platform-smoke-test.yml

name: Platform Smoke Test

on:
  workflow_call:
    secrets:
      CF_ACCESS_CLIENT_ID_STAGING:
        required: true
      CF_ACCESS_CLIENT_SECRET_STAGING:
        required: true
      VOID_TOKEN_STAGING:
        required: true
  schedule:
    - cron: '0 0 * * *' # daily at 8am SGT (midnight UTC)
  workflow_dispatch:

permissions: {}

jobs:
  check-ref:
    if: ${{ vars.VOID_PLATFORM_DEPLOY_ENABLED == 'true' && github.ref == 'refs/heads/main' }}
    runs-on: ubuntu-latest
    steps:
      # Reusable runs use the caller's ref. Reject case variants before secrets.
      - name: Verify the exact smoke-test branch
        run: test "$GITHUB_REF" = 'refs/heads/main'

  smoke-test:
    if: ${{ vars.VOID_PLATFORM_DEPLOY_ENABLED == 'true' && github.ref == 'refs/heads/main' }}
    needs: check-ref
    runs-on: blacksmith-4vcpu-ubuntu-2404
    # Configure all three credentials in Staging. Reusable callers must declare
    # these secret names explicitly for GitHub to resolve the environment values.
    environment: Staging
    # Serialize fixture initialization and resets across scheduled/reusable runs.
    concurrency:
      group: staging-kitchen-sink-smoke
      cancel-in-progress: false
    # Include the deployment observer's 30-minute deadline, builds, and HTTP tests.
    timeout-minutes: 40
    permissions:
      contents: read
    steps:
      - name: Verify staging smoke-test credentials
        env:
          CF_ACCESS_CLIENT_ID_STAGING: ${{ secrets.CF_ACCESS_CLIENT_ID_STAGING }}
          CF_ACCESS_CLIENT_SECRET_STAGING: ${{ secrets.CF_ACCESS_CLIENT_SECRET_STAGING }}
          VOID_TOKEN_STAGING: ${{ secrets.VOID_TOKEN_STAGING }}
        run: |
          for name in CF_ACCESS_CLIENT_ID_STAGING CF_ACCESS_CLIENT_SECRET_STAGING VOID_TOKEN_STAGING; do
            if [[ -z "${!name}" ]]; then
              echo "::error::Missing $name. Configure it in the Staging environment."
              exit 1
            fi
          done
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: voidzero-dev/setup-vp@1b32467adbe183473499fd9d5d372c3ed9641754 # v1.18.0
        with:
          cache: true
          node-version-file: .node-version
      - run: vp run build
      - name: Initialize missing kitchen-sink fixture secrets
        run: node platform/scripts/kitchen-sink-staging-env.ts
        env:
          VOID_TOKEN: ${{ secrets.VOID_TOKEN_STAGING }}
          VOID_API_URL: https://api.staging.void.cloud
          VOID_ACCESS_ORIGIN: https://api.staging.void.cloud
          CF_ACCESS_CLIENT_ID: ${{ secrets.CF_ACCESS_CLIENT_ID_STAGING }}
          CF_ACCESS_CLIENT_SECRET: ${{ secrets.CF_ACCESS_CLIENT_SECRET_STAGING }}
      - name: Prepare the hosted kitchen-sink fixture
        id: fixture
        run: node platform/scripts/kitchen-sink-platform-fixture.ts
      - name: Deploy kitchen-sink
        timeout-minutes: 32
        working-directory: ${{ steps.fixture.outputs.path }}
        run: |
          node "$GITHUB_WORKSPACE/packages/void/dist/cli/cli.mjs" connect "$VOID_API_URL" --no-login
          node "$GITHUB_WORKSPACE/packages/void/dist/cli/cli.mjs" deploy --project kitchen-sink
        env:
          VOID_TOKEN: ${{ secrets.VOID_TOKEN_STAGING }}
          VOID_API_URL: https://api.staging.void.cloud
          STAGING: '1'
          VOID_ACCESS_ORIGIN: https://api.staging.void.cloud
          # Prerendering uses the separately protected resource proxy.
          VOID_ACCESS_CREDENTIALS: >-
            {"https://proxy.staging.void.cloud": {
              "CF_ACCESS_CLIENT_ID": ${{ toJSON(secrets.CF_ACCESS_CLIENT_ID_STAGING) }},
              "CF_ACCESS_CLIENT_SECRET": ${{ toJSON(secrets.CF_ACCESS_CLIENT_SECRET_STAGING) }}
            }}
          CF_ACCESS_CLIENT_ID: ${{ secrets.CF_ACCESS_CLIENT_ID_STAGING }}
          CF_ACCESS_CLIENT_SECRET: ${{ secrets.CF_ACCESS_CLIENT_SECRET_STAGING }}
      - name: Retain deployment diagnostics
        if: ${{ always() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: staging-deployment-${{ github.run_id }}-${{ github.run_attempt }}
          path: ~/.void/logs/deploy-*.jsonl
          include-hidden-files: true
          if-no-files-found: ignore
          retention-days: 7
      - run: vp exec playwright install chromium
      - name: Reset app state
        run: |
          curl -sf -X POST https://kitchen-sink.staging.void.app/api/reset \
            -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
            -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET"
        env:
          CF_ACCESS_CLIENT_ID: ${{ secrets.CF_ACCESS_CLIENT_ID_STAGING }}
          CF_ACCESS_CLIENT_SECRET: ${{ secrets.CF_ACCESS_CLIENT_SECRET_STAGING }}
      - name: Run smoke tests
        run: node --test-timeout=120000 --test platform/scripts/kitchen-sink-smoke-test.ts
        env:
          SMOKE_URL: https://kitchen-sink.staging.void.app
          CF_ACCESS_CLIENT_ID: ${{ secrets.CF_ACCESS_CLIENT_ID_STAGING }}
          CF_ACCESS_CLIENT_SECRET: ${{ secrets.CF_ACCESS_CLIENT_SECRET_STAGING }}