Skip to content
Open
Show file tree
Hide file tree
Changes from 23 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
131 changes: 0 additions & 131 deletions .github/workflows/continuous-integration.yml

This file was deleted.

184 changes: 184 additions & 0 deletions .github/workflows/e2e-slow.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,184 @@
name: E2E Slow Tests

permissions:
contents: read

on:
pull_request:
types: [opened, synchronize, reopened, labeled, unlabeled, push]
branches: [main]
Comment on lines +6 to +9
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Invalid activity type push for pull_request event.

The push activity type is not valid for the pull_request webhook event and will cause the workflow to fail validation.

Proposed fix
 on:
   pull_request:
-    types: [opened, synchronize, reopened, labeled, unlabeled, push]
+    types: [opened, synchronize, reopened, labeled, unlabeled]
     branches: [main]
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
on:
pull_request:
types: [opened, synchronize, reopened, labeled, unlabeled, push]
branches: [main]
on:
pull_request:
types: [opened, synchronize, reopened, labeled, unlabeled]
branches: [main]
🧰 Tools
🪛 actionlint (1.7.11)

[error] 8-8: invalid activity type "push" for "pull_request" Webhook event. available types are "assigned", "auto_merge_disabled", "auto_merge_enabled", "closed", "converted_to_draft", "demilestoned", "dequeued", "edited", "enqueued", "labeled", "locked", "milestoned", "opened", "ready_for_review", "reopened", "review_request_removed", "review_requested", "synchronize", "unassigned", "unlabeled", "unlocked"

(events)

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/e2e-slow.yml around lines 6 - 9, The workflow's on:
pull_request types list includes an invalid activity "push" which fails
validation; edit the on: block by removing "push" from the pull_request.types
array (reference: the pull_request.types entry in the
.github/workflows/e2e-slow.yml diff) and, if you intended to run this workflow
on push events as well, add a separate top-level "push:" trigger instead of
placing "push" inside pull_request.types.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will fix before merging

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rvignesh89, sounds good! Just a reminder that the fix is simply removing push from the pull_request.types array:

on:
  pull_request:
    types: [opened, synchronize, reopened, labeled, unlabeled]
    branches: [main]

If you also intended to trigger this workflow on direct pushes to main, that would need a separate top-level push: trigger block. Let me know if you need any help with that!


🧠 Learnings used
Learnt from: rvignesh89
Repo: glific/cypress-testing PR: 219
File: .github/workflows/e2e.yml:71-91
Timestamp: 2026-04-01T02:44:21.649Z
Learning: When reviewing e2e GitHub Actions workflows in this repo, don’t assume `GLIFIC_API_HOST_OVERRIDE` is unused just because Cypress tests/config contain hardcoded URLs. This variable is intended for the Glific backend commands executed in the workflow (e.g., `mix setup` and `mix phx.server`), not for Cypress itself. Only flag/consider changes to Cypress URLs if there’s evidence the backend/API host resolution behavior is affected.


concurrency:
group: e2e-tests-slow
cancel-in-progress: true

jobs:
cypress-slow:
if: ${{ contains(github.event.pull_request.labels.*.name, 'e2e-slow') }}
runs-on: ubuntu-latest

env:
ELIXIR_VERSION: "1.18.3-otp-27"
OTP_VERSION: "27.3.3"

services:
postgres:
image: postgres:14
env:
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
POSTGRES_DB: glific_dev
ports:
- 5432:5432
options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5

steps:
- name: Setup cypress-testing
uses: actions/checkout@v6

- name: Use latest Node.js
uses: actions/setup-node@v6

- name: Setup elixir
uses: erlef/setup-beam@v1
with:
elixir-version: ${{ env.ELIXIR_VERSION }}
otp-version: ${{ env.OTP_VERSION }}

- name: Download ngrok
run: |
wget -q -O ngrok.tgz https://bin.ngrok.com/c/bNyj1mQVY4c/ngrok-v3-stable-linux-amd64.tgz
tar -xzvf ngrok.tgz
chmod +x ngrok
sudo mv ngrok /usr/local/bin/
Comment on lines +48 to +53
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
rg -n 'ngrok-v3-stable-linux-amd64.tgz|sha256sum|gpg|cosign' .github/workflows/e2e-slow.yml

Repository: glific/cypress-testing

Length of output: 167


Verify ngrok binary integrity before execution.

This workflow downloads and executes ngrok without checksum or signature verification. Add checksum validation or use signed binaries to ensure the downloaded binary hasn't been tampered with.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/e2e-slow.yml around lines 48 - 53, Add integrity
verification for the "Download ngrok" step: fetch the official checksum or
signature alongside the ngrok archive, verify the downloaded file (e.g., compare
sha256 checksum or verify GPG signature) before making it executable and moving
it to /usr/local/bin; if verification fails, exit the job with a clear error.
Ensure verification happens after downloading ngrok.tgz (the file produced by
wget -q -O ngrok.tgz https://... ) and before chmod +x ngrok and sudo mv ngrok
/usr/local/bin/, and fail fast on mismatch so a tampered binary is never
executed or installed.


- name: Start ngrok tunnel
run: |
ngrok config add-authtoken "${{ secrets.NGROK_AUTHTOKEN }}"
nohup ngrok http 4000 --pooling-enabled --host-header=glific.test:4000 --log=stdout > ngrok.log 2>&1 &
sleep 5
tail ngrok.log

- name: Set GLIFIC_API_HOST_OVERRIDE env
run: |
NGROK_API_URL="http://127.0.0.1:4040/api/tunnels"
count=0
until curl -s "${NGROK_API_URL}" | grep -q '"public_url"' || [ $count -eq 10 ]; do
echo "ngrok public_url not ready"
sleep 2
count=$((count+1))
done
API_URL=$(curl -s ${NGROK_API_URL} | jq -r '.tunnels[] | select(.proto=="https") | .public_url')
if [ -z "$API_URL" ]; then
API_URL=$(curl -s ${NGROK_API_URL} | jq -r '.tunnels[] | select(.proto=="http") | .public_url')
fi
echo "ngrok tunnels"
curl -s http://127.0.0.1:4040/api/tunnels
echo "api_url=$API_URL"

echo "GLIFIC_API_HOST_OVERRIDE=${API_URL}" >> $GITHUB_ENV

Comment on lines +62 to +80
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Guard against empty/null API_URL before exporting it.

If tunnel discovery fails, Line [79] still writes GLIFIC_API_HOST_OVERRIDE, causing downstream backend setup instability.

Based on learnings: GLIFIC_API_HOST_OVERRIDE is consumed by backend setup/server steps, so validating it here is required for reliable E2E execution.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/e2e-slow.yml around lines 62 - 80, The step that computes
API_URL from NGROK_API_URL may leave API_URL empty but still exports
GLIFIC_API_HOST_OVERRIDE; update the step to validate API_URL (the variable
produced by jq from NGROK_API_URL) before appending to $GITHUB_ENV: if API_URL
is empty or null, fail the job with a clear error and non-zero exit (or
optionally set a safe default) instead of writing an empty
GLIFIC_API_HOST_OVERRIDE, and log the NGROK_API_URL/curl output for debugging;
make this change in the block that sets API_URL and writes
GLIFIC_API_HOST_OVERRIDE so downstream backend setup/server steps don’t receive
an empty value.

- name: Setup backend (clone and configure)
run: |
echo '127.0.0.1 glific.test' | sudo tee -a /etc/hosts
echo '127.0.0.1 postgres' | sudo tee -a /etc/hosts
echo '127.0.0.1 api.glific.test' | sudo tee -a /etc/hosts
mkdir project
cd project
echo clone glific repo
git clone --branch rvignesh/seed-dev-kaapi https://github.com/glific/glific.git
Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This branch will be changed once glific PR is merged to master

echo done. go to dir.
cd glific
echo done. start dev.secret.exs config
cd priv
mkdir cert
cd cert
echo "${{ secrets.TEST_CERTIFICATE }}" > glific.test+1.pem
echo "${{ secrets.TEST_CERTIFICATE_KEY }}" > glific.test+1-key.pem
cd ../../
cd config
cp dev.secret.exs.txt dev.secret.exs
cp .env.dev.txt .env.dev
sed -i 's/:max_rate_limit_request, 60/:max_rate_limit_request, 300/g' config.exs
echo copy done. start setup
cd ../

- name: Cache Elixir deps and build
uses: actions/cache@v4
with:
path: |
project/glific/deps
project/glific/_build
key: ${{ runner.os }}-mix-${{ env.ELIXIR_VERSION }}-otp-${{ env.OTP_VERSION }}-${{ hashFiles('project/glific/mix.lock') }}
restore-keys: |
${{ runner.os }}-mix-${{ env.ELIXIR_VERSION }}-otp-${{ env.OTP_VERSION }}-

- name: Setup backend (mix)
env:
KAAPI_API_KEY: ${{ secrets.KAAPI_API_KEY }}
run: |
cd project/glific
echo install mix dependencies if not Cached
mix local.rebar --force
mix local.hex --force
mix hex.repo add oban https://getoban.pro/repo --fetch-public-key ${{ secrets.OBAN_PUBLIC_KEY }} --auth-key ${{ secrets.OBAN_PRO_KEY }}
mix deps.get
echo done. start installing inotify-tools
sudo apt-get install inotify-tools
echo start mix setup
ENABLE_DB_SSL=false KAAPI_API_KEY=${KAAPI_API_KEY} mix setup
cd ../../

- name: Setup frontend
run: |
cd project
echo clone glific repo
git clone https://github.com/glific/glific-frontend.git
echo done. go to repo dir.
cd glific-frontend
echo copy env file.
cp .env.example .env
echo done.
cat /proc/sys/fs/inotify/max_user_watches
echo set watchers
sudo sysctl fs.inotify.max_user_watches=524288
sudo sysctl -p
cat /proc/sys/fs/inotify/max_user_watches
echo start yarn setup.
yarn setup
echo done.
cd ../

- name: run glific-frontend
run: |
cd /home/runner/work/cypress-testing/cypress-testing/project/glific-frontend
yarn dev &

- name: run glific
run: |
cd /home/runner/work/cypress-testing/cypress-testing/project/glific
ENABLE_DB_SSL=false OPEN_AI_KEY=${{secrets.OPENAI_KEY}} mix phx.server > phoenix-server.log 2>&1 &

- name: Wait for backend to be ready
uses: iFaxity/wait-on-action@v1.2.1
with:
resource: https-get://glific.test:4001
timeout: 180000

- name: Cypress run (filesearch slow)
run: |
echo Create cypress.config.ts from example
cp cypress.config.ts.example cypress.config.ts
yarn install
yarn run cypress run --spec cypress/e2e/filesearch/Filesearch.spec.ts --record --key ${{ secrets.CYPRESS_DASHBOARD_KEY }}

- name: Upload Phoenix server logs
if: always()
uses: actions/upload-artifact@v4
with:
name: phoenix-server-log-filesearch-slow
path: |
/home/runner/work/cypress-testing/cypress-testing/project/glific/phoenix-server.log
/home/runner/work/cypress-testing/cypress-testing/ngrok.log
if-no-files-found: warn
retention-days: 7
Loading
Loading