ocis/.github/workflows/acceptance-tests.yml

name: Acceptance Tests

on:
  pull_request:
  workflow_dispatch:

jobs:
  coding-standard:
    name: coding-standard
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Install PHP 8.4
        run: |
          sudo add-apt-repository -y ppa:ondrej/php
          sudo apt-get update -qq
          sudo apt-get install -y php8.4 php8.4-curl php8.4-xml php8.4-mbstring php8.4-zip php8.4-ldap php8.4-gd
          sudo update-alternatives --set php /usr/bin/php8.4
          curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
      - name: PHP code style
        run: |
          make vendor-bin-codestyle
          make vendor-bin-codesniffer
          make test-php-style
      - name: Check env var annotations
        run: make check-env-var-annotations

  check-gherkin-standard:
    name: check-gherkin-standard
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "24"
      - name: Lint feature files
        run: |
          npm install -g @gherlint/gherlint@1.1.0
          make test-gherkin-lint

  check-suites-in-expected-failures:
    name: check-suites-in-expected-failures
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Check suites
        run: bash tests/acceptance/check-deleted-suites-in-expected-failure.sh

  build-and-test:
    name: build-and-test
    needs: [coding-standard, check-gherkin-standard, check-suites-in-expected-failures]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: go.mod
          cache: true

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "24"

      - name: Enable pnpm
        run: corepack enable && corepack prepare pnpm@10.28.1 --activate

      - name: Generate nodejs
        run: make ci-node-generate

      - name: Generate go
        run: make ci-go-generate

      - name: Vulnerability scan
        run: make govulncheck

      - name: Lint
        run: make ci-golangci-lint

      - name: Build ocis
        run: make -C ocis build

      - name: Build debug binary
        run: make -C ocis build-debug

      - name: Unit tests
        run: make test

  local-api-tests:
    name: ${{ matrix.suite }}
    needs: [build-and-test]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        suite:
          # contract & locks
          - apiContract
          - apiLocks
          # settings & notifications (needs email)
          - apiSettings
          - apiNotification
          - apiCors
          # graph
          - apiGraphUser
          - apiGraph
          - apiGraphGroup
          # spaces & dav
          - apiSpaces
          - apiSpacesShares
          - apiSpacesDavOperation
          - apiDownloads
          - apiAsyncUpload
          - apiDepthInfinity
          - apiArchiver
          - apiActivities
          # search
          - apiSearch1
          - apiSearch2
          - apiSearchContent    # needs Tika
          # sharing
          - apiSharingNgShares
          - apiReshare
          - apiSharingNgPermissions
          - apiSharingNgAdditionalShareRole
          - apiSharingNgDriveInvitation
          - apiSharingNgItemInvitation
          - apiSharingNgDriveLinkShare
          - apiSharingNgItemLinkShare
          - apiSharingNgLinkShareManagement
          # auth
          - apiAuthApp
          # antivirus (needs ClamAV)
          - apiAntivirus
          # federation (needs email + federation ocis)
          - apiOcm
          # collaboration (needs WOPI)
          - apiCollaboration
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: go.mod
          cache: true

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "24"

      - name: Enable pnpm
        run: corepack enable && corepack prepare pnpm@10.28.1 --activate

      - name: Install libcurl 8.12.0 from source
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y libssl-dev libnghttp2-dev libpsl-dev libldap-dev libssh-dev zlib1g-dev libvips-dev
          cd /tmp
          curl -sLO https://curl.se/download/curl-8.12.0.tar.gz
          tar xzf curl-8.12.0.tar.gz
          cd curl-8.12.0
          ./configure --with-ssl --with-zlib --with-nghttp2 --prefix=/usr/local --enable-versioned-symbols --silent
          make -j$(nproc) --silent
          sudo make install --silent
          sudo ldconfig
          curl --version | head -1
          php -r '
            $v = curl_version()["version"];
            echo "PHP curl: $v\n";
            if (version_compare($v, "8.12.0", "<")) {
              fwrite(STDERR, "FATAL: PHP sees libcurl $v, need >= 8.12.0\n");
              exit(1);
            }
          '

      - name: Install PHP 8.4
        run: |
          sudo add-apt-repository -y ppa:ondrej/php
          sudo apt-get update -qq
          sudo apt-get install -y php8.4 php8.4-curl php8.4-xml php8.4-mbstring php8.4-zip php8.4-ldap php8.4-gd
          sudo update-alternatives --set php /usr/bin/php8.4
          curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
          php -v
          composer --version

      - name: Run ${{ matrix.suite }}
        run: BEHAT_SUITES=${{ matrix.suite }} python3 tests/acceptance/run-github.py

  cli-tests:
    needs: [build-and-test]
    name: ${{ matrix.suite }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        suite:
          - cliCommands,apiServiceAvailability   # grouped like drone; needs ClamAV + email
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: go.mod
          cache: true

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "24"

      - name: Enable pnpm
        run: corepack enable && corepack prepare pnpm@10.28.1 --activate

      - name: Install PHP 8.4
        run: |
          sudo add-apt-repository -y ppa:ondrej/php
          sudo apt-get update -qq
          sudo apt-get install -y php8.4 php8.4-curl php8.4-xml php8.4-mbstring php8.4-zip php8.4-ldap php8.4-gd
          sudo update-alternatives --set php /usr/bin/php8.4
          curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
          php -v
          composer --version

      - name: Run ${{ matrix.suite }}
        run: BEHAT_SUITES="${{ matrix.suite }}" python3 tests/acceptance/run-github.py

  core-api-tests:
    name: ${{ matrix.suite }}
    needs: [build-and-test]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        suite:
          - "coreApiAuth,coreApiCapabilities,coreApiFavorites,coreApiMain,coreApiVersions"
          - "coreApiShareManagementBasicToShares,coreApiShareManagementToShares"
          - "coreApiSharees,coreApiSharePublicLink2"
          - "coreApiShareOperationsToShares1,coreApiShareOperationsToShares2,coreApiSharePublicLink1,coreApiShareCreateSpecialToShares1,coreApiShareCreateSpecialToShares2,coreApiShareUpdateToShares"
          - "coreApiTrashbin,coreApiTrashbinRestore,coreApiWebdavEtagPropagation1,coreApiWebdavEtagPropagation2"
          - "coreApiWebdavDelete,coreApiWebdavOperations,coreApiWebdavMove2"
          - "coreApiWebdavProperties"
          - "coreApiWebdavMove1,coreApiWebdavPreviews,coreApiWebdavUpload,coreApiWebdavUploadTUS"
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: go.mod
          cache: true

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "24"

      - name: Enable pnpm
        run: corepack enable && corepack prepare pnpm@10.28.1 --activate

      - name: Install libcurl 8.12.0 from source
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y libssl-dev libnghttp2-dev libpsl-dev libldap-dev libssh-dev zlib1g-dev libvips-dev
          cd /tmp
          curl -sLO https://curl.se/download/curl-8.12.0.tar.gz
          tar xzf curl-8.12.0.tar.gz
          cd curl-8.12.0
          ./configure --with-ssl --with-zlib --with-nghttp2 --prefix=/usr/local --enable-versioned-symbols --silent
          make -j$(nproc) --silent
          sudo make install --silent
          sudo ldconfig
          curl --version | head -1
          php -r '
            $v = curl_version()["version"];
            echo "PHP curl: $v\n";
            if (version_compare($v, "8.12.0", "<")) {
              fwrite(STDERR, "FATAL: PHP sees libcurl $v, need >= 8.12.0\n");
              exit(1);
            }
          '

      - name: Install PHP 8.4
        run: |
          sudo add-apt-repository -y ppa:ondrej/php
          sudo apt-get update -qq
          sudo apt-get install -y php8.4 php8.4-curl php8.4-xml php8.4-mbstring php8.4-zip php8.4-ldap php8.4-gd
          sudo update-alternatives --set php /usr/bin/php8.4
          curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer

      - name: Run ${{ matrix.suite }}
        run: >
          BEHAT_SUITES="${{ matrix.suite }}"
          ACCEPTANCE_TEST_TYPE=core-api
          WITH_REMOTE_PHP=true
          python3 tests/acceptance/run-github.py

  e2e-tests:
    name: e2e-${{ matrix.suite }}
    needs: [build-and-test]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - suite: part-1
            args: "--total-parts 4 --xsuites search,app-provider,ocm,keycloak --run-part 1"
          - suite: part-2
            args: "--total-parts 4 --xsuites search,app-provider,ocm,keycloak --run-part 2"
          - suite: part-3
            args: "--total-parts 4 --xsuites search,app-provider,ocm,keycloak --run-part 3"
          - suite: part-4
            args: "--total-parts 4 --xsuites search,app-provider,ocm,keycloak --run-part 4"
          - suite: search
            args: "--suites search"
            tika: true
          - suite: keycloak
            args: "--suites journeys,keycloak"
            keycloak: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: go.mod
          cache: true
      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "24"
      - name: Enable pnpm
        run: corepack enable && corepack prepare pnpm@10.28.1 --activate
      - name: Generate code
        run: |
          pnpm config set store-dir ./.pnpm-store
          make ci-node-generate
        env:
          CHROMEDRIVER_SKIP_DOWNLOAD: "true"

      - name: Cache Playwright Chromium
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ~/.cache/ms-playwright
          key: playwright-chromium-${{ hashFiles('.drone.env') }}

      # --- Tika (search suite only) ---
      - name: Start Tika
        if: matrix.tika == true
        run: |
          docker run -d --name tika --network host apache/tika:3.2.2.0-full
          timeout 120 bash -c 'until curl -sf http://localhost:9998; do sleep 2; done'
          echo "tika ready."

      # --- Keycloak (keycloak suite only) ---
      - name: Generate Keycloak certs
        if: matrix.keycloak == true
        run: |
          mkdir -p keycloak-certs
          openssl req -x509 -newkey rsa:2048 \
            -keyout keycloak-certs/keycloakkey.pem \
            -out keycloak-certs/keycloakcrt.pem \
            -nodes -days 365 -subj '/CN=keycloak'
          chmod -R 777 keycloak-certs

      - name: Start Postgres
        if: matrix.keycloak == true
        run: |
          docker run -d --name postgres --network host \
            -e POSTGRES_DB=keycloak \
            -e POSTGRES_USER=keycloak \
            -e POSTGRES_PASSWORD=keycloak \
            postgres:alpine3.18
          timeout 30 bash -c 'until docker exec postgres pg_isready -U keycloak; do sleep 1; done'

      - name: Start Keycloak
        if: matrix.keycloak == true
        run: |
          # Patch realm: replace Drone Docker hostname with localhost IP
          sed 's|https://ocis-server:9200|https://127.0.0.1:9200|g' \
            tests/config/drone/ocis-ci-realm.dist.json > /tmp/ocis-realm.json
          docker run -d --name keycloak --network host \
            -e OCIS_DOMAIN=https://127.0.0.1:9200 \
            -e KC_HOSTNAME=localhost \
            -e KC_PORT=8443 \
            -e KC_DB=postgres \
            -e "KC_DB_URL=jdbc:postgresql://localhost:5432/keycloak" \
            -e KC_DB_USERNAME=keycloak \
            -e KC_DB_PASSWORD=keycloak \
            -e KC_FEATURES=impersonation \
            -e KC_BOOTSTRAP_ADMIN_USERNAME=admin \
            -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
            -e KC_HTTPS_CERTIFICATE_FILE=/keycloak-certs/keycloakcrt.pem \
            -e KC_HTTPS_CERTIFICATE_KEY_FILE=/keycloak-certs/keycloakkey.pem \
            -v "$(pwd)/keycloak-certs:/keycloak-certs:ro" \
            -v "/tmp/ocis-realm.json:/opt/keycloak/data/import/oCIS-realm.json:ro" \
            quay.io/keycloak/keycloak:26.2.5 \
            start-dev --proxy-headers xforwarded \
              --spi-connections-http-client-default-disable-trust-manager=true \
              --import-realm --health-enabled=true
          timeout 300 bash -c 'until curl -skf https://localhost:9000/health/ready; do sleep 3; done' \
            || (echo "=== keycloak logs ===" && docker logs keycloak --tail 80 && exit 1)
          echo "keycloak ready."

      - name: Run e2e-${{ matrix.suite }}
        run: E2E_ARGS="${{ matrix.args }}" python3 tests/acceptance/run-e2e.py
        env:
          TIKA_NEEDED: ${{ matrix.tika == true && 'true' || 'false' }}
          KEYCLOAK_NEEDED: ${{ matrix.keycloak == true && 'true' || 'false' }}

  litmus:
    name: litmus
    needs: [build-and-test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: go.mod
          cache: true
      - name: Run litmus
        run: python3 tests/acceptance/run-litmus.py

  cs3api:
    name: cs3api
    needs: [build-and-test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: go.mod
          cache: true
      - name: Run cs3api validator
        run: python3 tests/acceptance/run-cs3api.py

  wopi-builtin:
    name: wopi-builtin
    needs: [build-and-test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: go.mod
          cache: true
      - name: Run WOPI validator (builtin)
        run: python3 tests/acceptance/run-wopi.py --type builtin

  wopi-cs3:
    name: wopi-cs3
    needs: [build-and-test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: go.mod
          cache: true
      - name: Run WOPI validator (cs3)
        run: python3 tests/acceptance/run-wopi.py --type cs3

  all-acceptance-tests:
    needs: [local-api-tests, cli-tests, core-api-tests, litmus, cs3api, wopi-builtin, wopi-cs3, e2e-tests]
    runs-on: ubuntu-latest
    if: always()
    steps:
      - name: Check all jobs passed
        run: |
          if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
            exit 1
          fi