Niek Otten
d49443353e
On the single self-hosted runner CI jobs run sequentially, so booting OpenZaak once beats once-per-job. Replace the integration + notifications + compose-smoke jobs with one verify-stack job that brings the full stack up once and runs, as clearly-named steps: health (make verify-up, the DoD smoke) → ACL ↔ OpenZaak (verify-acl) → OpenZaak → NRC delivery (verify-nrc) → teardown (always) + log dump on failure. The check logic moves into stack-agnostic runners (run-acl-integration.sh, run-notification-check.sh) that operate on whatever stack is already up, reaching services by container IP. The local single-concern wrappers (make integration oz-only, make verify-notifications oz+nrc) keep working by delegating to the same runners, so nothing is duplicated. make ci now runs the consolidated 'verify' stage. Verified locally: make verify boots the full stack once, ACL integration passes and the NRC notification is delivered, then tears down. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
38 lines
1.9 KiB
Bash
Executable File
38 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Run the ACL integration tests (Category=Integration) against the OpenZaak that is
|
|
# ALREADY running — works for any stack: oz-only (`make integration`), the standalone
|
|
# oz+nrc stack, or the full compose stack (the CI `verify-stack` job). Seeds a
|
|
# published BIG zaaktype (idempotent), then builds + runs the test image on the stack
|
|
# network, reaching OpenZaak by container IP (a single-label host isn't URL-valid;
|
|
# the runner can't reach published ports — see gitea-actions-gotchas.md §5/§6).
|
|
#
|
|
# Does NOT manage the stack lifecycle: the caller owns bring-up + teardown. Plain
|
|
# docker primitives only (docker/podman-portable). See ADR-0006.
|
|
set -euo pipefail
|
|
|
|
here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
root="$(cd "$here/.." && pwd)"
|
|
|
|
# The OpenZaak API container, matched across compose projects + docker/podman naming
|
|
# (`<project>[-_]openzaak[-_]<n>`); the delimiters exclude oz-db / oz-redis / oz-init.
|
|
oz="$(docker ps -q --filter 'name=[-_]openzaak[-_]' | head -1)"
|
|
[ -n "$oz" ] || { echo "ERROR: no running OpenZaak container found — bring the stack up first" >&2; exit 1; }
|
|
net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$oz" | head -1)"
|
|
oz_ip="$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$oz")"
|
|
oz_base="http://$oz_ip:8000"
|
|
echo ">> OpenZaak at $oz_base on network $net"
|
|
|
|
echo ">> seeding a published BIG zaaktype (idempotent)"
|
|
sid="$(docker create --network "$net" -e "OZ_BASE=$oz_base" -e OZ_PUBLISH=1 \
|
|
python:3-slim python /seed.py)"
|
|
docker cp "$here/openzaak/seed_catalogus.py" "$sid:/seed.py" >/dev/null
|
|
docker start -a "$sid"
|
|
docker rm -f "$sid" >/dev/null
|
|
|
|
echo ">> building the integration test image"
|
|
docker build -f "$root/services/acl/Dockerfile.integration" -t rr-acl-integration "$root/services/acl"
|
|
|
|
echo ">> running the ACL integration tests (inside the network)"
|
|
docker run --rm --network "$net" -e "OZ_BASE=$oz_base" rr-acl-integration
|