test-suite-orchestrate-e2e-tests.yml

name: test-suite-orchestrate-e2e-tests

on:
  pull_request:
    types: [opened, synchronize, reopened, labeled, unlabeled]
    branches:
      - main
      - release/*

permissions: {}

concurrency:
  group: test-suite-orchestrate-e2e-tests-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  coprocessor-docker-build:
    if: &build-trigger-condition |
      startsWith(github.head_ref, 'mergify/merge-queue/') || startsWith(github.base_ref, 'release/') || contains(github.event.pull_request.labels.*.name, 'e2e orchestrate test')
    uses: ./.github/workflows/coprocessor-docker-build.yml
    permissions: &docker_permissions
      actions: 'read' # Required to read workflow run information
      contents: 'read' # Required to checkout repository code
      pull-requests: 'read' # Required to read pull request information
      attestations: 'write' # Required to create build attestations
      packages: 'write' # Required to publish Docker images
      id-token: 'write' # Required for OIDC authentication
    secrets: &docker_secrets
      AWS_ACCESS_KEY_S3_USER: ${{ secrets.AWS_ACCESS_KEY_S3_USER }}
      AWS_SECRET_KEY_S3_USER: ${{ secrets.AWS_SECRET_KEY_S3_USER }}
      BLOCKCHAIN_ACTIONS_TOKEN: ${{ secrets.BLOCKCHAIN_ACTIONS_TOKEN }}
      GHCR_READ_TOKEN: ${{ secrets.GHCR_READ_TOKEN }}
      CGR_USERNAME: ${{ secrets.CGR_USERNAME }}
      CGR_PASSWORD: ${{ secrets.CGR_PASSWORD }}
  gateway-contracts-docker-build:
    if: *build-trigger-condition
    uses: ./.github/workflows/gateway-contracts-docker-build.yml
    permissions: *docker_permissions
    secrets: *docker_secrets
  host-contracts-docker-build:
    if: *build-trigger-condition
    uses: ./.github/workflows/host-contracts-docker-build.yml
    permissions: *docker_permissions
    secrets: *docker_secrets
  kms-connector-docker-build:
    if: *build-trigger-condition
    uses: ./.github/workflows/kms-connector-docker-build.yml
    permissions: *docker_permissions
    secrets: *docker_secrets
  relayer-docker-build:
    if: *build-trigger-condition
    uses: ./.github/workflows/relayer-docker-build.yml
    permissions: *docker_permissions
    secrets: *docker_secrets
  test-suite-docker-build:
    if: *build-trigger-condition
    uses: ./.github/workflows/test-suite-docker-build.yml
    permissions: *docker_permissions
    secrets: *docker_secrets

  create-e2e-tests-input:
    name: create-e2e-tests-input
    needs:
      - coprocessor-docker-build
      - gateway-contracts-docker-build
      - host-contracts-docker-build
      - kms-connector-docker-build
      - relayer-docker-build
      - test-suite-docker-build
    if: ${{ (success() || failure()) && (startsWith(github.head_ref, 'mergify/merge-queue/') || startsWith(github.base_ref, 'release/') || contains(github.event.pull_request.labels.*.name, 'e2e orchestrate test')) }}
    permissions:
      contents: 'read' # Required to read the checked-in release baseline defaults
    env:
      BASE_COMMIT_HASH: ${{ github.event.pull_request.base.sha }}
      NEW_COMMIT_HASH: ${{ github.event.pull_request.head.sha }}
      IS_RELEASE_PR: ${{ startsWith(github.base_ref, 'release/') }}
      DOCKER_BUILD_RESULTS: ${{ toJSON(needs) }}
    runs-on: ubuntu-latest
    outputs:
      coprocessor-db-migration-version: ${{ steps.create-e2e-tests-input.outputs.coprocessor-db-migration-version }}
      coprocessor-gw-listener-version: ${{ steps.create-e2e-tests-input.outputs.coprocessor-gw-listener-version }}
      coprocessor-host-listener-version: ${{ steps.create-e2e-tests-input.outputs.coprocessor-host-listener-version }}
      coprocessor-sns-worker-version: ${{ steps.create-e2e-tests-input.outputs.coprocessor-sns-worker-version }}
      coprocessor-tfhe-worker-version: ${{ steps.create-e2e-tests-input.outputs.coprocessor-tfhe-worker-version }}
      coprocessor-tx-sender-version: ${{ steps.create-e2e-tests-input.outputs.coprocessor-tx-sender-version }}
      coprocessor-zkproof-worker-version: ${{ steps.create-e2e-tests-input.outputs.coprocessor-zkproof-worker-version }}
      connector-db-migration-version: ${{ steps.create-e2e-tests-input.outputs.connector-db-migration-version }}
      connector-gw-listener-version: ${{ steps.create-e2e-tests-input.outputs.connector-gw-listener-version }}
      connector-kms-worker-version: ${{ steps.create-e2e-tests-input.outputs.connector-kms-worker-version }}
      connector-tx-sender-version: ${{ steps.create-e2e-tests-input.outputs.connector-tx-sender-version }}
      gateway-version: ${{ steps.create-e2e-tests-input.outputs.gateway-version }}
      host-version: ${{ steps.create-e2e-tests-input.outputs.host-version }}
      kms-core-version: ${{ steps.create-e2e-tests-input.outputs.kms-core-version }}
      relayer-migrate-version: ${{ steps.create-e2e-tests-input.outputs.relayer-migrate-version }}
      relayer-version: ${{ steps.create-e2e-tests-input.outputs.relayer-version }}
      test-suite-version: ${{ steps.create-e2e-tests-input.outputs.test-suite-version }}
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: 'false'
          fetch-depth: 0

      - id: create-e2e-tests-input
        run: |
          set -euo pipefail
          short_tag="$(git rev-parse --short=7 "$NEW_COMMIT_HASH")"
          base_short_tag="$(git rev-parse --short=7 "$BASE_COMMIT_HASH")"
          needs_file="$RUNNER_TEMP/docker-build-results.json"
          printf '%s' "$DOCKER_BUILD_RESULTS" > "$needs_file"

          outputs=(
            coprocessor-db-migration-version
            coprocessor-gw-listener-version
            coprocessor-host-listener-version
            coprocessor-sns-worker-version
            coprocessor-tfhe-worker-version
            coprocessor-tx-sender-version
            coprocessor-zkproof-worker-version
            connector-db-migration-version
            connector-gw-listener-version
            connector-kms-worker-version
            connector-tx-sender-version
            gateway-version
            host-version
            kms-core-version
            relayer-migrate-version
            relayer-version
            test-suite-version
          )
          for key in "${outputs[@]}"; do
            echo "$key=" >> "$GITHUB_OUTPUT"
          done

          if [ "$IS_RELEASE_PR" = "true" ]; then
            if git cat-file -e "${BASE_COMMIT_HASH}:test-suite/fhevm/profiles/latest-supported.json" 2>/dev/null; then
              core_version="$(git show "${BASE_COMMIT_HASH}:test-suite/fhevm/profiles/latest-supported.json" | python3 -c 'import json,sys; print(json.load(sys.stdin)["env"]["CORE_VERSION"])')"
            elif git cat-file -e "${BASE_COMMIT_HASH}:test-suite/fhevm/fhevm-cli" 2>/dev/null; then
              core_version="$(git show "${BASE_COMMIT_HASH}:test-suite/fhevm/fhevm-cli" | sed -n 's/^export CORE_VERSION=.*:-"\\([^"]*\\)".*/\\1/p' | head -n 1)"
            else
              core_version=""
            fi
            if [ -z "$core_version" ]; then
              echo "Could not extract CORE_VERSION from release base ${BASE_COMMIT_HASH}" >&2
              exit 1
            fi
            echo "kms-core-version=$core_version" >> "$GITHUB_OUTPUT"
          fi

          failures=()
          while IFS='|' read -r job result_key output_key; do
            result="$(jq -r --arg job "$job" --arg key "$result_key" '.[$job].outputs[$key] // "missing"' "$needs_file")"
            case "$result" in
              success)
                echo "$output_key=$short_tag" >> "$GITHUB_OUTPUT"
                ;;
              skipped)
                echo "$output_key=$base_short_tag" >> "$GITHUB_OUTPUT"
                ;;
              *)
                failures+=("$job.$result_key=$result")
                ;;
            esac
          done <<'EOF'
          coprocessor-docker-build|db_migration_build_result|coprocessor-db-migration-version
          coprocessor-docker-build|gw_listener_build_result|coprocessor-gw-listener-version
          coprocessor-docker-build|host_listener_build_result|coprocessor-host-listener-version
          coprocessor-docker-build|sns_worker_build_result|coprocessor-sns-worker-version
          coprocessor-docker-build|tfhe_worker_build_result|coprocessor-tfhe-worker-version
          coprocessor-docker-build|tx_sender_build_result|coprocessor-tx-sender-version
          coprocessor-docker-build|zkproof_worker_build_result|coprocessor-zkproof-worker-version
          kms-connector-docker-build|db_migration_build_result|connector-db-migration-version
          kms-connector-docker-build|gw_listener_build_result|connector-gw-listener-version
          kms-connector-docker-build|kms_worker_build_result|connector-kms-worker-version
          kms-connector-docker-build|tx_sender_build_result|connector-tx-sender-version
          gateway-contracts-docker-build|build_result|gateway-version
          host-contracts-docker-build|build_result|host-version
          relayer-docker-build|relayer_migrate_build_result|relayer-migrate-version
          relayer-docker-build|relayer_build_result|relayer-version
          test-suite-docker-build|build_result|test-suite-version
          EOF

          if [ "${#failures[@]}" -gt 0 ]; then
            echo "Required repo-owned build outputs failed: ${failures[*]}" >&2
            exit 1
          fi

  run-e2e-tests:
    needs: [create-e2e-tests-input]
    if: ${{ startsWith(github.head_ref, 'mergify/merge-queue/') || startsWith(github.base_ref, 'release/') || contains(github.event.pull_request.labels.*.name, 'e2e orchestrate test') }}
    uses:
      ./.github/workflows/test-suite-e2e-tests.yml
    permissions:
      contents: 'read' # Required to checkout repository code
      id-token: 'write' # Required for OIDC authentication
      packages: 'read' # Required to read GitHub packages/container registry
    secrets:
      GHCR_READ_TOKEN: ${{ secrets.GHCR_READ_TOKEN }}
      CGR_USERNAME: ${{ secrets.CGR_USERNAME }}
      CGR_PASSWORD: ${{ secrets.CGR_PASSWORD }}
    with:
      orchestrated: true
      build: false
      coprocessor-db-migration-version: ${{ needs.create-e2e-tests-input.outputs.coprocessor-db-migration-version }}
      coprocessor-gw-listener-version: ${{ needs.create-e2e-tests-input.outputs.coprocessor-gw-listener-version }}
      coprocessor-host-listener-version: ${{ needs.create-e2e-tests-input.outputs.coprocessor-host-listener-version }}
      coprocessor-sns-worker-version: ${{ needs.create-e2e-tests-input.outputs.coprocessor-sns-worker-version }}
      coprocessor-tfhe-worker-version: ${{ needs.create-e2e-tests-input.outputs.coprocessor-tfhe-worker-version }}
      coprocessor-tx-sender-version: ${{ needs.create-e2e-tests-input.outputs.coprocessor-tx-sender-version }}
      coprocessor-zkproof-worker-version: ${{ needs.create-e2e-tests-input.outputs.coprocessor-zkproof-worker-version }}
      connector-db-migration-version: ${{ needs.create-e2e-tests-input.outputs.connector-db-migration-version }}
      connector-gw-listener-version: ${{ needs.create-e2e-tests-input.outputs.connector-gw-listener-version }}
      connector-kms-worker-version: ${{ needs.create-e2e-tests-input.outputs.connector-kms-worker-version }}
      connector-tx-sender-version: ${{ needs.create-e2e-tests-input.outputs.connector-tx-sender-version }}
      gateway-version: ${{ needs.create-e2e-tests-input.outputs.gateway-version }}
      host-version: ${{ needs.create-e2e-tests-input.outputs.host-version }}
      kms-core-version: ${{ needs.create-e2e-tests-input.outputs.kms-core-version }}
      relayer-migrate-version: ${{ needs.create-e2e-tests-input.outputs.relayer-migrate-version }}
      relayer-version: ${{ needs.create-e2e-tests-input.outputs.relayer-version }}
      scenario: ${{ startsWith(github.base_ref, 'release/') && 'two-of-two' || 'two-of-two-multi-chain' }}
      test-suite-version: ${{ needs.create-e2e-tests-input.outputs.test-suite-version }}