Add integration tests

[slominskir-coding-agent]

Adds integration tests that run against the app and its services in containers, following the pattern of JLab projects such as myquery and epics2web: an integration source set (src/integration/java) and an integrationTest task. The task is not part of ./gradlew build.

Running them

docker compose -f build.yaml up -d --build
./gradlew integrationTest

The tests wait up to 5 minutes for the app, Oracle and Keycloak to be ready (ADM_READY_TIMEOUT_SECONDS). ADM_URL and KEYCLOAK_URL point them at other ports. The README's Develop section says the same.

Tests

The tests use real Keycloak tokens, like CI's deploy workflow: the demo users tbrown (admin) and jadams (user) by password, and the adm client's service account (service-account-adm) by client credentials. Requests go to the app over HTTPS as bearer tokens.

• DeployIT (10): deploys to the sshd container and reads each job from /log:
  • tbrown deploys the demo env local-demo: exit 0, stdout 1.0.0;
  • the service account deploys to an env whose request user it is, as CI does;
  • a failing command keeps exit code 3 and its stdout and stderr (Record the deploy command's real exit code and output #17);
  • a prompt gets no input and fails at once (Give deploy commands empty input #20);
  • an unknown host is recorded as a stack trace with no exit code;
  • refused: another user, an invalid version (1.0.0; touch /tmp/pwned), a missing version (Reject a deploy request without a version #22), an unknown env, and a request without a token (302 to Keycloak's login).
• InventoryIT (2): an admin can add and remove an app env; jadams can't add one.

Each run adds its own app envs, named it- plus a random suffix, and removes them at the end, which removes their deploy jobs too (ON DELETE CASCADE). So runs leave the demo data as they found it, and two runs against one stack don't collide.

Other changes

• container/keycloak/initdb.d/03_customize.sh now also enables the password grant on the test realm's adm client, so tests can get tokens for demo users. This only affects the local test realm.
• That script is now executable. The Keycloak image runs only executable *.sh files, so it was silently skipped before, the same problem as Make the sshd container's entrypoint executable #18. Its existing setup (the deployer-group role for jsmith) never ran either; it does now.

CI: please add this job

The GitHub App can't change workflows, so this PR doesn't touch .github/workflows/ci.yaml. To run the tests on every PR, like myquery does, add this job:

  integration:
    needs:
      - build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21
      - uses: gradle/actions/setup-gradle@v4
        with:
          gradle-version: wrapper
      - name: Start containers
        run: docker compose -f build.yaml up -d --build
      - name: Run integration tests
        run: ./gradlew integrationTest
      - name: Dump container logs
        if: failure()
        run: docker compose -f build.yaml logs
      - name: Stop containers
        if: always()
        run: docker compose -f build.yaml down

I haven't been able to run that job. One risk: Dockerfile-sshd downloads http://pki.jlab.org/JLabCA.crt by default. It's reachable from the agent VM, but I don't know whether GitHub's runners can reach it. If they can't, add --build-arg, or set CUSTOM_CRT_URL to empty for the sshd build in build.yaml.

Checks

On the agent VM, with the stack started by docker compose -f build.yaml up -d --build:

• ./gradlew integrationTest: 12 passed in 16 s, and again on a second run. No it- envs were left afterwards.
• With the sshd container stopped, the 4 tests that run a deploy command fail, as they should.
• ./gradlew clean spotlessCheck build still runs only the unit tests.

The first --build on a fresh machine took about 13 minutes, mostly downloading images (Oracle XE alone is 4.5 GB). After that, the stack was ready about 2 minutes after up.

🤖 Generated with Claude Code

[slominskir-coding-agent]

Two commits since you started reviewing:

• 48e22e2: trust only the app's certificate, for the CodeQL alert. I've replied in that thread.
• 9d46791: wait for Keycloak's setup. awaitReady didn't retry a failed token request, which is an assertion error. It also treated the stack as ready once the service account could log in, which happens before the setup script that enables password logins has run. Starting two stacks at once for Make the Compose stack's ports configurable #26 showed this. I checked it by recreating Keycloak and running the tests straight away: they waited about 2.5 minutes, then all 12 passed.

The squash template uses the first commit's message, which still describes the PR.