mobius/docker-compose.test.yml at main · mobius-os/mobius · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
services:
  # Exercise the same response-header and dedicated-service-origin boundary as
  # production.  The app remains separately published on INTERNAL_TEST_PORT
  # for cleanup that must not traverse the public proxy.
  caddy:
    image: caddy:2.9-alpine
    container_name: ${MOBIUS_CADDY_CONTAINER:-mobius-test-caddy}
    restart: unless-stopped
    environment:
      - DOMAIN=http://localhost:${TEST_PORT:-8001}
      - FRONTEND_ORIGIN=http://localhost:${TEST_PORT:-8001}
      - MOBIUS_SERVICE_GATEWAY_ORIGIN=http://services.localhost:${TEST_PORT:-8001}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
    ports: !override ["${TEST_PORT:-8001}:${TEST_PORT:-8001}"]
    depends_on:
      app:
        condition: service_healthy

  app:
    # container_name and image are GLOBAL (not Compose-project-scoped), so two
    # runs with the same defaults collide even when -p differs. For full
    # isolation set MOBIUS_CONTAINER and MOBIUS_IMAGE in addition to -p:
    #   MOBIUS_CONTAINER=mobius-test-foo MOBIUS_IMAGE=mobius-test-foo:ci \
    #     docker compose -p mobius-test-foo -f docker-compose.test.yml ...
    # The volume is already project-scoped (<project>_test_data) and needs
    # no override — only container_name + image are global.
    image: ${MOBIUS_IMAGE:-mobius-test:ci}
    build:
      context: .
      args:
        BUILD_SHA: ${BUILD_SHA:-unknown}
        BUILD_DATE: ${BUILD_DATE:-unknown}
        # Disposable tests mount and verify the checkout under /workspace, so
        # they are the only supported build path that may use an unstamped
        # image. Normal/release images fail closed without an exact SHA.
        MOBIUS_ALLOW_UNKNOWN_BUILD_SHA: "1"
    container_name: ${MOBIUS_CONTAINER:-mobius-test}
    init: true
    # Settings restart SIGTERMs uvicorn and relies on Docker bringing the
    # container back up.
    restart: unless-stopped
    environment:
      # Pin a fixed test SECRET_KEY so the test container never inherits a
      # prod-shaped value from the host shell. Do NOT use this value anywhere
      # other than mobius-test.
      - SECRET_KEY=test-secret-not-for-prod-do-not-use-anywhere-else
      - DOMAIN=localhost
      - FRONTEND_ORIGIN=http://localhost:${TEST_PORT:-8001}
      - DATABASE_URL=sqlite:////data/db/ultimate.db
      - DATA_DIR=/data
      - AGENT_BROWSER_STREAM_PORT=9225
      # E2E must run the checkout that owns the tests, not the default branch
      # cloned into an image whose BUILD_SHA was left unstamped. GitHub exposes
      # GITHUB_SHA to Compose automatically; local runs still seed their current
      # checkout and validate it against its own HEAD.
      - MOBIUS_TEST_RUNTIME=1
      - MOBIUS_TEST_PLATFORM_SOURCE=/workspace
      - BUILD_SHA=${GITHUB_SHA:-unknown}
      - MOBIUS_SERVICE_GATEWAY_ORIGIN=http://services.localhost:${TEST_PORT:-8001}
    volumes:
      - test_data:/data
      - ./:/workspace:ro
    # The public browser surface is Caddy on TEST_PORT. Publish the app on a
    # separate host port only for exact, proxy-independent cleanup/probes.
    ports: !override ["${INTERNAL_TEST_PORT:-8012}:8000"]
    healthcheck:
      # Includes ordinary API health plus a fail-closed checkout identity test.
      # A healthy container therefore proves Playwright will exercise this
      # checkout's backend and the frontend watcher rooted in the same clone.
      test: ["CMD", "python3", "/app/scripts/verify_test_runtime.py"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s

  fake-tandoor:
    image: ${MOBIUS_IMAGE:-mobius-test:ci}
    network_mode: "service:app"
    entrypoint: ["python3", "/workspace/tests/fake_tandoor.py"]
    volumes:
      - ./:/workspace:ro
    depends_on:
      app:
        condition: service_started

  pytest:
    image: ${MOBIUS_IMAGE:-mobius-test:ci}
    profiles: ["test"]
    # The full suite launches many short-lived subprocesses. Keep pytest out
    # of PID 1 so orphaned children are reaped and later /proc-based recovery
    # target tests see a production-shaped process table.
    init: true
    volumes:
      # Mount one coherent checkout at a non-runtime path and run exactly like
      # CI (`cd backend && pytest`). Mounting only app/tests/scripts at /app
      # mixed live tests with baked recovery, frontend, root scripts, and build
      # metadata from another revision; repo-root tests then resolved `/` and
      # produced a large false-failure cluster.
      - ./:/workspace
    tmpfs:
      # The baked runtime vendor tree is not part of a source-checkout CI run.
      # Mask it so frontend watcher tests compare only their fixture builds.
      - /app/static/vendor
    environment:
      - SECRET_KEY=test-secret-key-at-least-32-characters-long
      - DATABASE_URL=sqlite:////tmp/test.db
      - DATA_DIR=/tmp/testdata
      - FRONTEND_ORIGIN=http://localhost:5173
      - MOBIUS_TEST_RUNTIME=1
      - MOBIUS_BUILD_INFO_PATH=/workspace/.test-build-info-does-not-exist.json
      # Execute the current checkout's checker source with the dependency tree
      # baked into the verified test image; the /workspace bind intentionally
      # contains no host node_modules directory.
      - MOBIUS_FRONTEND_NODE_MODULES=/app/shell-src/node_modules
      # Worktrees can retain __pycache__ files first compiled at the old /app
      # mount.  Their embedded filenames and, in timestamp/size collisions,
      # bytecode can then come from a different checkout.  Use a fresh cache
      # root per throwaway pytest container so the coherent /workspace source
      # is also what Python compiles and executes.
      - PYTHONPYCACHEPREFIX=/tmp/pytest-pycache
      # This may be a linked git worktree whose .git file points to a host-only
      # common dir. Tests create and query explicit temporary repos; prevent an
      # unrelated `git ls-remote` from failing while discovering the broken
      # outer worktree pointer first.
      - GIT_CEILING_DIRECTORIES=/workspace
      # Bootstrap fetches curated app manifests from GitHub on first boot.
      # Tests must not depend on outbound network — set
      # this so ensure_bootstrap_apps_installed() returns immediately.
      - MOEBIUS_SKIP_BOOTSTRAP=1
    working_dir: /workspace/backend
    entrypoint: ["python", "-m", "pytest", "tests/", "-v"]

volumes:
  test_data: