e2e-api.yml

# E2E API - Venom API tests on Vercel preview deploys
# Trigger: deployment_status (Vercel webhook)
# Parallel: runs alongside e2e-web on preview deploy
name: e2e-api

on:
  deployment_status:

permissions:
  contents: read
  pull-requests: read

jobs:
  api-tests:
    if: >
      github.event.deployment_status.state == 'success' &&
      github.event.deployment_status.environment_url != '' &&
      (startsWith(github.event.deployment_status.environment_url, 'https://') ||
       startsWith(github.event.deployment_status.environment_url, 'http://')) &&
      (github.event.deployment.environment == 'Preview' || github.event.deployment.environment == 'preview')
    runs-on: blacksmith-2vcpu-ubuntu-2404
    timeout-minutes: 20
    steps:
      - name: Check for doc-only changes
        id: doc_check
        uses: actions/github-script@v7
        with:
          script: |
            const { owner, repo } = context.repo;
            const sha =
              context.payload.deployment?.sha ??
              context.payload.deployment_status?.deployment?.sha;
            if (!sha) {
              core.warning("No deployment SHA found; running tests.");
              core.setOutput("run_tests", "true");
              return;
            }
            let prs = [];
            try {
              const response =
                await github.rest.repos.listPullRequestsAssociatedWithCommit({
                  owner,
                  repo,
                  commit_sha: sha,
                });
              prs = response.data ?? [];
            } catch (error) {
              core.warning(`Failed to resolve PR for ${sha}: ${error.message}`);
              core.setOutput("run_tests", "true");
              return;
            }
            if (!prs.length) {
              core.notice(`No PR found for ${sha}; running tests.`);
              core.setOutput("run_tests", "true");
              return;
            }
            const pr = prs[0];
            const prNumber = pr.number;
            const isBumpPr =
              pr.title?.startsWith("chore: bump version") ||
              pr.head?.ref?.startsWith("chore/bump-version");
            if (isBumpPr) {
              core.notice("Bump PR detected; skipping E2E API tests.");
              core.setOutput("run_tests", "false");
              return;
            }
            const files = await github.paginate(
              github.rest.pulls.listFiles,
              { owner, repo, pull_number: prNumber, per_page: 100 }
            );
            const docOnly = files.every(
              (file) =>
                file.filename === "README.md" ||
                file.filename === "AGENTS.md" ||
                file.filename.startsWith("docs/") ||
                file.filename.startsWith(".codex/") ||
                file.filename.startsWith("packages/opencode-excalidraw/") ||
                file.filename.startsWith(".github/workflows/opencode-excalidraw-")
            );
            core.setOutput("run_tests", docOnly ? "false" : "true");
            if (docOnly) {
              core.notice("Docs-only change; skipping E2E API tests.");
            }

      - name: Checkout
        if: steps.doc_check.outputs.run_tests == 'true'
        uses: actions/checkout@v4

      - name: Setup Bun
        if: steps.doc_check.outputs.run_tests == 'true'
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.5"

      - name: Install Dependencies
        if: steps.doc_check.outputs.run_tests == 'true'
        run: bun install --frozen-lockfile

      - name: Install Playwright browsers
        if: steps.doc_check.outputs.run_tests == 'true'
        run: ./packages/backend/node_modules/.bin/playwright install --with-deps

      - name: Install Venom
        if: steps.doc_check.outputs.run_tests == 'true'
        run: |
          curl -L -o venom https://github.com/ovh/venom/releases/download/v1.3.0/venom.linux-amd64
          chmod +x venom
          sudo mv venom /usr/local/bin/

      - name: Run API tests
        if: steps.doc_check.outputs.run_tests == 'true'
        env:
          BYPASS_SECRET: ${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}
          SKETCHI_E2E_EMAIL: ${{ secrets.SKETCHI_E2E_EMAIL }}
          SKETCHI_E2E_PASSWORD: ${{ secrets.SKETCHI_E2E_PASSWORD }}
          VENOM_VAR_target_url: ${{ github.event.deployment_status.environment_url }}
          VENOM_VAR_bypass_secret: ${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}
        run: |
          if [ -z "$BYPASS_SECRET" ]; then
            echo "Missing required secret: VERCEL_AUTOMATION_BYPASS_SECRET"
            exit 1
          fi
          if [ -z "$SKETCHI_E2E_EMAIL" ]; then
            echo "Missing required secret: SKETCHI_E2E_EMAIL"
            exit 1
          fi
          if [ -z "$SKETCHI_E2E_PASSWORD" ]; then
            echo "Missing required secret: SKETCHI_E2E_PASSWORD"
            exit 1
          fi

          API_AUTH_TOKEN="$(
            TARGET_URL="${{ github.event.deployment_status.environment_url }}" \
            BYPASS_SECRET="$BYPASS_SECRET" \
            SKETCHI_E2E_EMAIL="$SKETCHI_E2E_EMAIL" \
            SKETCHI_E2E_PASSWORD="$SKETCHI_E2E_PASSWORD" \
            bun packages/backend/scripts/mint-device-token.mjs
          )"
          if [ -z "$API_AUTH_TOKEN" ]; then
            echo "Failed to mint auth token via device flow."
            exit 1
          fi

          echo "::add-mask::$BYPASS_SECRET"
          echo "::add-mask::$API_AUTH_TOKEN"
          export VENOM_VAR_auth_token="$API_AUTH_TOKEN"
          venom run tests/api/auth-device.yml tests/api/diagrams.yml \
            --output-dir tests/api/results \
            --format xml

      - name: Collect Venom log
        if: always() && steps.doc_check.outputs.run_tests == 'true'
        run: |
          mkdir -p tests/api/results
          if [ -f venom.log ]; then
            cp venom.log tests/api/results/venom.log
          fi

      - name: Summarize API tests
        if: always() && steps.doc_check.outputs.run_tests == 'true'
        run: |
          node -e "
          const fs = require('fs');
          const path = require('path');
          const resultsDir = path.join(process.cwd(), 'tests', 'api', 'results');
          const summaryPath = process.env.GITHUB_STEP_SUMMARY;
          const lines = [];
          lines.push('## API Test Results');
          if (!fs.existsSync(resultsDir)) {
            lines.push('No results directory found.');
            fs.appendFileSync(summaryPath, lines.join('\\n') + '\\n');
            process.exit(0);
          }
          const xmlFiles = fs.readdirSync(resultsDir).filter((f) => f.endsWith('.xml'));
          if (xmlFiles.length === 0) {
            lines.push('No XML results found.');
            fs.appendFileSync(summaryPath, lines.join('\\n') + '\\n');
            process.exit(0);
          }
          let totalTests = 0;
          let totalFailures = 0;
          const testcases = [];
          for (const file of xmlFiles) {
            const xml = fs.readFileSync(path.join(resultsDir, file), 'utf8');
            const testsMatch = xml.match(/tests=\\\"(\\d+)\\\"/);
            if (testsMatch) {
              totalTests += Number(testsMatch[1] || 0);
            }
            const failureCount =
              (xml.match(/<failure\\b/g) || []).length +
              (xml.match(/<error\\b/g) || []).length;
            totalFailures += failureCount;
            const caseRegex = /<testcase[^>]*name=\\\"([^\\\"]+)\\\"/g;
            let match;
            while ((match = caseRegex.exec(xml)) !== null) {
              testcases.push(match[1]);
            }
          }
          lines.push('Total tests: ' + totalTests);
          lines.push('Failures: ' + totalFailures);
          if (testcases.length > 0) {
            lines.push('Testcases:');
            for (const name of testcases) {
              lines.push('- ' + name);
            }
          }
          fs.appendFileSync(summaryPath, lines.join('\\n') + '\\n');
          "

      - name: Upload API test artifacts
        if: always() && steps.doc_check.outputs.run_tests == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: api-test-results-${{ github.run_id }}
          path: tests/api/results
          if-no-files-found: warn
          retention-days: 7