ci: add integration job and tests for acme-commerce-lenders

.github/workflows/ci.yml

@@ -135,3 +135,139 @@ jobs:
           curl -sf -o /dev/null "http://127.0.0.1:18080$script"
           # A missing file is a 404, not the app.
           test "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:18080/assets/missing.js)" = 404
+
+  # Runs the demo against LocalStack and drives the whole flow over HTTP: seed
+  # the world, apply, accept, fund and settle. Needs the LocalStack platform's
+  # GitHub OIDC login, which a fork's pull request is not given.
+  # localstack-project-id: proj_5f62a1e8 (https://v2.app.localstack.cloud/projects/proj_5f62a1e8)
+  # Runtime config (emulator image, env vars, extensions) is fetched by
+  # `lstk project start` at run time, so change it on the platform, not here.
+  #
+  # Today LocalStack answers 404 for stripe, plaid and xero, so all three app
+  # emulators come from the WonderTwin builds below and LocalStack is started
+  # but not exercised. This is not LocalStack-hosted coverage yet.
+  integration:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      id-token: write
+      contents: read
+    env:
+      # The WonderTwin commit the twins are built from. The test asserts exact
+      # numbers, so bump this deliberately, in the PR that changes them.
+      WONDERTWIN_REF: 8f1b30fcaf8d9f7c97278eff1b29ff476e8eaa26
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version-file: web/.node-version
+
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.work
+          cache: false
+
+      - name: Authenticate to LocalStack via GitHub OIDC
+        env:
+          LOCALSTACK_OIDC_AUDIENCE: https://v2.api.localstack.cloud/github-oidc
+          LOCALSTACK_PLATFORM_API_URL: https://v2.api.localstack.cloud
+          LOCALSTACK_ORG_ID: "1e09b0c1"
+          LOCALSTACK_PROJECT: "proj_5f62a1e8"
+        run: |
+          set -euo pipefail
+          OIDC_TOKEN=$(curl -sSf \
+            -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${LOCALSTACK_OIDC_AUDIENCE}" \
+            | jq -r .value)
+
+          PAYLOAD=$(jq -n \
+            --arg token "$OIDC_TOKEN" \
+            --arg orgId "$LOCALSTACK_ORG_ID" \
+            --arg project "$LOCALSTACK_PROJECT" \
+            '{token: $token, orgId: $orgId, project: $project}')
+
+          RESPONSE=$(curl -sSf -X POST "${LOCALSTACK_PLATFORM_API_URL}/v1/auth/github-oidc" \
+            -H "Content-Type: application/json" \
+            -d "$PAYLOAD")
+
+          TOKEN=$(echo "$RESPONSE" | jq -r .localstackAuthToken)
+          echo "::add-mask::$TOKEN"
+          echo "LOCALSTACK_AUTH_TOKEN=$TOKEN" >> "$GITHUB_ENV"
+
+      - name: Install lstk and lstk-project
+        run: |
+          npm install -g @localstack/lstk
+          pip install "https://localstack-artifacts-internal.s3.eu-central-1.amazonaws.com/packages/lstk-project/lstk_project-0.1.1-py3-none-any.whl"
+
+      - name: Start LocalStack
+        run: |
+          mkdir -p "$RUNNER_TEMP/lstk-stage" && exec > >(tee -a "$RUNNER_TEMP/lstk-stage/start.log") 2>&1
+          lstk project start "localstack-app-emulators"
+
+      # Shows what the sandbox serves, so a "not-included" failure below says
+      # whether the app emulators are missing or the Host header never arrives.
+      - name: Probe the app emulators
+        run: |
+          curl -s localhost:4566/_localstack/info || true; echo
+          for app in stripe plaid xero; do
+            echo "$app via Host header:"
+            curl -s -w ' HTTP %{http_code}\n' -H "Host: $app.localhost.localstack.cloud:4566" localhost:4566/admin/health || true
+          done
+
+      # Any app emulator this LocalStack release does not host is built from
+      # WonderTwin and run beside it, and the demo is pointed at it through
+      # <APP>_EMULATOR_URL. Plaid and Xero are in no LocalStack release yet.
+      - name: Run the app emulators LocalStack does not host
+        run: |
+          set -euo pipefail
+          missing=""
+          for app in stripe plaid xero; do
+            code="$(curl -s -o /dev/null -w '%{http_code}' --max-time 120 \
+              -H "Host: $app.localhost.localstack.cloud:4566" http://127.0.0.1:4566/admin/health || true)"
+            echo "$app on LocalStack: HTTP $code"
+            [ "$code" = 200 ] || missing="$missing $app"
+          done
+          [ -n "$missing" ] || exit 0
+          git init -q "$RUNNER_TEMP/wondertwin"
+          git -C "$RUNNER_TEMP/wondertwin" fetch -q --depth 1 https://github.com/WonderTwin-AI/wondertwin "$WONDERTWIN_REF"
+          git -C "$RUNNER_TEMP/wondertwin" checkout -q FETCH_HEAD
+          port=5101
+          for app in $missing; do
+            (cd "$RUNNER_TEMP/wondertwin" && go build -o "$RUNNER_TEMP/twin-$app" "./twin-$app/cmd/twin-$app")
+            # The twins never need the LocalStack token, so they don't get it.
+            env -u LOCALSTACK_AUTH_TOKEN "$RUNNER_TEMP/twin-$app" --port=$port > "$RUNNER_TEMP/twin-$app.log" 2>&1 &
+            echo "$(echo "$app" | tr a-z A-Z)_EMULATOR_URL=http://127.0.0.1:$port" >> "$GITHUB_ENV"
+            port=$((port + 1))
+          done
+
+      # The test starts the demo itself, and it uses LocalStack for every app
+      # emulator the step above did not replace.
+      - name: Run the integration tests
+        working-directory: demos/acme-commerce-lenders
+        env:
+          INTEGRATION_ALLOW_RESET: "1"
+        run: go test -tags integration -count=1 -v ./integration
+
+      - name: Show the LocalStack logs
+        if: always()
+        run: |
+          docker ps -a
+          for c in $(docker ps -aq); do docker logs --tail 200 "$c" 2>&1 || true; done
+
+      - name: Generate a LocalStack diagnostic report
+        if: failure()
+        run: curl -s localhost:4566/_localstack/diagnose | gzip -cf > diagnose.json.gz || true
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: failure()
+        with:
+          name: localstack-diagnose
+          path: diagnose.json.gz
+          if-no-files-found: ignore
+
+      - name: Shut down LocalStack
+        if: always()
+        continue-on-error: true
+        run: lstk project shutdown "localstack-app-emulators" --status ${{ job.status }}