test-suite-orchestrate-e2e-tests.yml

name: test-suite-orchestrate-e2e-tests

on:
  pull_request:
    branches:
      - main
      - release/*

permissions: {}

concurrency:
  group: test-suite-orchestrate-e2e-tests-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  coprocessor-docker-build:
    if: &build-trigger-condition |
      startsWith(github.head_ref, 'mergify/merge-queue/') || startsWith(github.base_ref, 'release/')
    uses: ./.github/workflows/coprocessor-docker-build.yml
    permissions: &docker_permissions
      actions: 'read' # Required to read workflow run information
      contents: 'read' # Required to checkout repository code
      pull-requests: 'read' # Required to read pull request information
      attestations: 'write' # Required to create build attestations
      packages: 'write' # Required to publish Docker images
      id-token: 'write' # Required for OIDC authentication
    secrets: &docker_secrets
      AWS_ACCESS_KEY_S3_USER: ${{ secrets.AWS_ACCESS_KEY_S3_USER }}
      AWS_SECRET_KEY_S3_USER: ${{ secrets.AWS_SECRET_KEY_S3_USER }}
      BLOCKCHAIN_ACTIONS_TOKEN: ${{ secrets.BLOCKCHAIN_ACTIONS_TOKEN }}
      GHCR_READ_TOKEN: ${{ secrets.GHCR_READ_TOKEN }}
      CGR_USERNAME: ${{ secrets.CGR_USERNAME }}
      CGR_PASSWORD: ${{ secrets.CGR_PASSWORD }}
  gateway-contracts-docker-build:
    if: *build-trigger-condition
    uses: ./.github/workflows/gateway-contracts-docker-build.yml
    permissions: *docker_permissions
    secrets: *docker_secrets
  host-contracts-docker-build:
    if: *build-trigger-condition
    uses: ./.github/workflows/host-contracts-docker-build.yml
    permissions: *docker_permissions
    secrets: *docker_secrets
  kms-connector-docker-build:
    if: *build-trigger-condition
    uses: ./.github/workflows/kms-connector-docker-build.yml
    permissions: *docker_permissions
    secrets: *docker_secrets
  test-suite-docker-build:
    if: *build-trigger-condition
    uses: ./.github/workflows/test-suite-docker-build.yml
    permissions: *docker_permissions
    secrets: *docker_secrets

  create-e2e-tests-input:
    name: create-e2e-tests-input
    needs:
      - coprocessor-docker-build
      - gateway-contracts-docker-build
      - host-contracts-docker-build
      - kms-connector-docker-build
      - test-suite-docker-build
    if: ${{ success() || failure() }}
    env:
      PREVIOUS_COMMIT_HASH: ${{ github.event.pull_request.base.sha }}
      NEW_COMMIT_HASH: ${{ github.event.pull_request.head.sha }}
      DOCKER_BUILD_RESULTS: ${{ toJSON(needs) }}
    runs-on: ubuntu-latest
    outputs:
      coprocessor-db-migration-version: ${{ steps.create-e2e-tests-input.outputs.coprocessor-db-migration-version }}
      coprocessor-gw-listener-version: ${{ steps.create-e2e-tests-input.outputs.coprocessor-gw-listener-version }}
      coprocessor-host-listener-version: ${{ steps.create-e2e-tests-input.outputs.coprocessor-host-listener-version }}
      coprocessor-sns-worker-version: ${{ steps.create-e2e-tests-input.outputs.coprocessor-sns-worker-version }}
      coprocessor-tfhe-worker-version: ${{ steps.create-e2e-tests-input.outputs.coprocessor-tfhe-worker-version }}
      coprocessor-tx-sender-version: ${{ steps.create-e2e-tests-input.outputs.coprocessor-tx-sender-version }}
      coprocessor-zkproof-worker-version: ${{ steps.create-e2e-tests-input.outputs.coprocessor-zkproof-worker-version }}
      connector-db-migration-version: ${{ steps.create-e2e-tests-input.outputs.connector-db-migration-version }}
      connector-gw-listener-version: ${{ steps.create-e2e-tests-input.outputs.connector-gw-listener-version }}
      connector-kms-worker-version: ${{ steps.create-e2e-tests-input.outputs.connector-kms-worker-version }}
      connector-tx-sender-version: ${{ steps.create-e2e-tests-input.outputs.connector-tx-sender-version }}
      gateway-version: ${{ steps.create-e2e-tests-input.outputs.gateway-version }}
      host-version: ${{ steps.create-e2e-tests-input.outputs.host-version }}
      stack-era: ${{ steps.create-e2e-tests-input.outputs.stack-era }}
      test-suite-version: ${{ steps.create-e2e-tests-input.outputs.test-suite-version }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          persist-credentials: 'false'

      - name: Setup Bun
        uses: oven-sh/setup-bun@ecf28ddc73e819eb6fa29df6b34ef8921c743461 # v2.1.3

      - name: Install CLI deps
        working-directory: test-suite/fhevm
        run: bun install --frozen-lockfile

      - name: Read compat anchors
        working-directory: test-suite/fhevm
        run: |
          defaults=$(./fhevm-cli compat-defaults)
          echo "SIMPLE_ACL_CUTOVER=$(echo "$defaults" | jq -r .anchors.SIMPLE_ACL_MIN_SHA)" >> "$GITHUB_ENV"

      - id: create-e2e-tests-input
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v0.8.0
        with:
          script: |
            const previousCommitHash = process.env.PREVIOUS_COMMIT_HASH;
            const newCommitHash = process.env.NEW_COMMIT_HASH;
            const simpleAclCutover = process.env.SIMPLE_ACL_CUTOVER;
            console.log(`Previous commit hash: ${previousCommitHash}`)
            console.log(`New commit hash: ${newCommitHash}`)
            console.log(`Docker build results: ${process.env.DOCKER_BUILD_RESULTS}`)

            const { execSync } = require('child_process');
            const dockerBuildResults = JSON.parse(process.env.DOCKER_BUILD_RESULTS);
            const selectedCommits = new Set();
            function getSelectedCommit(key, build_result) {
              return dockerBuildResults[key].outputs[build_result] === 'success' ? newCommitHash : previousCommitHash;
            }
            function getImageTagIfBuilt(key, build_result) {
              const imageCommit = getSelectedCommit(key, build_result);
              selectedCommits.add(imageCommit);
              let imageTag;
              try {
                imageTag = execSync(`git rev-parse --short=7 ${imageCommit}`, { encoding: 'utf8' }).trim();
              } catch (err) {
                console.log(`Failed to resolve short hash for ${imageCommit}, falling back to substring`);
                imageTag = imageCommit.substring(0, 7);
              }
              console.log(`Assigning image tag '${imageTag}' for ${key}`);
              return imageTag;
            }

            core.setOutput('coprocessor-db-migration-version', getImageTagIfBuilt('coprocessor-docker-build', 'db_migration_build_result'));
            core.setOutput('coprocessor-gw-listener-version', getImageTagIfBuilt('coprocessor-docker-build', 'gw_listener_build_result'));
            core.setOutput('coprocessor-host-listener-version', getImageTagIfBuilt('coprocessor-docker-build', 'host_listener_build_result'));
            core.setOutput('coprocessor-sns-worker-version', getImageTagIfBuilt('coprocessor-docker-build', 'sns_worker_build_result'));
            core.setOutput('coprocessor-tfhe-worker-version', getImageTagIfBuilt('coprocessor-docker-build', 'tfhe_worker_build_result'));
            core.setOutput('coprocessor-tx-sender-version', getImageTagIfBuilt('coprocessor-docker-build', 'tx_sender_build_result'));
            core.setOutput('coprocessor-zkproof-worker-version', getImageTagIfBuilt('coprocessor-docker-build', 'zkproof_worker_build_result'));

            core.setOutput('connector-db-migration-version', getImageTagIfBuilt('kms-connector-docker-build', 'db_migration_build_result'));
            core.setOutput('connector-gw-listener-version', getImageTagIfBuilt('kms-connector-docker-build', 'gw_listener_build_result'));
            core.setOutput('connector-kms-worker-version', getImageTagIfBuilt('kms-connector-docker-build', 'kms_worker_build_result'));
            core.setOutput('connector-tx-sender-version', getImageTagIfBuilt('kms-connector-docker-build', 'tx_sender_build_result'));

            core.setOutput('gateway-version', getImageTagIfBuilt('gateway-contracts-docker-build', 'build_result'));
            core.setOutput('host-version', getImageTagIfBuilt('host-contracts-docker-build', 'build_result'));
            core.setOutput('test-suite-version', getImageTagIfBuilt('test-suite-docker-build', 'build_result'));

            const needsModernRelayer = [...selectedCommits].some((commit) => {
              try {
                execSync(`git merge-base --is-ancestor ${simpleAclCutover} ${commit}`, { stdio: 'ignore' });
                return true;
              } catch (err) {
                return false;
              }
            });
            if (needsModernRelayer) {
              console.log("Selected stack crosses simple-ACL cutover; assigning modern stack era");
              core.setOutput('stack-era', 'modern');
            }

  run-e2e-tests:
    needs: [create-e2e-tests-input]
    uses:
      ./.github/workflows/test-suite-e2e-tests.yml
    permissions:
      contents: 'read' # Required to checkout repository code
      id-token: 'write' # Required for OIDC authentication
      packages: 'read' # Required to read GitHub packages/container registry
    secrets:
      GHCR_READ_TOKEN: ${{ secrets.GHCR_READ_TOKEN }}
      CGR_USERNAME: ${{ secrets.CGR_USERNAME }}
      CGR_PASSWORD: ${{ secrets.CGR_PASSWORD }}
    with:
      image_mode: registry
      coprocessor-db-migration-version: ${{ needs.create-e2e-tests-input.outputs.coprocessor-db-migration-version }}
      coprocessor-gw-listener-version: ${{ needs.create-e2e-tests-input.outputs.coprocessor-gw-listener-version }}
      coprocessor-host-listener-version: ${{ needs.create-e2e-tests-input.outputs.coprocessor-host-listener-version }}
      coprocessor-sns-worker-version: ${{ needs.create-e2e-tests-input.outputs.coprocessor-sns-worker-version }}
      coprocessor-tfhe-worker-version: ${{ needs.create-e2e-tests-input.outputs.coprocessor-tfhe-worker-version }}
      coprocessor-tx-sender-version: ${{ needs.create-e2e-tests-input.outputs.coprocessor-tx-sender-version }}
      coprocessor-zkproof-worker-version: ${{ needs.create-e2e-tests-input.outputs.coprocessor-zkproof-worker-version }}
      connector-db-migration-version: ${{ needs.create-e2e-tests-input.outputs.connector-db-migration-version }}
      connector-gw-listener-version: ${{ needs.create-e2e-tests-input.outputs.connector-gw-listener-version }}
      connector-kms-worker-version: ${{ needs.create-e2e-tests-input.outputs.connector-kms-worker-version }}
      connector-tx-sender-version: ${{ needs.create-e2e-tests-input.outputs.connector-tx-sender-version }}
      gateway-version: ${{ needs.create-e2e-tests-input.outputs.gateway-version }}
      host-version: ${{ needs.create-e2e-tests-input.outputs.host-version }}
      stack-era: ${{ needs.create-e2e-tests-input.outputs.stack-era }}
      test-suite-version: ${{ needs.create-e2e-tests-input.outputs.test-suite-version }}