# Run all the runtiem things against our CI installations

name: Runtime Integration Tests

on:

workflow_call:

workflow_dispatch:

inputs:

run_id:

description: "ID of the workflow run that uploaded the artifact"

required: true

# Reaching the CI instances needs an OIDC token. A caller must grant the same

# permission, which ci.yml does on the job that invokes this workflow.

permissions:

contents: read

id-token: write

jobs:

runtime-tests:

if: ${{ !contains(vars.CI_SKIP_JOBS, 'runtime-tests') }}

name: Runtime Integration Tests

strategy:

matrix:

include:

- runner: [gke-runners-amd64]

feldera_host: ${{ vars.FELDERA_HOST_CI_GKE_AMD64 }}

- runner: [gke-runners-arm64]

feldera_host: ${{ vars.FELDERA_HOST_CI_GKE_ARM64 }}

runs-on: ${{ matrix.runner }}

env:

FELDERA_RUNTIME_VERSION: ${{ github.sha }}

# GCS test bucket over the S3-interop endpoint; the env names are the

# standard ones the tests read (python/tests/utils.py).

CI_K8S_MINIO_ACCESS_KEY_ID: ${{ secrets.CI_GCS_HMAC_ACCESS_KEY_ID }}

CI_K8S_MINIO_SECRET_ACCESS_KEY: ${{ secrets.CI_GCS_HMAC_SECRET_ACCESS_KEY }}

CI_MINIO_ENDPOINT: https://storage.googleapis.com

CI_MINIO_BUCKET: feldera-ci-test-feldera-ci

# rclone quirks for GCS S3-interop; MinIO provider signing gets 403.

CI_MINIO_PROVIDER: GCS

# GCS S3-interop lacks x-amz checksums; newer AWS SDKs (pyarrow's C++

# SDK) fail GetObject with "Response checksums mismatch" otherwise.

AWS_REQUEST_CHECKSUM_CALCULATION: WHEN_REQUIRED

AWS_RESPONSE_CHECKSUM_VALIDATION: WHEN_REQUIRED

container:

image: us-central1-docker.pkg.dev/feldera-ci/ghcr-remote/feldera/feldera-dev:sha-a5ab793b8d261068867b9fdfad3f04157b2536fc

steps:

- name: Checkout repository

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

# The instances identify this workflow by the audience it requests, so

# the value has to match the one their trust pins.

- name: Authenticate to Feldera

uses: feldera/oidc-auth-action@d1fce411d12fcda95a1f1a0bc441d2dc191e3f2c # v1.0.0

with:

host: ${{ matrix.feldera_host }}

audience: feldera-ci-runtime-tests

- name: Python runtime tests

if: ${{ vars.CI_DRY_RUN != 'true' && !contains(vars.CI_SKIP_JOBS, 'runtime-pytest') }}

run: uv run --locked pytest -n ${{ vars.PYTEST_WORKERS }} tests/runtime --timeout=3600 --maxfail=1 -vv ${{ vars.PYTEST_EXTRA }}

working-directory: python

env:

PYTHONPATH: ${{ github.workspace }}/python

- name: Python runtime_aggtest test

if: ${{ vars.CI_DRY_RUN != 'true' && !contains(vars.CI_SKIP_JOBS, 'runtime-aggtest') }}

run: uv run --locked ./tests/runtime_aggtest/run.sh

working-directory: python

env:

RUNTIME_AGGTEST_JOBS: ${{ vars.RUNTIME_AGGTEST_JOBS }}

PYTHONPATH: ${{ github.workspace }}/python

- name: Python workload tests

if: ${{ vars.CI_DRY_RUN != 'true' && !contains(vars.CI_SKIP_JOBS, 'runtime-workload') }}

run: uv run --locked pytest -n ${{ vars.PYTEST_WORKERS }} tests/workloads --timeout=3600 --maxfail=1 -vv ${{ vars.PYTEST_EXTRA }}

working-directory: python

env:

PYTHONPATH: ${{ github.workspace }}/python

KAFKA_BOOTSTRAP_SERVERS: ${{ vars.CI_KAFKA_BOOTSTRAP }}

SCHEMA_REGISTRY_URL: ${{ vars.CI_SCHEMA_REGISTRY }}

RUN_ID: 1 # we use this to run a single variant of the Kafka tests in test_kafka_avro.py

# Test teardown only runs while pytest is alive. A cancel sentinel firing

# for some other job, a runner eviction or a job timeout leaves tests

# running on the shared instance to burn compute.

# This step reclaims the pipelines this run named after itself

- name: Stop pipelines this run leaked

if: ${{ always() && vars.CI_DRY_RUN != 'true' }}

timeout-minutes: 10

run: uv run --locked python -m tests.stop_ci_run_pipelines

working-directory: python

env:

PYTHONPATH: ${{ github.workspace }}/python