ci: test that release can be deployed

Author: aramprice

ci/pipeline.yml

@@ -80,14 +80,33 @@ jobs:
               DB: postgresql
               DB_VERSION: 15
 
-  - name: placeholder-create-release
+  - name: test-release
     public: true
     plan:
       - in_parallel:
           - get: config-server-ci
           - get: config-server
             passed:
               - test-integration
+            trigger: true
+          - get: docker-cpi-image
+          - get: stemcell
+            resource: ubuntu-noble-stemcell
+      - task: test-release
+        file: config-server-ci/ci/tasks/test-release.yml
+        image: docker-cpi-image
+        privileged: true
+        params:
+          STEMCELL_OS: ubuntu-noble
+
+  - name: placeholder-create-release
+    public: true
+    plan:
+      - in_parallel:
+          - get: config-server-ci
+          - get: config-server
+            passed:
+              - test-release
           - get: bosh-integration-image
       - task: create-release
         image: bosh-integration-image
@@ -216,3 +235,22 @@ resources:
       start: 3:00 -0700
       stop: 4:30 -0700
       days: [ Saturday ]
+
+  - name: docker-cpi-image
+    type: registry-image
+    source:
+      repository: ghcr.io/cloudfoundry/bosh/docker-cpi
+      username: ((github_read_write_packages.username))
+      password: ((github_read_write_packages.password))
+
+  - name: ubuntu-noble-stemcell
+    type: bosh-io-stemcell
+    source:
+      name: bosh-warden-boshlite-ubuntu-noble
+
+resource_types:
+  - name: bosh-io-stemcell
+    type: registry-image
+    source:
+      repository: foundationalinfrastructure/bosh-io-stemcell-resource
+      tag: v1.2.1

ci/tasks/test-release.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -eu -o pipefail
+
+RELEASE_PATH="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)/config-server"
+
+if [[ -n "${DEBUG:-}" ]]; then
+  set -x
+  export BOSH_LOG_LEVEL=debug
+fi
+
+echo "Starting BOSH Director"
+source start-bosh
+source /tmp/local-bosh/director/bosh-env
+
+echo "Uploading stemcell"
+bosh -n upload-stemcell stemcell/*.tgz
+
+echo "Uploading BPM release"
+bosh -n upload-release /usr/local/releases/bpm.tgz
+
+echo "Creating and uploading config-server release"
+bosh create-release --dir "${RELEASE_PATH}"
+bosh upload-release --dir "${RELEASE_PATH}"
+
+echo "Deploying config-server"
+bosh -n -d config-server-test deploy \
+  --var=stemcell_os="${STEMCELL_OS}" \
+  --vars-store=/tmp/config-server-test-creds.yml \
+  "${RELEASE_PATH}/manifests/test.yml"
+
+echo "Deployment complete. Instances:"
+bosh -d config-server-test instances --details
+
+CS_IP="$(bosh -d config-server-test instances | grep running | awk '{ print $4 }')"
+echo "config-server IP: ${CS_IP}"
+
+echo "Verifying config-server API responds..."
+response_code="$(curl -sk -o /dev/null -w "%{http_code}" "https://${CS_IP}:8080/v1/data?name=test-key")"
+
+if [[ "${response_code}" == "401" ]]; then
+  echo "SUCCESS: config-server is responding correctly (received expected 401 Unauthorized)"
+else
+  echo "ERROR: Expected HTTP 401 from config-server, got HTTP ${response_code}"
+  exit 1
+fi

ci/tasks/test-release.yml

@@ -0,0 +1,13 @@
+---
+platform: linux
+
+inputs:
+- name: config-server
+- name: config-server-ci
+- name: stemcell
+
+run:
+  path: config-server-ci/ci/tasks/test-release.sh
+
+params:
+  STEMCELL_OS: ubuntu-noble

manifests/test.yml

@@ -0,0 +1,60 @@
+---
+name: config-server-test
+
+releases:
+- name: config-server
+  version: latest
+- name: bpm
+  version: latest
+
+stemcells:
+- alias: default
+  os: ((stemcell_os))
+  version: latest
+
+update:
+  canaries: 1
+  canary_watch_time: 30000-300000
+  max_in_flight: 1
+  update_watch_time: 30000-300000
+
+instance_groups:
+- name: config-server
+  azs: [z1]
+  instances: 1
+  vm_type: default
+  stemcell: default
+  networks:
+  - name: default
+  jobs:
+  - name: bpm
+    release: bpm
+  - name: config_server
+    release: config-server
+    properties:
+      port: 8080
+      store: memory
+      jwt:
+        verification_key: ((config_server_jwt_key.public_key))
+      ca:
+        certificate: ((config_server_ca.certificate))
+        private_key: ((config_server_ca.private_key))
+      ssl:
+        certificate: ((config_server_tls.certificate))
+        private_key: ((config_server_tls.private_key))
+
+variables:
+- name: config_server_jwt_key
+  type: rsa
+- name: config_server_ca
+  type: certificate
+  options:
+    is_ca: true
+    common_name: config-server-ca
+- name: config_server_tls
+  type: certificate
+  options:
+    ca: config_server_ca
+    common_name: config-server
+    alternative_names:
+    - config-server