run_integration_tests.yml

name: Run integration tests

on:
  workflow_call:
    inputs:
      lane:
        description: "Which lane to run (dev or latest)"
        required: true
        type: string
        default: "latest"
    secrets:
        INTEGRATION_TEST_AZURE_CLIENT_SECRET:
          required: true
          description: "Azure client secret for the service principal used in integration tests with access to keyvault"

  workflow_dispatch:
    inputs:
      lane:
        description: "Which lane to run (dev or latest)"
        required: true
        type: string
        default: "latest"

permissions:
  contents: read

env:
  KEYVAULT_NAME: FlotillaTestsKv
  AZURE_TENANT_ID: 3aa4a235-b6e2-48d5-9195-7fcf05b459b0
  AZURE_CLIENT_ID: 17d7c036-e4ff-4df6-87fd-0d648a36a727

  FLOTILLA_BACKEND_IMAGE: ghcr.io/equinor/flotilla-backend
  FLOTILLA_BROKER_IMAGE: ghcr.io/equinor/flotilla-broker
  POSTGRESQL_IMAGE: postgres:16
  ISAR_ROBOT_IMAGE: ghcr.io/equinor/isar-robot
  SARA_IMAGE: ghcr.io/equinor/sara
  AZURITE_IMAGE: mcr.microsoft.com/azure-storage/azurite:latest

jobs:
  tests:
    runs-on: ubuntu-latest

    steps:
      - name: Azure login
        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43
        with:
          creds: '{"clientId":"${{ env.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.INTEGRATION_TEST_AZURE_CLIENT_SECRET }}","tenantId":"${{ env.AZURE_TENANT_ID }}"}'
          allow-no-subscriptions: 'true'

      - name: Retrieve secrets from Key Vault
        id: kv
        shell: bash
        run: |
          echo "Retrieving secrets from Key Vault: $KEYVAULT_NAME"

          # You can list the secret names here
          secrets=(
            INTEGRATION-TESTS-CLIENT-SECRET
            FLOTILLA-MQTT-PASSWORD
            FLOTILLA-AZURE-CLIENT-SECRET
            FLOTILLA-BROKER-SERVER-KEY
            ISAR-AZURE-CLIENT-SECRET
            ISAR-MQTT-PASSWORD
            SARA-AZURE-CLIENT-SECRET
            SARA-MQTT-PASSWORD
          )

          for name in "${secrets[@]}"; do
            value=$(az keyvault secret show \
              --vault-name "$KEYVAULT_NAME" \
              --name "$name" \
              --query value -o tsv)
          
            # Mask the value in any future log output
            echo "::add-mask::$value"
          
            # Replace hyphens with underscores and export to env
            safe_name="${name//-/_}"
            echo "${safe_name}=$value" >> $GITHUB_ENV
          done

      - name: Checkout armada repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6
        with:
          repository: equinor/armada
          ref: main
          path: ./integration-tests

      - name: Compose image references
        id: images
        run: |
          TAG="${{ inputs.lane }}"
          echo "flotilla_backend=${{ env.FLOTILLA_BACKEND_IMAGE }}:${TAG}"  >> $GITHUB_OUTPUT
          echo "flotilla_broker=${{ env.FLOTILLA_BROKER_IMAGE }}:${TAG}"    >> $GITHUB_OUTPUT
          echo "postgres=${{ env.POSTGRESQL_IMAGE }}"                       >> $GITHUB_OUTPUT
          echo "isar_robot=${{ env.ISAR_ROBOT_IMAGE }}:${TAG}"              >> $GITHUB_OUTPUT
          echo "sara=${{ env.SARA_IMAGE }}:${TAG}"                          >> $GITHUB_OUTPUT
          echo "azurite=${{ env.AZURITE_IMAGE }}"                           >> $GITHUB_OUTPUT
          echo "git_ref=$TAG"                                               >> $GITHUB_OUTPUT

      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b #v8.1.0
        with:
          enable-cache: true
          python-version: "3.14"

      - name: Install dependencies
        working-directory: integration-tests
        run: uv sync --frozen

      - name: Run integration tests with pytest
        working-directory: integration-tests
        env:
          FLOTILLA_BACKEND_IMAGE: ${{ steps.images.outputs.flotilla_backend }}
          FLOTILLA_BROKER_IMAGE: ${{ steps.images.outputs.flotilla_broker }}
          POSTGRESQL_IMAGE: ${{ steps.images.outputs.postgres }}
          ISAR_ROBOT_IMAGE: ${{ steps.images.outputs.isar_robot }}
          SARA_IMAGE: ${{ steps.images.outputs.sara }}
          AZURITE_IMAGE: ${{ steps.images.outputs.azurite }}
          GIT_REPOSITORY_FOR_MIGRATIONS_REF: ${{ steps.images.outputs.git_ref }}
          SARA_GIT_REPOSITORY_FOR_MIGRATIONS_REF: ${{ steps.images.outputs.git_ref }}

          INTEGRATION_TESTS_CLIENT_SECRET: ${{ env.INTEGRATION_TESTS_CLIENT_SECRET }}
          FLOTILLA_MQTT_PASSWORD: ${{ env.FLOTILLA_MQTT_PASSWORD }}
          FLOTILLA_AZURE_CLIENT_SECRET: ${{ env.FLOTILLA_AZURE_CLIENT_SECRET }}
          FLOTILLA_BROKER_SERVER_KEY: ${{ env.FLOTILLA_BROKER_SERVER_KEY }}
          ISAR_AZURE_CLIENT_SECRET: ${{ env.ISAR_AZURE_CLIENT_SECRET }}
          ISAR_MQTT_PASSWORD: ${{ env.ISAR_MQTT_PASSWORD }}
          SARA_AZURE_CLIENT_SECRET: ${{ env.SARA_AZURE_CLIENT_SECRET }}
          SARA_MQTT_PASSWORD: ${{ env.SARA_MQTT_PASSWORD }}

        run: uv run --frozen pytest -s -n auto robotics_integration_tests