nightly-example-stack.yaml

name: Nightly example-stack

# Bring up the full codmin example stack (postgres + coauth + coland +
# floria + codmin) on a fresh GHA runner every night and assert each
# service responds 200 on its /health endpoint. Logs from every
# container are captured and uploaded as artifacts on failure so a
# regression doesn't require local docker reproduction.
#
# This complements the per-repo Docker workflows (which build single
# images in isolation) by exercising the integrated bring-up surface
# documented in examples/docker-compose.example-stack.yaml.

on:
  schedule:
    # 07:30 UTC daily — late enough for upstream caches to warm but
    # early enough that a regression is triaged before the workday in
    # the +08 timezone where most of arkret is maintained.
    - cron: "30 7 * * *"
  workflow_dispatch:
  pull_request:
    paths:
      - "examples/**"
      - ".github/workflows/nightly-example-stack.yaml"

concurrency:
  group: nightly-example-stack-${{ github.ref }}
  cancel-in-progress: true

jobs:
  example-stack:
    name: Bring up + smoke
    runs-on: ubuntu-latest
    # Four cold Rust/Dioxus images are built in sequence to bound memory.
    timeout-minutes: 120
    steps:
      - name: Check out codmin
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          path: codmin

      # The compose file references ../../{coauth,coland,floria} as
      # build contexts so we need sibling checkouts on disk. Pinning to
      # `main` keeps nightly bring-up reproducible against the umbrella
      # `arkret` layout described in examples/README.md.
      - name: Check out coauth
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          repository: ${{ github.repository_owner }}/coauth
          path: coauth
          ref: main
          token: ${{ secrets.CI_REPO_TOKEN || github.token }}

      - name: Check out coland
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          repository: ${{ github.repository_owner }}/coland
          path: coland
          ref: main
          token: ${{ secrets.CI_REPO_TOKEN || github.token }}

      - name: Complete Coland build dependency layout
        working-directory: coland
        env:
          CI_REPO_TOKEN: ${{ secrets.CI_REPO_TOKEN || github.token }}
        run: bash .ci/checkout-build-dependencies.sh

      - name: Check out floria
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          repository: ${{ github.repository_owner }}/floria
          path: floria
          ref: main
          token: ${{ secrets.CI_REPO_TOKEN || github.token }}

      - name: Check out arkret-rust-sdk
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          repository: ${{ github.repository_owner }}/arkret-rust-sdk
          path: arkret-rust-sdk
          ref: main
          token: ${{ secrets.CI_REPO_TOKEN || github.token }}

      # Coauth's package graph includes Cotest's fixture crate and Garth.
      # Cargo resolves these manifest paths while preparing its Docker recipe.
      - name: Check out cotest
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          repository: ${{ github.repository_owner }}/cotest
          path: cotest
          ref: main
          token: ${{ secrets.CI_REPO_TOKEN || github.token }}

      - name: Check out garth
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          repository: ${{ github.repository_owner }}/garth
          path: garth
          ref: main
          token: ${{ secrets.CI_REPO_TOKEN || github.token }}

      - name: Check out arkret-spec
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          repository: ${{ github.repository_owner }}/arkret-spec
          path: arkret-spec
          ref: main
          token: ${{ secrets.CI_REPO_TOKEN || github.token }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Show docker + compose versions
        run: |
          docker --version
          docker compose version

      - name: Bring up example stack
        id: up
        working-directory: codmin
        run: |
          # `up.sh` builds every image, generates a coauth config via an
          # ephemeral coauth container, brings the stack up with --wait,
          # and dumps recent logs on failure. Exit non-zero propagates.
          ./examples/up.sh

      - name: Smoke probe every /health endpoint
        id: smoke
        working-directory: codmin
        env:
          # Generous budget on a cold-start GHA runner — coauth needs to
          # finish migrations against the freshly-spun postgres before
          # /health flips to 200.
          SMOKE_ATTEMPT_BUDGET: "60"
        run: ./examples/smoke.sh

      - name: Verify durable Coauth keys across an ordinary restart
        working-directory: codmin
        run: |
          python3 examples/check-key-persistence.py
          ./examples/smoke.sh

      - name: Set up Node for Playwright
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: codmin/package-lock.json

      - name: Install Playwright dependencies
        working-directory: codmin
        run: |
          npm ci
          npx playwright install --with-deps chromium

      - name: Run Playwright against example stack
        working-directory: codmin
        env:
          CODMIN_E2E_BASE_URL: http://localhost:58200
        run: npm run test:smoke -- --reporter=line

      - name: Run Lighthouse budget against example stack
        working-directory: codmin
        run: npm run lhci -- --collect.url=http://localhost:58200/

      - name: Capture container logs (always)
        if: always()
        working-directory: codmin
        run: |
          mkdir -p logs
          for svc in postgres coauth coauth-provision coland floria codmin; do
            docker compose -f examples/docker-compose.example-stack.yaml \
              logs --no-color --tail=2000 "${svc}" > "logs/${svc}.log" 2>&1 || true
          done
          docker compose -f examples/docker-compose.example-stack.yaml ps \
            > logs/compose-ps.txt 2>&1 || true

      - name: Upload logs on failure
        if: failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: example-stack-logs-${{ github.run_id }}
          path: codmin/logs/
          retention-days: 14

      - name: Tear down (always)
        if: always()
        working-directory: codmin
        run: ./examples/down.sh || true