test-suite-e2e-tests.yml

name: test-suite-e2e-tests

on:
  workflow_dispatch:
    inputs: &workflow_inputs
      image_mode:
        description: "Use registry images or build workspace overrides on the runner"
        default: "registry"
        type: string
      override:
        description: "Comma-separated override values for workspace mode (for example: all, coprocessor, or coprocessor:host-listener)"
        default: ""
        type: string
      coprocessor-db-migration-version:
        description: "Coprocessor DB Migration Image Version"
        default: ""
        type: string
      coprocessor-host-listener-version:
        description: "Coprocessor Host Listener Image Version"
        default: ""
        type: string
      coprocessor-gw-listener-version:
        description: "Coprocessor Gateway Listener Image Version"
        default: ""
        type: string
      coprocessor-tx-sender-version:
        description: "Coprocessor Transaction Sender Image Version"
        default: ""
        type: string
      coprocessor-tfhe-worker-version:
        description: "Coprocessor TFHE Worker Image Version"
        default: ""
        type: string
      coprocessor-sns-worker-version:
        description: "Coprocessor SNS Worker Image Version"
        default: ""
        type: string
      coprocessor-zkproof-worker-version:
        description: "Coprocessor ZKProof Worker Image Version"
        default: ""
        type: string
      gateway-version:
        description: "Gateway version"
        default: ""
        type: string
      host-version:
        description: "Host version"
        default: ""
        type: string
      connector-db-migration-version:
        description: "KMS Connector DB Migration Image Version"
        default: ""
        type: string
      connector-gw-listener-version:
        description: "KMS Connector Gateway Listener Image Version"
        default: ""
        type: string
      connector-kms-worker-version:
        description: "KMS Connector KMS Worker Image Version"
        default: ""
        type: string
      connector-tx-sender-version:
        description: "KMS Connector Transaction Sender Image Version"
        default: ""
        type: string
      test-suite-version:
        description: "Test suite version"
        default: ""
        type: string
      relayer-version:
        description: "Relayer version"
        default: ""
        type: string
      kms-core-version:
        description: "KMS Core version"
        default: ""
        type: string
  workflow_call:
    secrets:
      GHCR_READ_TOKEN:
        required: true
      CGR_USERNAME:
        required: true
      CGR_PASSWORD:
        required: true
    inputs: *workflow_inputs

permissions: {}

# Allow to run multiple instances of the same workflow in parallel when triggered manually
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'workflow_dispatch' && github.run_id || 'auto' }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  fhevm-e2e-test:
    permissions:
      contents: 'read' # Required to checkout repository code
      id-token: 'write' # Required for OIDC authentication
      packages: 'read' # Required to read GitHub packages/container registry
    env:
      GH_TOKEN: ${{ secrets.GHCR_READ_TOKEN || github.token }}
      IMAGE_MODE: ${{ inputs.image_mode || 'registry' }}
      WORKSPACE_OVERRIDE: ${{ inputs.override || '' }}
      COPROCESSOR_DB_MIGRATION_VERSION: ${{ inputs.coprocessor-db-migration-version }}
      COPROCESSOR_HOST_LISTENER_VERSION: ${{ inputs.coprocessor-host-listener-version }}
      COPROCESSOR_GW_LISTENER_VERSION: ${{ inputs.coprocessor-gw-listener-version }}
      COPROCESSOR_TX_SENDER_VERSION: ${{ inputs.coprocessor-tx-sender-version }}
      COPROCESSOR_TFHE_WORKER_VERSION: ${{ inputs.coprocessor-tfhe-worker-version }}
      COPROCESSOR_SNS_WORKER_VERSION: ${{ inputs.coprocessor-sns-worker-version }}
      COPROCESSOR_ZKPROOF_WORKER_VERSION: ${{ inputs.coprocessor-zkproof-worker-version }}
      GATEWAY_VERSION: ${{ inputs.gateway-version }}
      HOST_VERSION: ${{ inputs.host-version }}
      CONNECTOR_DB_MIGRATION_VERSION: ${{ inputs.connector-db-migration-version }}
      CONNECTOR_GW_LISTENER_VERSION: ${{ inputs.connector-gw-listener-version }}
      CONNECTOR_KMS_WORKER_VERSION: ${{ inputs.connector-kms-worker-version }}
      CONNECTOR_TX_SENDER_VERSION: ${{ inputs.connector-tx-sender-version }}
      TEST_SUITE_VERSION: ${{ inputs.test-suite-version }}
      RELAYER_VERSION: ${{ inputs.relayer-version }}
      CORE_VERSION: ${{ inputs.kms-core-version }}
    runs-on: large_ubuntu_32
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: 'false'

      - name: Setup Docker
        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0

      - name: Setup Bun
        uses: oven-sh/setup-bun@ecf28ddc73e819eb6fa29df6b34ef8921c743461 # v2

      - name: Install foundry
        uses: foundry-rs/foundry-toolchain@82dee4ba654bd2146511f85f0d013af94670c4de # v1.4.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GHCR_READ_TOKEN }}

      - name: Login to Chainguard Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: cgr.dev
          username: ${{ secrets.CGR_USERNAME }}
          password: ${{ secrets.CGR_PASSWORD }}

      - name: Install CLI deps
        working-directory: test-suite/fhevm
        run: bun install --frozen-lockfile

      - name: Resolve CLI up args
        working-directory: test-suite/fhevm
        run: |
          set -euo pipefail
          args_file="$RUNNER_TEMP/fhevm-up-args"
          printf '%s\n%s\n' --target latest-release > "$args_file"
          case "$IMAGE_MODE" in
            registry)
              if [ -n "$WORKSPACE_OVERRIDE" ]; then
                echo "::error::override requires image_mode=workspace"
                exit 1
              fi
              ;;
            workspace)
              if [ -z "$WORKSPACE_OVERRIDE" ]; then
                echo "::error::image_mode=workspace requires override"
                exit 1
              fi
              IFS=',' read -r -a overrides <<< "$WORKSPACE_OVERRIDE"
              for raw in "${overrides[@]}"; do
                override="${raw#"${raw%%[![:space:]]*}"}"
                override="${override%"${override##*[![:space:]]}"}"
                [ -n "$override" ] || continue
                printf '%s\n%s\n' --override "$override" >> "$args_file"
              done
              if ! grep -qx -- --override "$args_file"; then
                echo "::error::override did not contain any usable values"
                exit 1
              fi
              ;;
            *)
              echo "::error::image_mode must be registry or workspace"
              exit 1
              ;;
          esac
          echo "UP_ARGS_FILE=$args_file" >> "$GITHUB_ENV"

      - name: Dry run
        working-directory: test-suite/fhevm
        run: |
          mapfile -t up_args < "$UP_ARGS_FILE"
          ./fhevm-cli up "${up_args[@]}" --dry-run

      - name: Boot fhevm Stack
        working-directory: test-suite/fhevm
        run: |
          mapfile -t up_args < "$UP_ARGS_FILE"
          ./fhevm-cli up "${up_args[@]}"

      # E2E tests on pausing the Host contracts
      - name: Pause Host Contracts
        working-directory: test-suite/fhevm
        run: |
          ./fhevm-cli pause host

      - name: Paused Host contracts test
        working-directory: test-suite/fhevm
        run: |
          ./fhevm-cli test paused-host-contracts

      - name: Unpause Host Contracts
        working-directory: test-suite/fhevm
        run: |
          ./fhevm-cli unpause host

      # E2E tests on pausing the Gateway contracts
      - name: Pause Gateway Contracts
        working-directory: test-suite/fhevm
        run: |
          ./fhevm-cli pause gateway

      - name: Paused Gateway contracts test
        working-directory: test-suite/fhevm
        run: |
          ./fhevm-cli test paused-gateway-contracts

      - name: Unpause Gateway Contracts
        working-directory: test-suite/fhevm
        run: |
          ./fhevm-cli unpause gateway

      # E2E tests after unpausing the Host and Gateway contracts
      - name: Input proof test (uint64)
        working-directory: test-suite/fhevm
        run: |
          ./fhevm-cli test input-proof

      - name: Input proof test with compute and decrypt (uint64)
        working-directory: test-suite/fhevm
        run: |
          ./fhevm-cli test input-proof-compute-decrypt

      - name: User Decryption test
        working-directory: test-suite/fhevm
        run: |
          ./fhevm-cli test user-decryption

      - name: Delegated User Decryption test
        working-directory: test-suite/fhevm
        run: |
          ./fhevm-cli test delegated-user-decryption

      - name: ERC20 test
        working-directory: test-suite/fhevm
        run: |
          ./fhevm-cli test erc20

      - name: Public Decryption HTTP endpoint test (ebool)
        working-directory: test-suite/fhevm
        run: |
          ./fhevm-cli test public-decrypt-http-ebool

      - name: Public Decryption HTTP endpoint test (mixed)
        working-directory: test-suite/fhevm
        run: |
          ./fhevm-cli test public-decrypt-http-mixed

      - name: Random operators test (subset)
        working-directory: test-suite/fhevm
        run: |
          ./fhevm-cli test random-subset

      - name: HCU block cap test
        working-directory: test-suite/fhevm
        run: |
          ./fhevm-cli test hcu-block-cap

      - name: Host listener poller test
        working-directory: test-suite/fhevm
        run: |
          docker stop coprocessor-host-listener
          ./fhevm-cli test erc20
          docker start coprocessor-host-listener

      - name: Show logs on test failure
        working-directory: test-suite/fhevm
        if: failure()
        run: |
          echo "::group::Relayer Logs"
          timeout 20 ./fhevm-cli logs fhevm-relayer || true
          echo "::endgroup::"
          echo "::group::SNS Worker Logs"
          timeout 20 ./fhevm-cli logs coprocessor-sns-worker | grep -v "Selected 0 rows to process" || true
          echo "::endgroup::"
          echo "::group::Transaction Sender Logs (filtered)"
          timeout 20 ./fhevm-cli logs coprocessor-transaction-sender | grep -v "Selected 0 rows to process" || true
          echo "::endgroup::"
          echo "::group::Host Listener"
          timeout 20 ./fhevm-cli logs coprocessor-host-listener || true
          echo "::endgroup::"
          echo "::group::Gateway Listener"
          timeout 20 ./fhevm-cli logs coprocessor-gw-listener || true
          echo "::endgroup::"
          echo "::group::ZKProof Worker"
          timeout 20 ./fhevm-cli logs coprocessor-zkproof-worker || true
          echo "::endgroup::"
          echo "::group::TFHE Worker"
          timeout 20 ./fhevm-cli logs coprocessor-tfhe-worker || true
          echo "::endgroup::"
          echo "::group::Coprocessor 2 - SNS Worker"
          ./fhevm-cli logs coprocessor-2-sns-worker 2>/dev/null | grep -v "Selected 0 rows to process" || true
          echo "::endgroup::"
          echo "::group::Coprocessor 2 - Transaction Sender (filtered)"
          ./fhevm-cli logs coprocessor-2-transaction-sender 2>/dev/null | grep -v "Selected 0 rows to process" || true
          echo "::endgroup::"
          echo "::group::Coprocessor 2 - TFHE Worker"
          ./fhevm-cli logs coprocessor-2-tfhe-worker 2>/dev/null || true
          echo "::endgroup::"

      - name: Cleanup
        working-directory: test-suite/fhevm
        if: always()
        run: |
          ./fhevm-cli clean --images