Merge origin/master and resolve workflow conflicts

.github/workflows/tests.yml

@@ -5,68 +5,42 @@ on:
   push:
 
 jobs:
-  unit:
-    name: Unit (required)
+  php:
+    name: PHP ${{ matrix.suite }} (required)
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        suite: [unit, integration, api, legacy]
+    env:
+      COMPOSE_PROJECT_NAME: php-${{ github.run_id }}-${{ github.job }}-${{ matrix.suite }}-${{ github.run_attempt }}
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Setup Node.js
+        if: ${{ matrix.suite == 'unit' }}
         uses: actions/setup-node@v4
         with:
           node-version: 22
 
       - name: Check AI workflow sync
+        if: ${{ matrix.suite == 'unit' }}
         run: node scripts/sync-ai-workflow.mjs --check
 
-      - name: Materialize compose env files
-        env:
-          COMPOSE_ENV: ${{ secrets.COMPOSE_ENV }}
-          COMPOSE_ENV_STAGING: ${{ secrets.COMPOSE_ENV_STAGING }}
-        run: |
-          set -euo pipefail
-          if [ -z "${COMPOSE_ENV}" ]; then
-            echo "Required GitHub secret COMPOSE_ENV is not configured." >&2
-            exit 1
-          fi
-          if [ -z "${COMPOSE_ENV_STAGING}" ]; then
-            echo "Required GitHub secret COMPOSE_ENV_STAGING is not configured." >&2
-            exit 1
-          fi
-          printf '%s\n' "$COMPOSE_ENV" > .env
-          printf '%s\n' "$COMPOSE_ENV_STAGING" > .env.staging
+      - name: Run PHP ${{ matrix.suite }} suite
+        run: bash scripts/php-ci-test.sh ${{ matrix.suite }}
 
-      - name: Boot php1 test stack
-        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml up -d redis mysql-debug php1
-
-      - name: Sync PHP app checkout
-        run: tar -C services/nginx/app -cf - . | docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 tar -C /var/www/html -xf -
-
-      - name: Resolve dependencies
-        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 sh -lc "cd /var/www/html && composer update --no-interaction --prefer-dist"
-
-      - name: Run unit tests
-        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 sh -lc "cd /var/www/html && composer test:unit"
-
-      - name: Generate coverage report
-        run: |
-          docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 sh -lc "cd /var/www/html && if php -m | grep -Eq '^(pcov|xdebug)$'; then composer test:coverage; else echo 'Skipping coverage: no pcov/xdebug extension available in php1 image.'; fi"
-
-      - name: Upload coverage artifact
-        if: ${{ github.event_name == 'pull_request' }}
+      - name: Upload PHP suite logs
+        if: ${{ failure() }}
         continue-on-error: true
         uses: actions/upload-artifact@v4
         with:
-          name: unit-coverage-clover
-          path: services/nginx/app/build/logs/clover.xml
+          name: php-${{ matrix.suite }}-logs
+          path: .tmp/ci-logs/${{ matrix.suite }}
           if-no-files-found: warn
-          retention-days: 1
-
-      - name: Tear down php1 test stack
-        if: always()
-        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml down -v
+          retention-days: 3
 
   edge-agent:
     name: Edge Agent (required)
@@ -83,6 +57,30 @@ jobs:
           cache: npm
           cache-dependency-path: services/edge-agent/package-lock.json
 
+      - name: Install native build tools
+        run: |
+          set -euo pipefail
+          if command -v make >/dev/null 2>&1 && command -v g++ >/dev/null 2>&1; then
+            exit 0
+          fi
+
+          if ! command -v apt-get >/dev/null 2>&1; then
+            echo "make and g++ are required to install node-pty, but apt-get is not available on this runner." >&2
+            exit 1
+          fi
+
+          apt_cmd=(apt-get)
+          if [ "$(id -u)" -ne 0 ]; then
+            if ! command -v sudo >/dev/null 2>&1; then
+              echo "make and g++ are missing, and sudo is not available to install them." >&2
+              exit 1
+            fi
+            apt_cmd=(sudo apt-get)
+          fi
+
+          "${apt_cmd[@]}" update
+          "${apt_cmd[@]}" install -y --no-install-recommends build-essential python3
+
       - name: Install dependencies
         working-directory: services/edge-agent
         run: npm ci
@@ -99,22 +97,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Materialize compose env files
-        env:
-          COMPOSE_ENV: ${{ secrets.COMPOSE_ENV }}
-          COMPOSE_ENV_STAGING: ${{ secrets.COMPOSE_ENV_STAGING }}
+      - name: Materialize CI compose env files
         run: |
           set -euo pipefail
-          if [ -z "${COMPOSE_ENV}" ]; then
-            echo "Required GitHub secret COMPOSE_ENV is not configured." >&2
-            exit 1
-          fi
-          if [ -z "${COMPOSE_ENV_STAGING}" ]; then
-            echo "Required GitHub secret COMPOSE_ENV_STAGING is not configured." >&2
-            exit 1
-          fi
-          printf '%s\n' "$COMPOSE_ENV" > .env
-          printf '%s\n' "$COMPOSE_ENV_STAGING" > .env.staging
+          cp .github/ci.env .env
+          cp .github/ci.env.staging .env.staging
 
       - name: Validate compose contracts
         run: |
@@ -141,6 +128,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       COMPOSE_FILE: docker-compose.yml:.github/docker-compose.ci.yml
+      COMPOSE_PROJECT_NAME: edge-gateway-backend-${{ github.run_id }}-${{ github.run_attempt }}
       TRAEFIK_WEB_PORT: "18080"
       TRAEFIK_WEBSECURE_PORT: "18443"
       TRAEFIK_WEBSECURE_STAGING_PORT: "18433"
@@ -151,22 +139,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Materialize compose env files
-        env:
-          COMPOSE_ENV: ${{ secrets.COMPOSE_ENV }}
-          COMPOSE_ENV_STAGING: ${{ secrets.COMPOSE_ENV_STAGING }}
+      - name: Materialize CI compose env files
         run: |
           set -euo pipefail
-          if [ -z "${COMPOSE_ENV}" ]; then
-            echo "Required GitHub secret COMPOSE_ENV is not configured." >&2
-            exit 1
-          fi
-          if [ -z "${COMPOSE_ENV_STAGING}" ]; then
-            echo "Required GitHub secret COMPOSE_ENV_STAGING is not configured." >&2
-            exit 1
-          fi
-          printf '%s\n' "$COMPOSE_ENV" > .env
-          printf '%s\n' "$COMPOSE_ENV_STAGING" > .env.staging
+          cp .github/ci.env .env
+          cp .github/ci.env.staging .env.staging
+          printf '\nEDGE_PUBLIC_BROKER_URL=http://edge-broker:4300\n' >> .env
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -174,13 +152,19 @@ jobs:
           node-version: 22
 
       - name: Boot local stack
-        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml up -d traefik redis mysql-debug edge-broker php1 caddy
+        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml up -d traefik redis mysql-debug edge-broker php1 php2 php3 php4 php5 caddy
 
       - name: Sync PHP app checkout
-        run: tar -C services/nginx/app -cf - . | docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 tar -C /var/www/html -xf -
+        run: >
+          tar
+          --exclude='./vendor'
+          --exclude='./.phpunit.cache'
+          --exclude='./build/logs'
+          -C services/nginx/app -cf - .
+          | docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 tar -C /var/www/html -xf -
 
       - name: Resolve dependencies
-        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 sh -lc "cd /var/www/html && composer update --no-interaction --prefer-dist"
+        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 sh -lc "cd /var/www/html && composer install --no-interaction --prefer-dist --no-progress"
 
       - name: Verify edge gateway test files
         run: >
@@ -198,7 +182,18 @@ jobs:
           "cd /var/www/html &&
           RUN_API_TESTS=1
           API_TEST_BOOTSTRAP_SCHEMA=1
+          API_TEST_ALLOW_LIVE_DB=1
           CONFIG_DB_TARGET=debug
+          CONFIG_DB_HOST=mysql-debug
+          CONFIG_DB_USER=\${CONFIG_DB_USER:-root}
+          CONFIG_DB_PASSWORD=\${CONFIG_DB_PASSWORD:-debug_root_password}
+          CONFIG_DB_DATABASE=\${CONFIG_DB_DATABASE:-nnks_db_debug}
+          CONFIG_DB_PORT=3306
+          CONFIG_DB_DEBUG_HOST=mysql-debug
+          CONFIG_DB_DEBUG_USER=\${CONFIG_DB_DEBUG_USER:-root}
+          CONFIG_DB_DEBUG_PASSWORD=\${CONFIG_DB_DEBUG_PASSWORD:-debug_root_password}
+          CONFIG_DB_DEBUG_DATABASE=\${CONFIG_DB_DEBUG_DATABASE:-nnks_db_debug}
+          CONFIG_DB_DEBUG_PORT=3306
           API_TEST_REQUEST_TIMEOUT=180
           EDGE_GATEWAY_VIEW_CACHE_TTL=0
           EDGE_BROKER_URL=
@@ -214,6 +209,16 @@ jobs:
           "cd /var/www/html &&
           RUN_INTEGRATION_TESTS=1
           CONFIG_DB_TARGET=debug
+          CONFIG_DB_HOST=mysql-debug
+          CONFIG_DB_USER=\${CONFIG_DB_USER:-root}
+          CONFIG_DB_PASSWORD=\${CONFIG_DB_PASSWORD:-debug_root_password}
+          CONFIG_DB_DATABASE=\${CONFIG_DB_DATABASE:-nnks_db_debug}
+          CONFIG_DB_PORT=3306
+          CONFIG_DB_DEBUG_HOST=mysql-debug
+          CONFIG_DB_DEBUG_USER=\${CONFIG_DB_DEBUG_USER:-root}
+          CONFIG_DB_DEBUG_PASSWORD=\${CONFIG_DB_DEBUG_PASSWORD:-debug_root_password}
+          CONFIG_DB_DEBUG_DATABASE=\${CONFIG_DB_DEBUG_DATABASE:-nnks_db_debug}
+          CONFIG_DB_DEBUG_PORT=3306
           EDGE_BROKER_URL=
           vendor/bin/pest tests/Integration/EdgeGateway --colors=always"
 
@@ -228,9 +233,15 @@ jobs:
             --name "$runner" \
             --network "${compose_project}_default" \
             -e COMPOSE_FILE="$COMPOSE_FILE" \
+            -e COMPOSE_PROJECT_NAME="$compose_project" \
+            -e TRAEFIK_WEB_PORT="${TRAEFIK_WEB_PORT:-18080}" \
+            -e TRAEFIK_WEBSECURE_PORT="${TRAEFIK_WEBSECURE_PORT:-18443}" \
+            -e TRAEFIK_WEBSECURE_STAGING_PORT="${TRAEFIK_WEBSECURE_STAGING_PORT:-18433}" \
+            -e TRAEFIK_METRICS_PORT="${TRAEFIK_METRICS_PORT:-19100}" \
             -e EDGE_GATEWAY_E2E_BASE_URL="http://caddy" \
             -e EDGE_GATEWAY_E2E_COMPOSE_PROJECT="$compose_project" \
             -e EDGE_GATEWAY_E2E_COPY_CONFIG="true" \
+            -e EDGE_GATEWAY_E2E_SKIP_COMPOSE_UP="true" \
             -v /var/run/docker.sock:/var/run/docker.sock \
             -w /workspace \
             node:22-alpine \
@@ -245,86 +256,31 @@ jobs:
         if: always()
         run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml down -v
 
-  integration:
-    name: Integration (advisory)
+  release-manager-gate:
+    name: Release Manager gate
     runs-on: ubuntu-latest
-    continue-on-error: true
+    needs: [php, edge-agent, edge-broker, edge-gateway-backend]
+    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Materialize compose env files
-        env:
-          COMPOSE_ENV: ${{ secrets.COMPOSE_ENV }}
-          COMPOSE_ENV_STAGING: ${{ secrets.COMPOSE_ENV_STAGING }}
+      - name: Record Release Manager API gate
         run: |
           set -euo pipefail
-          if [ -z "${COMPOSE_ENV}" ]; then
-            echo "Required GitHub secret COMPOSE_ENV is not configured." >&2
-            exit 1
-          fi
-          if [ -z "${COMPOSE_ENV_STAGING}" ]; then
-            echo "Required GitHub secret COMPOSE_ENV_STAGING is not configured." >&2
-            exit 1
-          fi
-          printf '%s\n' "$COMPOSE_ENV" > .env
-          printf '%s\n' "$COMPOSE_ENV_STAGING" > .env.staging
-
-      - name: Boot integration stack
-        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml up -d redis mysql-debug php1
-
-      - name: Sync PHP app checkout
-        run: tar -C services/nginx/app -cf - . | docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 tar -C /var/www/html -xf -
-
-      - name: Resolve dependencies
-        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 sh -lc "cd /var/www/html && composer update --no-interaction --prefer-dist"
-
-      - name: Run integration tests
-        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T -e RUN_INTEGRATION_TESTS=1 php1 sh -lc "cd /var/www/html && composer test:integration"
-
-      - name: Tear down integration stack
-        if: always()
-        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml down -v
-
-  api:
-    name: API (advisory)
-    runs-on: ubuntu-latest
-    continue-on-error: true
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Materialize compose env files
+          test -n "$RELEASE_MANAGER_GATE_TOKEN" || (echo "RELEASE_MANAGER_GATE_TOKEN is required" >&2; exit 1)
+          curl --fail --show-error --silent \
+            --connect-timeout 10 \
+            --retry 5 \
+            --retry-all-errors \
+            --retry-delay 15 \
+            --retry-max-time 300 \
+            -X POST "$RELEASE_MANAGER_GATE_URL" \
+            -H "Authorization: Bearer $RELEASE_MANAGER_GATE_TOKEN" \
+            -H "Content-Type: application/json" \
+            --data "{\"channel_slug\":\"stable\",\"app\":\"api\",\"repository\":\"$RELEASE_REPOSITORY\",\"branch\":\"$RELEASE_BRANCH\",\"expected_commit\":\"$RELEASE_EXPECTED_COMMIT\",\"workflow_url\":\"$RELEASE_WORKFLOW_URL\",\"auto_sync\":true,\"wait_timeout_seconds\":300,\"poll_interval_seconds\":10,\"required_checks\":[]}"
         env:
-          COMPOSE_ENV: ${{ secrets.COMPOSE_ENV }}
-          COMPOSE_ENV_STAGING: ${{ secrets.COMPOSE_ENV_STAGING }}
-        run: |
-          set -euo pipefail
-          if [ -z "${COMPOSE_ENV}" ]; then
-            echo "Required GitHub secret COMPOSE_ENV is not configured." >&2
-            exit 1
-          fi
-          if [ -z "${COMPOSE_ENV_STAGING}" ]; then
-            echo "Required GitHub secret COMPOSE_ENV_STAGING is not configured." >&2
-            exit 1
-          fi
-          printf '%s\n' "$COMPOSE_ENV" > .env
-          printf '%s\n' "$COMPOSE_ENV_STAGING" > .env.staging
-
-      - name: Boot API stack
-        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml up -d redis mysql-debug php1
-
-      - name: Sync PHP app checkout
-        run: tar -C services/nginx/app -cf - . | docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 tar -C /var/www/html -xf -
-
-      - name: Resolve dependencies
-        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 sh -lc "cd /var/www/html && composer update --no-interaction --prefer-dist"
-
-      - name: Run API tests
-        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T -e RUN_API_TESTS=1 -e API_TEST_BOOTSTRAP_SCHEMA=1 php1 sh -lc "cd /var/www/html && composer test:api"
-
-      - name: Tear down API stack
-        if: always()
-        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml down -v
+          RELEASE_MANAGER_GATE_URL: ${{ secrets.RELEASE_MANAGER_GATE_URL || 'https://api.truckwash.io/release/gate/test-runs' }}
+          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
+          RELEASE_REPOSITORY: ${{ github.repository }}
+          RELEASE_BRANCH: ${{ github.ref_name }}
+          RELEASE_EXPECTED_COMMIT: ${{ github.sha }}
+          RELEASE_WORKFLOW_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}