platform-integration-test.yaml

# Based on
#   https://github.com/opentdf/java-sdk/blob/v0.6.1/.github/workflows/checks.yaml
#
# Except, that this is a "Composite Action", and specifies 'shell: bash' for
# each 'run:' step.
name: "Platform Integration testing"

on:
  workflow_call:
    inputs:
      wheel:
        description: The Python wheel to test
        required: true
        type: string
      python_version:
        description: The wheel's Python version (like "3.12" or "3.13")
        required: true
        type: string

permissions:
  contents: read

jobs:
  integration_test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout this repo
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11

      - uses: actions/cache/restore@v4
        with:
          path: dist/otdf_python-0.1.11-py3-none-any.whl
          key: ${{ runner.os }}${{ inputs.python_version }}-data-${{ github.sha }}

      - name: Prove that the input file is available
        shell: bash
        run: |
          ls -la
          ls -la "${{ inputs.wheel }}"
          du -sh "${{ inputs.wheel }}"

      # - uses: bufbuild/buf-setup-action@382440cdb8ec7bc25a68d7b4711163d95f7cc3aa
      #   with:
      #     github_token: ${{ secrets.GITHUB_TOKEN }}

      - name: Check out platform
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
        with:
          repository: opentdf/platform
          ref: main
          path: platform
      - name: Set up go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
        with:
          go-version: "1.22.3"
          check-latest: false
          cache-dependency-path: |
            platform/service/go.sum
            platform/examples/go.sum
            platform/protocol/go/go.sum
            platform/sdk/go.sum
      - run: go mod download
        shell: bash
        working-directory: platform
      - run: go mod verify
        shell: bash
        working-directory: platform
      - name: Create keys
        shell: bash
        run: |
          .github/scripts/init-temp-keys.sh
          cp opentdf-dev.yaml opentdf.yaml
          sudo chmod -R 777 ./keys
        working-directory: platform
      # - name: Trust the locally issued cert
      #   run: |
      #     keytool \
      #       -importcert \
      #       -storepass changeit \
      #       -noprompt \
      #       -file localhost.crt \
      #       -keystore $JAVA_HOME/lib/security/cacerts \
      #       -alias localhost-for-tests
      #   working-directory: platform/keys
      - name: Bring the services up
        shell: bash
        run: docker compose up -d --wait --wait-timeout 240
        working-directory: platform
      - name: Provision keycloak
        shell: bash
        run: go run ./service provision keycloak
        working-directory: platform
      - name: Provision fixtures
        shell: bash
        run: go run ./service provision fixtures
        working-directory: platform
      - name: Start server in background
        uses: JarvusInnovations/background-action@2428e7b970a846423095c79d43f759abf979a635
        with:
          run: |
            go run ./service start
          wait-on: |
            tcp:localhost:8080
          log-output-if: true
          wait-for: 90s
          working-directory: platform
      - name: Get grpcurl
        shell: bash
        run: go install github.com/fullstorydev/grpcurl/cmd/grpcurl@v1.8.9
      - name: Make sure that the platform is up
        shell: bash
        run: |
          grpcurl -plaintext localhost:8080 list && \
          grpcurl -plaintext localhost:8080 kas.AccessService/PublicKey

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
            python-version: ${{ inputs.python_version }}

      - name: Validate the Python SDK
        env:
          OPENTDF_CLIENT_ID: "opentdf-sdk"
          OPENTDF_CLIENT_SECRET: "secret"
          OPENTDF_HOSTNAME: "localhost:8080"
          OIDC_TOKEN_ENDPOINT: "http://localhost:8888/auth/realms/opentdf/protocol/openid-connect/token"
          OPENTDF_KAS_URL: "http://localhost:8080/kas"
        run: |
          mkdir validation
          wheel="$(basename ${{ inputs.wheel }} )"
          cp -v "${{ inputs.wheel }}" validation/
          cp -v validate_otdf_python.py validation/
          cd validation
          python -m venv .venv
          source .venv/bin/activate
          pip install ./"$wheel"
          python validate_otdf_python.py

      # - name: Validate the SDK through the command line interface
      #   run: |
      #     printf 'here is some data to encrypt' > data

      #     java -jar target/cmdline.jar \
      #       --client-id=opentdf-sdk \
      #       --client-secret=secret \
      #       --platform-endpoint=localhost:8080 \
      #       -i \
      #       encrypt --kas-url=localhost:8080 --mime-type=text/plain --attr https://example.com/attr/attr1/value/value1 --autoconfigure=false -f data -m 'here is some metadata' > test.tdf

      #     java -jar target/cmdline.jar \
      #       --client-id=opentdf-sdk \
      #       --client-secret=secret \
      #       --platform-endpoint=localhost:8080 \
      #       -i \
      #       decrypt -f test.tdf > decrypted

      #     java -jar target/cmdline.jar \
      #       --client-id=opentdf-sdk \
      #       --client-secret=secret \
      #       --platform-endpoint=localhost:8080 \
      #       -i \
      #       metadata -f test.tdf > metadata

      #     if ! diff -q data decrypted; then
      #       printf 'decrypted data is incorrect [%s]' "$(< decrypted)"
      #       exit 1
      #     fi

      #     if [ "$(< metadata)" != 'here is some metadata' ]; then
      #       printf 'metadata is incorrect [%s]\n' "$(< metadata)"
      #       exit 1
      #     fi
      #   working-directory: cmdline

      # - name: Encrypt/Decrypt NanoTDF
      #   run: |
      #     echo 'here is some data to encrypt' > data

      #     java -jar target/cmdline.jar \
      #       --client-id=opentdf-sdk \
      #       --client-secret=secret \
      #       --platform-endpoint=localhost:8080 \
      #       -i \
      #       encryptnano --kas-url=http://localhost:8080 --attr https://example.com/attr/attr1/value/value1 -f data -m 'here is some metadata' > nano.ntdf

      #     java -jar target/cmdline.jar \
      #       --client-id=opentdf-sdk \
      #       --client-secret=secret \
      #       --platform-endpoint=localhost:8080 \
      #       -i \
      #       decryptnano -f nano.ntdf > decrypted

      #     if ! diff -q data decrypted; then
      #       printf 'decrypted data is incorrect [%s]' "$(< decrypted)"
      #       exit 1
      #     fi
      #   working-directory: cmdline

      # - uses: JarvusInnovations/background-action@2428e7b970a846423095c79d43f759abf979a635
      #   name: start another KAS server in background
      #   with:
      #     run: >
      #       <opentdf.yaml >opentdf-beta.yaml yq e '
      #         (.server.port = 8282)
      #         | (.mode = ["kas"])
      #         | (.sdk_config = {"endpoint":"http://localhost:8080","plaintext":true,"client_id":"opentdf","client_secret":"secret"})
      #       '
      #       && go run ./service --config-file ./opentdf-beta.yaml start
      #     wait-on: |
      #       tcp:localhost:8282
      #     log-output-if: true
      #     wait-for: 90s
      #     working-directory: platform
      # - name: Make sure that the second platform is up
      #   run: |
      #     grpcurl -plaintext localhost:8282 kas.AccessService/PublicKey
      # - name: Validate multikas through the command line interface
      #   run: |
      #     printf 'here is some data to encrypt' > data

      #     java -jar target/cmdline.jar \
      #       --client-id=opentdf-sdk \
      #       --client-secret=secret \
      #       --platform-endpoint=localhost:8080 \
      #       -i \
      #       encrypt --kas-url=localhost:8080,localhost:8282 -f data -m 'here is some metadata' > test.tdf

      #     java -jar target/cmdline.jar \
      #       --client-id=opentdf-sdk \
      #       --client-secret=secret \
      #       --platform-endpoint=localhost:8080 \
      #       -i \
      #       decrypt -f test.tdf > decrypted

      #     java -jar target/cmdline.jar \
      #       --client-id=opentdf-sdk \
      #       --client-secret=secret \
      #       --platform-endpoint=localhost:8080 \
      #       -i \
      #       metadata -f test.tdf > metadata

      #     if ! diff -q data decrypted; then
      #       printf 'decrypted data is incorrect [%s]' "$(< decrypted)"
      #       exit 1
      #     fi

      #     if [ "$(< metadata)" != 'here is some metadata' ]; then
      #       printf 'metadata is incorrect [%s]\n' "$(< metadata)"
      #       exit 1
      #     fi
      #   working-directory: cmdline

  # platform-xtest:
  #   permissions:
  #     contents: read
  #     packages: read
  #   needs: platform-integration
  #   uses: opentdf/tests/.github/workflows/xtest.yml@main
  #   with:
  #     java-ref: ${{ github.ref }}

  # ci:
  #   needs:
  #     - platform-integration
  #     - platform-xtest
  #     - mavenverify
  #     - pr
  #   runs-on: ubuntu-latest
  #   if: always()
  #   steps:
  #     - if: contains(needs.*.result, 'failure')
  #       run: echo "Failed due to ${{ contains(needs.*.result, 'failure') }}" && exit 1