integration-docker.yml

# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
---
name: Integration (Docker)
on:
  workflow_call:
  pull_request:
  push: { branches: [master] }
  workflow_dispatch:
defaults: { run: { shell: pwsh } }
jobs:
  config:
    runs-on: ubuntu-latest
    permissions: { contents: read }
    outputs: { matrix: "${{ steps.pin.outputs.matrix }}" }
    steps:
      - uses: actions/checkout@v6.0.3
        with: { persist-credentials: false }
      - name: Resolve pinned @bitwarden/cli version
        id: pin
        run: |
          $spec = (gc package.json | ConvertFrom-Json).devDependencies.'@bitwarden/cli'
          $version = $spec -replace '^[\^~]', ''
          if ($version -notmatch '\A\d+\.\d+\.\d+([-.+][0-9A-Za-z.-]+)?\z') {
          	Write-Host "::error::Unexpected @bitwarden/cli version in package.json: '$spec'"; exit 1
          }
          $matrix = @{
          	include = @(
          		@{ experimental = $false; 'bw-version' = $version }
          		@{ experimental = $true; 'bw-version' = 'latest' }
          	)
          } | ConvertTo-Json -Compress -Depth 4
          "matrix=$matrix" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
          Write-Host "Matrix:"; $matrix | yq . -P

  e2e:
    needs: config
    runs-on: ubuntu-latest
    permissions: { contents: read }
    timeout-minutes: 15
    continue-on-error: ${{ matrix.experimental }}
    env:
      BW_SERVER_URL: https://localhost:18443
      BW_CERT_PATH: ${{ github.workspace }}/tests/fixtures/vaultwarden-certs/cert.pem
      KP2BW_SNAPSHOT_GOLDEN: ${{ !matrix.experimental }}
    strategy: { fail-fast: false, matrix: "${{ fromJson(needs.config.outputs.matrix) }}" }
    steps:
      - uses: actions/checkout@v6.0.3
        with: { persist-credentials: false }

      - name: Build Vaultwarden image
        run: docker build -f tests/Dockerfile.vaultwarden -t kp2bw-vaultwarden tests

      - name: Start Vaultwarden
        run: |
          docker run -d --name vaultwarden -p 18443:443 `
            -e I_REALLY_WANT_VOLATILE_STORAGE=true `
            -e SIGNUPS_ALLOWED=false `
            -e DOMAIN=$env:BW_SERVER_URL `
            -e ROCKET_PORT=443 `
            -e 'ROCKET_TLS={certs="/ssl/cert.pem",key="/ssl/key.pem"}' `
            kp2bw-vaultwarden

      - name: Wait for Vaultwarden
        run: |
          curl --retry 30 --retry-connrefused --retry-delay 2 -fsk $env:BW_SERVER_URL | Out-Null
          if ($LASTEXITCODE -ne 0) {
            Write-Host @"
          ::error::Vaultwarden did not become healthy
          ::group::Vaultwarden logs
          "@
            docker logs vaultwarden
            Write-Host ::endgroup::
            exit 1
          }
          Write-Host "Vaultwarden is healthy"

      - uses: astral-sh/setup-uv@v8.2.0
      - run: uv sync --frozen

      - name: Set up Bitwarden CLI (${{ matrix.bw-version }})
        uses: ./.github/actions/setup-bw
        with: { version: "${{ matrix.bw-version }}" }

      - name: Run Vaultwarden end-to-end migration test
        run: uv run tests/e2e_vaultwarden_test.py

      - name: Show Vaultwarden logs on failure
        if: failure() || cancelled()
        run: |
          Write-Host ::group::Vaultwarden` logs
          docker logs vaultwarden
          Write-Host ::endgroup::

      - name: Cleanup
        if: always()
        run: docker rm -f vaultwarden 2>$null; exit 0