Skip to content
CI

fix: accept string request field in stripeEventSchema #794

Sign in to view logs

fix: accept string request field in stripeEventSchema

fix: accept string request field in stripeEventSchema #794

Workflow file for this run

.github/workflows/ci.yml at 0187ad3
name: CI
on:
pull_request:
push:
branches: [main, dev, v2]
workflow_dispatch:
permissions:
packages: write
contents: write
env:
STRIPE_NPM_REGISTRY: https://npm.pkg.github.com
jobs:
# ---------------------------------------------------------------------------
# Changes — skip Docker/publish jobs when only docs/ changed
# ---------------------------------------------------------------------------
changes:
name: Detect code changes
runs-on: ubuntu-24.04-arm
outputs:
code: ${{ steps.filter.outputs.code }}
steps:
- uses: actions/checkout@v5
- uses: dorny/paths-filter@v4
id: filter
with:
filters: |
code:
- '**'
- '!docs/**'
# ---------------------------------------------------------------------------
# Test — lint, build, unit & integration tests
# ---------------------------------------------------------------------------
test:
name: Lint, build & test
runs-on: ubuntu-24.04-arm
steps:
- uses: actions/checkout@v5
- name: Start services
run: docker compose up -d --wait
- name: Install pnpm
uses: pnpm/action-setup@v5
- name: Set up Node
uses: actions/setup-node@v6
with:
node-version-file: ./.nvmrc
cache: pnpm
- name: Set up .env file
run: |
touch packages/source-stripe/.env
echo DATABASE_URL='postgres://postgres:postgres@localhost:55432/postgres?sslmode=disable&search_path=stripe' >> packages/source-stripe/.env
echo NODE_ENV=dev >> packages/source-stripe/.env
echo STRIPE_SECRET_KEY=sk_test_ >> packages/source-stripe/.env
echo STRIPE_WEBHOOK_SECRET=whsec_ >> packages/source-stripe/.env
echo SCHEMA=stripe >> packages/source-stripe/.env
echo PORT=8080 >> packages/source-stripe/.env
echo API_KEY=api_key_test >> packages/source-stripe/.env
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Formatting checks
run: pnpm format:check
continue-on-error: true
- name: Lint
run: pnpm lint
- name: Build
run: pnpm build
- name: Check deprecated paths are up to date
run: |
cd packages/openapi
bundled=$(ls oas/*.json | grep -v manifest.json | grep -v index.html)
[ "$(echo "$bundled" | wc -l)" -eq 1 ] || { echo "Expected 1 bundled spec"; exit 1; }
version=$(basename "$bundled" .json)
grep -q "DEPRECATED_PATHS_BUNDLED_VERSION = '${version}'" src/deprecatedPaths.ts \
|| { echo "deprecatedPaths.ts is stale (bundled spec is ${version}). Fix: node packages/openapi/scripts/generate-versions.mjs"; exit 1; }
- name: Check generated OpenAPI files
run: ./scripts/generate-openapi.sh --check
env:
STRIPE_API_KEY: 'sk_test_placeholder'
- name: Ensure all shell tests are wired up
run: |
missing=()
for f in e2e/*.test.sh; do
name=$(basename "$f")
if ! grep -rq "$name" .github/workflows/; then
missing+=("$f")
fi
done
if [ ${#missing[@]} -gt 0 ]; then
printf 'Not referenced in any workflow: %s\n' "${missing[@]}"
exit 1
fi
- name: Initialize DB schema
run: |
docker run --rm \
--network="host" \
-e PGPASSWORD=postgres \
postgres:18 \
psql -h localhost -p 55432 -U postgres -d postgres -c 'create schema if not exists "stripe";'
- name: stripe-mock smoke test
run: bash e2e/stripe-mock.test.sh
- name: Tests
run: pnpm --filter '!@stripe/sync-e2e' test
env:
DATABASE_URL: 'postgres://postgres:postgres@localhost:55432/postgres?sslmode=disable&search_path=stripe'
POSTGRES_URL: 'postgres://postgres:postgres@localhost:55432/postgres'
STRIPE_MOCK_URL: 'http://localhost:12111'
STRIPE_API_KEY: ${{ secrets.STRIPE_API_KEY }}
GOOGLE_CLIENT_ID: ${{ vars.GOOGLE_CLIENT_ID }}
GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
GOOGLE_REFRESH_TOKEN: ${{ secrets.GOOGLE_REFRESH_TOKEN }}
GOOGLE_SPREADSHEET_ID: ${{ vars.GOOGLE_SPREADSHEET_ID }}
- name: Disconnect & time-limit tests (Node)
run: |
pnpm --filter @stripe/sync-e2e exec vitest run test-disconnect.test.ts
env:
DISCONNECT_TEST_NODE: '1'
SKIP_SETUP: '1'
- name: Install Bun
uses: oven-sh/setup-bun@v2
with:
bun-version: latest
- name: Disconnect & time-limit tests (Bun)
run: |
pnpm --filter @stripe/sync-e2e exec vitest run test-disconnect.test.ts
env:
DISCONNECT_TEST_BUN: '1'
SKIP_SETUP: '1'
- name: Connector loading test
run: bash e2e/connector-loading.test.sh
- name: ESBUILD binary path test
run: bash e2e/esbuild-binary-path.test.sh
- name: Skipped test warnings
if: always()
run: '[ -f /tmp/vitest-skip-warnings.txt ] && cat /tmp/vitest-skip-warnings.txt || true'
# ---------------------------------------------------------------------------
# mitmweb — proxy intercept smoke test (curl, Node, Bun → httpbin.org)
# ---------------------------------------------------------------------------
mitmweb:
name: mitmweb proxy intercept test
runs-on: ubuntu-24.04-arm
steps:
- uses: actions/checkout@v5
- name: Install pnpm
uses: pnpm/action-setup@v5
- name: Set up Node
uses: actions/setup-node@v6
with:
node-version-file: ./.nvmrc
- name: Install Bun
uses: oven-sh/setup-bun@v2
with:
bun-version: latest
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Install mitmproxy
run: pip3 install --quiet mitmproxy
- name: Run mitmweb intercept test
run: bash scripts/mitmweb-env.test.sh
- name: Stop mitmweb
if: always()
run: pkill -f mitmweb || true
# ---------------------------------------------------------------------------
# Publish npm — publish @stripe/* packages to GitHub Packages
# ---------------------------------------------------------------------------
publish_npm:
name: Publish npm packages
needs: [changes]
if: needs.changes.outputs.code == 'true'
runs-on: ubuntu-24.04-arm
steps:
- uses: actions/checkout@v5
- name: Install pnpm
uses: pnpm/action-setup@v5
- name: Set up Node
uses: actions/setup-node@v6
with:
node-version-file: ./.nvmrc
cache: pnpm
- name: Install dependencies & build
run: pnpm install --frozen-lockfile && pnpm build
- name: Publish to GitHub Packages
run: |
echo "//npm.pkg.github.com/:_authToken=${{ secrets.GITHUB_TOKEN }}" >> .npmrc
./scripts/publish-packages.sh
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# ---------------------------------------------------------------------------
# Publish npmjs.org — auto-publish when version changes
# ---------------------------------------------------------------------------
publish_npmjs:
name: Publish to npmjs.org
needs: [test, publish_npm, changes]
if: >-
github.event_name == 'push'
&& needs.changes.outputs.code == 'true'
runs-on: ubuntu-24.04-arm
steps:
- uses: actions/checkout@v5
- name: Check if version changed
id: version-check
run: |
LOCAL_VERSION=$(jq -r .version apps/engine/package.json)
NPM_VERSION=$(npm view @stripe/sync-engine version \
--registry https://registry.npmjs.org 2>/dev/null || echo "0.0.0")
echo "local=$LOCAL_VERSION" >> "$GITHUB_OUTPUT"
echo "npm=$NPM_VERSION" >> "$GITHUB_OUTPUT"
if [ "$LOCAL_VERSION" = "$NPM_VERSION" ]; then
echo "changed=false" >> "$GITHUB_OUTPUT"
echo "Version unchanged: $LOCAL_VERSION"
elif [ "$(printf '%s\n%s\n' "$LOCAL_VERSION" "$NPM_VERSION" | sort -V | tail -n1)" = "$LOCAL_VERSION" ]; then
echo "changed=true" >> "$GITHUB_OUTPUT"
echo "Version increased: npm=$NPM_VERSION -> local=$LOCAL_VERSION"
else
echo "changed=false" >> "$GITHUB_OUTPUT"
echo "::notice::Skipping npmjs publish because local version $LOCAL_VERSION is older than npmjs version $NPM_VERSION"
fi
- name: Install pnpm
if: steps.version-check.outputs.changed == 'true'
uses: pnpm/action-setup@v5
- name: Set up Node
if: steps.version-check.outputs.changed == 'true'
uses: actions/setup-node@v6
with:
node-version-file: ./.nvmrc
cache: pnpm
- name: Install dependencies & build
if: steps.version-check.outputs.changed == 'true'
run: pnpm install --frozen-lockfile && pnpm build
- name: Publish to npmjs.org
if: steps.version-check.outputs.changed == 'true'
run: bash scripts/promote-to-npmjs.sh
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
GITHUB_REPO_OWNER: ${{ github.repository_owner }}
GITHUB_REPO_NAME: ${{ github.event.repository.name }}
RELEASE_VERSION: ${{ steps.version-check.outputs.local }}
- name: Create GitHub Release
if: steps.version-check.outputs.changed == 'true'
run: |
VERSION="${{ steps.version-check.outputs.local }}"
# Extract changelog section for this version
BODY=$(sed -n "/^## v${VERSION}/,/^## v/{ /^## v${VERSION}/d; /^## v/d; p; }" CHANGELOG.md 2>/dev/null | head -100 || true)
gh release create "v${VERSION}" \
--title "v${VERSION}" \
--notes "${BODY:-Release v${VERSION}}" \
--target "${{ github.sha }}" || echo "::warning::GitHub Release creation skipped (tag may not exist or release already exists)"
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# ---------------------------------------------------------------------------
# Build arm64 — native arm build with BuildKit registry cache
# ---------------------------------------------------------------------------
build:
name: Build Docker (arm64)
needs: [changes]
if: needs.changes.outputs.code == 'true'
runs-on: ubuntu-24.04-arm
steps:
- uses: actions/checkout@v5
- name: Install pnpm
uses: pnpm/action-setup@v5
- name: Set up Node
uses: actions/setup-node@v6
with:
node-version-file: ./.nvmrc
cache: pnpm
- name: Install dependencies & build
run: pnpm install --frozen-lockfile && pnpm build
- name: Login to ghcr.io
uses: docker/login-action@v4
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- uses: docker/setup-buildx-action@v3
- name: Build and push Docker images (arm64)
run: |
BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
COMMIT_URL="${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}"
docker buildx build \
--platform linux/arm64 \
--build-arg GIT_COMMIT=${{ github.sha }} \
--build-arg BUILD_DATE="${BUILD_DATE}" \
--build-arg COMMIT_URL="${COMMIT_URL}" \
--cache-from type=registry,ref=ghcr.io/${{ github.repository }}:cache-arm64 \
--cache-to type=registry,ref=ghcr.io/${{ github.repository }}:cache-arm64,mode=max \
--target engine \
--tag ghcr.io/${{ github.repository }}:${{ github.sha }}-arm64 \
--push \
.
docker buildx build \
--platform linux/arm64 \
--build-arg GIT_COMMIT=${{ github.sha }} \
--build-arg BUILD_DATE="${BUILD_DATE}" \
--build-arg COMMIT_URL="${COMMIT_URL}" \
--cache-from type=registry,ref=ghcr.io/${{ github.repository }}-service:cache-arm64 \
--cache-to type=registry,ref=ghcr.io/${{ github.repository }}-service:cache-arm64,mode=max \
--target service \
--tag ghcr.io/${{ github.repository }}-service:${{ github.sha }}-arm64 \
--push \
.
# ---------------------------------------------------------------------------
# Build amd64 — native x86 build in parallel with arm64 [push only]
# ---------------------------------------------------------------------------
build_amd64:
name: Build Docker (amd64)
needs: [changes]
if: ${{ github.event_name == 'push' && needs.changes.outputs.code == 'true' }}
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v5
- name: Install pnpm
uses: pnpm/action-setup@v5
- name: Set up Node
uses: actions/setup-node@v6
with:
node-version-file: ./.nvmrc
cache: pnpm
- name: Install dependencies & build
run: pnpm install --frozen-lockfile && pnpm build
- name: Login to ghcr.io
uses: docker/login-action@v4
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- uses: docker/setup-buildx-action@v3
- name: Build and push Docker images (amd64)
run: |
BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
COMMIT_URL="${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}"
docker buildx build \
--platform linux/amd64 \
--build-arg GIT_COMMIT=${{ github.sha }} \
--build-arg BUILD_DATE="${BUILD_DATE}" \
--build-arg COMMIT_URL="${COMMIT_URL}" \
--cache-from type=registry,ref=ghcr.io/${{ github.repository }}:cache-amd64 \
--cache-to type=registry,ref=ghcr.io/${{ github.repository }}:cache-amd64,mode=max \
--target engine \
--tag ghcr.io/${{ github.repository }}:${{ github.sha }}-amd64 \
--push \
.
docker buildx build \
--platform linux/amd64 \
--build-arg GIT_COMMIT=${{ github.sha }} \
--build-arg BUILD_DATE="${BUILD_DATE}" \
--build-arg COMMIT_URL="${COMMIT_URL}" \
--cache-from type=registry,ref=ghcr.io/${{ github.repository }}-service:cache-amd64 \
--cache-to type=registry,ref=ghcr.io/${{ github.repository }}-service:cache-amd64,mode=max \
--target service \
--tag ghcr.io/${{ github.repository }}-service:${{ github.sha }}-amd64 \
--push \
.
# ---------------------------------------------------------------------------
# Merge — combine arm64 + amd64 into a single multi-arch manifest [push only]
# ---------------------------------------------------------------------------
build_manifest:
name: Merge multi-arch manifest
needs: [build, build_amd64]
if: ${{ github.event_name == 'push' }}
runs-on: ubuntu-24.04-arm
steps:
- name: Login to ghcr.io
uses: docker/login-action@v4
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Create and push multi-arch manifests
run: |
TAG="${GITHUB_REF_NAME//\//-}"
docker buildx imagetools create \
--tag ghcr.io/${{ github.repository }}:${{ github.sha }} \
--tag ghcr.io/${{ github.repository }}:${TAG} \
ghcr.io/${{ github.repository }}:${{ github.sha }}-amd64 \
ghcr.io/${{ github.repository }}:${{ github.sha }}-arm64
docker buildx imagetools create \
--tag ghcr.io/${{ github.repository }}-service:${{ github.sha }} \
--tag ghcr.io/${{ github.repository }}-service:${TAG} \
ghcr.io/${{ github.repository }}-service:${{ github.sha }}-amd64 \
ghcr.io/${{ github.repository }}-service:${{ github.sha }}-arm64
- name: Docker smoke test
run: |
docker run -d --name smoke -p 3000:3000 ghcr.io/${{ github.repository }}:${{ github.sha }}
trap 'docker rm -f smoke 2>/dev/null || true' EXIT
for i in $(seq 1 30); do
body=$(curl -sf http://localhost:3000/health 2>/dev/null || true)
if echo "$body" | grep -q '"ok":true'; then
echo "health check passed: $body"
exit 0
fi
sleep 1
done
echo "health check timed out"
docker logs smoke
exit 1
# ---------------------------------------------------------------------------
# E2E Docker — Docker image smoke + engine tests (runs on every push/PR)
# ---------------------------------------------------------------------------
e2e_docker:
name: E2E Docker
needs: build
runs-on: ubuntu-24.04-arm
steps:
- uses: actions/checkout@v5
- name: Install pnpm
uses: pnpm/action-setup@v5
- name: Set up Node
uses: actions/setup-node@v6
with:
node-version-file: ./.nvmrc
cache: pnpm
- name: Install dependencies & build
run: pnpm install --frozen-lockfile && pnpm build
- name: Start Postgres with SSL
run: |
docker run -d --name ci-postgres \
-e POSTGRES_PASSWORD=postgres \
-p 55432:5432 \
postgres:18 \
-c ssl=on \
-c ssl_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem \
-c ssl_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
for i in $(seq 1 30); do
docker exec ci-postgres pg_isready -U postgres && break || sleep 2
done
- name: Login to ghcr.io
uses: docker/login-action@v4
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Docker tests
run: |
IMAGE="ghcr.io/${{ github.repository }}:${{ github.sha }}-arm64"
docker pull "$IMAGE"
if [ -n "${STRIPE_API_KEY:-}" ]; then
bash e2e/docker.test.sh "$IMAGE"
else
echo "::warning::Docker e2e skipped — STRIPE_API_KEY not available. Running smoke only."
docker run --rm "$IMAGE" --version
fi
env:
STRIPE_API_KEY: ${{ secrets.STRIPE_API_KEY }}
POSTGRES_URL: 'postgres://postgres:postgres@localhost:55432/postgres'
GOOGLE_CLIENT_ID: ${{ vars.GOOGLE_CLIENT_ID }}
GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
GOOGLE_REFRESH_TOKEN: ${{ secrets.GOOGLE_REFRESH_TOKEN }}
GOOGLE_SPREADSHEET_ID: ${{ vars.GOOGLE_SPREADSHEET_ID }}
- name: Disconnect & time-limit tests (Docker)
run: |
pnpm --filter @stripe/sync-e2e exec vitest run test-disconnect.test.ts
env:
DISCONNECT_TEST_DOCKER: '1'
DISCONNECT_TEST_DOCKER_HOST_NETWORK: '1'
ENGINE_IMAGE: 'ghcr.io/${{ github.repository }}:${{ github.sha }}-arm64'
- name: Smokescreen proxy e2e
run: |
if [ -z "${STRIPE_API_KEY:-}" ]; then
echo "::warning::smokescreen.test.sh skipped — STRIPE_API_KEY not available"
exit 0
fi
bash e2e/smokescreen.test.sh
env:
STRIPE_API_KEY: ${{ secrets.STRIPE_API_KEY }}
ENGINE_IMAGE: 'ghcr.io/${{ github.repository }}:${{ github.sha }}-arm64'
- name: Publish test
run: |
if [ -z "${STRIPE_NPM_REGISTRY:-}" ]; then
echo "::warning::publish.test.sh skipped — STRIPE_NPM_REGISTRY not set"
exit 0
fi
bash e2e/publish.test.sh
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# ---------------------------------------------------------------------------
# E2E Stripe — Stripe API + Temporal integration tests (runs on every push/PR)
# ---------------------------------------------------------------------------
e2e_stripe:
name: E2E Stripe
runs-on: ubuntu-24.04-arm
services:
temporal-db:
image: postgres:16-alpine
env:
POSTGRES_USER: temporal
POSTGRES_PASSWORD: temporal
options: >-
--health-cmd "pg_isready -U temporal"
--health-interval 5s
--health-timeout 3s
--health-retries 5
temporal:
image: temporalio/auto-setup:latest
env:
DB: postgres12
DB_PORT: 5432
POSTGRES_USER: temporal
POSTGRES_PWD: temporal
POSTGRES_SEEDS: temporal-db
ports:
- 7233:7233
steps:
- uses: actions/checkout@v5
- name: Start Postgres with SSL
run: |
docker run -d --name ci-postgres \
-e POSTGRES_PASSWORD=postgres \
-p 55432:5432 \
postgres:18 \
-c ssl=on \
-c ssl_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem \
-c ssl_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
for i in $(seq 1 30); do
docker exec ci-postgres pg_isready -U postgres && break || sleep 2
done
- name: Install pnpm
uses: pnpm/action-setup@v5
- name: Set up Node
uses: actions/setup-node@v6
with:
node-version-file: ./.nvmrc
cache: pnpm
- name: Install dependencies & build
run: pnpm install --frozen-lockfile && pnpm build
- name: E2E vitest tests
run: |
if [ -z "${STRIPE_API_KEY:-}" ]; then
echo "::warning::E2E tests skipped — STRIPE_API_KEY not available (fork PR?)"
exit 0
fi
pnpm --filter @stripe/sync-e2e exec vitest run \
--exclude 'service-docker.test.ts' \
--exclude 'test-server-all-api.test.ts' \
--exclude 'test-server-sync.test.ts' \
--exclude 'test-sync-e2e.test.ts' \
--exclude 'test-sync-engine.test.ts' \
--exclude 'test-e2e-network.test.ts' \
--exclude 'test-disconnect.test.ts' # ↑ run in dedicated Docker / main jobs
env:
STRIPE_API_KEY: ${{ secrets.STRIPE_API_KEY }}
POSTGRES_URL: 'postgres://postgres:postgres@localhost:55432/postgres'
TEMPORAL_ADDRESS: 'localhost:7233'
- name: Skipped test warnings
if: always()
run: '[ -f /tmp/vitest-skip-warnings.txt ] && cat /tmp/vitest-skip-warnings.txt || true'
# ---------------------------------------------------------------------------
# E2E Test Server — test-server suites that need Docker Compose infrastructure
# ---------------------------------------------------------------------------
e2e_test_server:
name: E2E Test Server
runs-on: ubuntu-24.04-arm
steps:
- uses: actions/checkout@v5
- name: Install pnpm
uses: pnpm/action-setup@v5
- name: Set up Node
uses: actions/setup-node@v6
with:
node-version-file: ./.nvmrc
cache: pnpm
- name: Install dependencies & build
run: pnpm install --frozen-lockfile && pnpm build
- name: Start Docker Compose stack
run: |
docker compose -f compose.yml -f compose.dev.yml -f e2e/compose.e2e.yml \
up --build -d --wait temporal engine service worker
- name: Test server suites (parallel)
run: |
pnpm --filter @stripe/sync-e2e exec vitest run \
test-server-all-api.test.ts \
test-server-sync.test.ts \
test-sync-e2e.test.ts \
test-sync-engine.test.ts
env:
SKIP_SETUP: '1'
GH_TOKEN: ${{ github.token }}
GITHUB_TOKEN: ${{ github.token }}
- name: Network interruption tests (pauses containers)
run: |
pnpm --filter @stripe/sync-e2e exec vitest run \
test-e2e-network.test.ts
env:
SKIP_SETUP: '1'
- name: Skipped test warnings
if: always()
run: '[ -f /tmp/vitest-skip-warnings.txt ] && cat /tmp/vitest-skip-warnings.txt || true'
# ---------------------------------------------------------------------------
# E2E Service — service + worker Docker containers end-to-end (every push/PR)
# ---------------------------------------------------------------------------
e2e_service:
name: E2E Service Docker
needs: build
runs-on: ubuntu-24.04-arm
services:
temporal-db:
image: postgres:16-alpine
env:
POSTGRES_USER: temporal
POSTGRES_PASSWORD: temporal
options: >-
--health-cmd "pg_isready -U temporal"
--health-interval 5s
--health-timeout 3s
--health-retries 5
temporal:
image: temporalio/auto-setup:latest
env:
DB: postgres12
DB_PORT: 5432
POSTGRES_USER: temporal
POSTGRES_PWD: temporal
POSTGRES_SEEDS: temporal-db
ports:
- 7233:7233
steps:
- uses: actions/checkout@v5
- name: Start Postgres with SSL
run: |
docker run -d --name ci-postgres \
-e POSTGRES_PASSWORD=postgres \
-p 55432:5432 \
postgres:18 \
-c ssl=on \
-c ssl_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem \
-c ssl_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
for i in $(seq 1 30); do
docker exec ci-postgres pg_isready -U postgres && break || sleep 2
done
- name: Start stripe-mock
run: |
docker run -d --name ci-stripe-mock -p 12111:12111 stripe/stripe-mock:latest
for i in $(seq 1 20); do
if nc -z localhost 12111 2>/dev/null; then
echo "stripe-mock ready after ${i}s"
break
fi
sleep 0.5
done
nc -z localhost 12111 || (echo "stripe-mock failed to start"; exit 1)
- name: Login to ghcr.io
uses: docker/login-action@v4
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Install pnpm
uses: pnpm/action-setup@v5
- name: Set up Node
uses: actions/setup-node@v6
with:
node-version-file: ./.nvmrc
cache: pnpm
- name: Pull images and install dependencies in parallel
run: |
ENGINE_IMAGE="ghcr.io/${{ github.repository }}:${{ github.sha }}-arm64"
SERVICE_IMAGE="ghcr.io/${{ github.repository }}-service:${{ github.sha }}-arm64"
docker pull "$ENGINE_IMAGE" &
docker pull "$SERVICE_IMAGE" &
pnpm install --frozen-lockfile && pnpm build
wait
env:
ENGINE_IMAGE: ${{ github.repository }}
SERVICE_IMAGE: ${{ github.repository }}-service
- name: Wait for Temporal to be ready
run: |
echo "Waiting for Temporal gRPC on localhost:7233..."
for i in $(seq 1 90); do
if nc -z 127.0.0.1 7233 2>/dev/null; then
echo "Temporal port open after ${i}s"
break
fi
sleep 1
done
nc -z 127.0.0.1 7233 || (echo "Temporal never became ready"; exit 1)
# Sleep to allow schema migration + namespace creation to complete after port opens
sleep 20
- name: Start service containers
run: |
ENGINE_IMAGE="ghcr.io/${{ github.repository }}:${{ github.sha }}-arm64"
SERVICE_IMAGE="ghcr.io/${{ github.repository }}-service:${{ github.sha }}-arm64"
docker run -d --name ci-engine --network=host \
-e PORT=3000 \
"$ENGINE_IMAGE"
docker volume create ci-pipeline-data
docker run -d --name ci-service --network=host \
-v ci-pipeline-data:/data \
"$SERVICE_IMAGE" \
serve --temporal-address localhost:7233 --port 4020 --data-dir /data
docker run -d --name ci-worker --network=host \
-v ci-pipeline-data:/data \
"$SERVICE_IMAGE" \
worker --temporal-address localhost:7233 --engine-url http://localhost:3000 --data-dir /data
# Wait for service API health
for i in $(seq 1 60); do
if curl -sf http://localhost:4020/health > /dev/null 2>&1; then
echo "Service healthy after ${i}s"
break
fi
sleep 1
done
curl -sf http://localhost:4020/health || (echo "Service failed to start"; docker logs ci-service; exit 1)
# Verify worker is still running (crashes immediately on misconfiguration)
sleep 3
if ! docker inspect ci-worker --format='{{.State.Running}}' | grep -q true; then
echo "Worker container exited unexpectedly:"
docker logs ci-worker 2>&1 | tail -30
exit 1
fi
echo "Worker is running"
- name: Service Docker e2e
run: |
if [ -z "${STRIPE_API_KEY:-}" ]; then
echo "::warning::service-docker.test.ts skipped — STRIPE_API_KEY not available"
exit 0
fi
pnpm --filter @stripe/sync-e2e exec vitest run service-docker.test.ts
env:
STRIPE_API_KEY: ${{ secrets.STRIPE_API_KEY }}
POSTGRES_URL: 'postgres://postgres:postgres@localhost:55432/postgres'
POSTGRES_CONTAINER_URL: 'postgresql://postgres:postgres@localhost:55432/postgres'
STRIPE_MOCK_URL: 'http://localhost:12111'
SERVICE_DOCKER_E2E: '1'
SKIP_SETUP: '1'
- name: Dump container logs
if: always()
run: |
for name in ci-engine ci-service ci-worker; do
echo "=== $name ==="
docker logs "$name" 2>&1 | tail -100 || true
done
- name: Stop service containers
if: always()
run: docker rm -f ci-engine ci-service ci-worker ci-stripe-mock 2>/dev/null || true
- name: Skipped test warnings
if: always()
run: '[ -f /tmp/vitest-skip-warnings.txt ] && cat /tmp/vitest-skip-warnings.txt || true'
# ---------------------------------------------------------------------------
# Docker Hub — promote the built GHCR image to Docker Hub tags
# ---------------------------------------------------------------------------
publish_dockerhub:
name: Publish Docker Hub
needs: [build_manifest]
if: ${{ github.event_name == 'push' }}
runs-on: ubuntu-24.04-arm
steps:
- uses: actions/checkout@v5
with:
sparse-checkout: scripts/promote-to-dockerhub.sh
- name: Login to ghcr.io
uses: docker/login-action@v4
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Login to Docker Hub
uses: docker/login-action@v4
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN_SYNC_ENGINE }}
- name: Sanitize ref name for Docker tag
id: tag
run: echo "name=${GITHUB_REF_NAME//\//-}" >> "$GITHUB_OUTPUT"
- name: Promote built image to Docker Hub
run: bash scripts/promote-to-dockerhub.sh
env:
GHCR_IMAGE: ghcr.io/${{ github.repository }}:${{ github.sha }}
DOCKERHUB_TAGS: ${{ steps.tag.outputs.name }}${{ github.ref_name == 'main' && ' latest' || '' }}