIST_LOGIN_PATH=/login
869+
CONNECTORS_LOGIN_PATH=/login
870+
871+
# Authentication
872+
TEST_AUTH_TYPE=${TEST_AUTH_TYPE}
873+
TEST_CLIENT_ID=${TEST_CLIENT_ID}
874+
EOF
875+
876+
# Fetch service client secrets from the cluster
877+
echo "🔑 Fetching service client secrets..."
878+
879+
for svc in CONNECTORS TASKLIST OPTIMIZE OPERATE ZEEBE ORCHESTRATION; do
880+
secret=$(kubectl -n "$TEST_NAMESPACE" \
881+
get secret integration-test-credentials \
882+
-o jsonpath="{.data.identity-${svc,,}-client-token}" 2>/dev/null | base64 -d 2>/dev/null || \
883+
kubectl -n "$TEST_NAMESPACE" \
884+
get secret "${CAMUNDA_RELEASE_NAME}-credentials" \
885+
-o jsonpath="{.data.identity-${svc,,}-client-token}" 2>/dev/null | base64 -d 2>/dev/null || \
886+
echo "")
887+
888+
if [[ -n "$secret" ]]; then
889+
echo "::add-mask::$secret"
890+
echo "PLAYWRIGHT_VAR_${svc}_CLIENT_SECRET=${secret}" >> "$ENV_FILE"
891+
else
892+
echo "⚠️ Could not fetch secret for $svc, using test-client-secret"
893+
echo "PLAYWRIGHT_VAR_${svc}_CLIENT_SECRET=${TEST_CLIENT_SECRET}" >> "$ENV_FILE"
894+
fi
895+
done
896+
897+
# Fetch admin client secret
898+
admin_secret=$(kubectl -n "$TEST_NAMESPACE" \
899+
get secret integration-test-credentials \
900+
-o jsonpath="{.data.identity-admin-client-password}" 2>/dev/null | base64 -d 2>/dev/null || \
901+
kubectl -n "$TEST_NAMESPACE" \
902+
get secret "${CAMUNDA_RELEASE_NAME}-credentials" \
903+
-o jsonpath="{.data.identity-admin-client-password}" 2>/dev/null | base64 -d 2>/dev/null || \
904+
echo "$TEST_CLIENT_SECRET")
905+
906+
if [[ -n "$admin_secret" ]]; then
907+
echo "::add-mask::$admin_secret"
908+
fi
909+
echo "PLAYWRIGHT_VAR_ADMIN_CLIENT_SECRET=${admin_secret}" >> "$ENV_FILE"
910+
911+
# Additional settings
912+
cat >> "$ENV_FILE" << EOF
913+
CI=true
914+
VERBOSE=true
915+
TEST_BASE_PATH=${TEST_SUITE_PATH}/files
916+
FIXTURES_DIR=${TEST_SUITE_PATH}/files
917+
EOF
918+
919+
echo "✅ Environment file created at $ENV_FILE"
920+
921+
- name: 🎭 HELM PLAYWRIGHT - Run integration tests
922+
id: helm-playwright-tests
923+
if: ${{ inputs.enable-helm-playwright-tests == 'true' && inputs.camunda-domain != '' }}
924+
shell: bash
925+
working-directory: ${{ env.HELM_PLAYWRIGHT_TEST_SUITE_PATH }}
926+
env:
927+
TEST_AUTH_TYPE: ${{ inputs.helm-playwright-test-auth-type }}
928+
TEST_PROJECT: ${{ inputs.helm-playwright-test-project }}
929+
TEST_EXCLUDE: ${{ inputs.helm-playwright-test-exclude }}
930+
run: |
931+
set -euo pipefail
932+
933+
echo "🎭 Running Helm Playwright integration tests..."
934+
echo " Project: $TEST_PROJECT"
935+
echo " Auth type: $TEST_AUTH_TYPE"
936+
echo " Exclude: ${TEST_EXCLUDE:-none}"
937+
938+
# Build playwright arguments
939+
PLAYWRIGHT_ARGS="--project=$TEST_PROJECT --reporter=html,list"
940+
941+
if [[ -n "$TEST_EXCLUDE" ]]; then
942+
PLAYWRIGHT_ARGS="$PLAYWRIGHT_ARGS --grep-invert=\"$TEST_EXCLUDE\""
943+
fi
944+
945+
# Run all tests with the specified auth type
946+
if npx playwright test $PLAYWRIGHT_ARGS; then
947+
echo "result=success" >> "$GITHUB_OUTPUT"
948+
echo "✅ All Playwright tests passed!"
949+
else
950+
echo "result=failure" >> "$GITHUB_OUTPUT"
951+
echo "❌ Some Playwright tests failed"
952+
exit 1
953+
fi
954+
955+
- name: 🎭 HELM PLAYWRIGHT - Upload test artifacts
956+
if: ${{ inputs.enable-helm-playwright-tests == 'true' && inputs.helm-playwright-upload-artifacts == 'true' }}
957+
uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4
958+
with:
959+
name: helm-playwright-report-${{ github.run_id }}-${{ github.run_attempt }}
960+
path: |
961+
${{ steps.playwright-prereqs.outputs.test-suite-path }}/playwright-report
962+
${{ steps.playwright-prereqs.outputs.test-suite-path }}/test-results
963+
retention-days: ${{ inputs.helm-playwright-artifact-retention-days }}

‎.github/workflows/local_kubernetes_kind_single_region_tests.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -269,10 +269,12 @@ jobs:
269269
test-namespace: ${{ env.CAMUNDA_NAMESPACE }}
270270
test-cluster-type: ${{ env.TEST_CLUSTER_TYPE }}
271271
test-release-name: ${{ env.CAMUNDA_RELEASE_NAME }}
272+
tests-camunda-helm-chart-repo-ref: main
273+
tests-camunda-helm-chart-repo-path: ${{ env.TESTS_CAMUNDA_HELM_CHART_REPO_PATH }}
272274
# Use auto-generated local credentials instead of CI credentials from Vault
273275
test-client-id: ${{ steps.local-credentials.outputs.LOCAL_CLIENT_ID }}
274276
test-client-secret: ${{ steps.local-credentials.outputs.LOCAL_CLIENT_SECRET }}
275-
# Disable Venom/Helm chart tests, only run C8-SM-CHECKS
277+
# Disable Venom/Helm chart tests
276278
enable-helm-chart-tests: 'false'
277279
enable-zeebe-client-tests: 'false'
278280
# Enable C8-SM-CHECKS
@@ -287,6 +289,10 @@ jobs:
287289
|| 'false' }}
288290
# Enable local domain mode for Kind - configures /etc/hosts for domain resolution
289291
local-domain-mode: ${{ matrix.declination.use_tls && 'true' || 'false' }}
292+
# Enable Helm Playwright smoke tests (only when domain/TLS is enabled)
293+
enable-helm-playwright-tests: ${{ matrix.declination.use_tls && 'true' || 'false' }}
294+
helm-playwright-test-project: smoke-tests
295+
helm-playwright-test-auth-type: keycloak
290296

291297
- name: 🔬🚨 Debug - Show pod details on failure
292298
if: failure()

0 commit comments

Comments
 (0)