UPLOAD-1798/gha-playwright #528

thetif · 2024-10-09T16:58:44Z

created playwright docker-compose file
added playwright tests to tus-upload-server-ci.yml, testing all upload locations
changed some playwright configuration
removed the endpoint field from the upload form because it is unnecessary and possibly destructive
updated playwright tests to remove endpoint field and make them a little more fault tolerant

…LOAD-1798/gha-playwright

…laywright version to a specific value; updated tests to be more robust; added playwright tests to tus-upload-server-ci workflow; removed the endpoint field from the form because setting it is unnecessary and possibly destructive

…LOAD-1798/gha-playwright

fortify-pr-scan · 2024-10-09T17:07:23Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

fortify-pr-scan · 2024-10-09T17:13:12Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

fortify-pr-scan · 2024-10-09T17:18:08Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

fortify-pr-scan · 2024-10-09T17:26:17Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

fortify-pr-scan · 2024-10-09T17:30:10Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

fortify-pr-scan · 2024-10-09T17:43:08Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

fortify-pr-scan · 2024-10-09T17:57:16Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

fortify-pr-scan · 2024-10-09T18:15:40Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

…e docker compose to call install before running the tests

fortify-pr-scan · 2024-10-09T19:41:09Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

fortify-pr-scan · 2024-10-09T19:46:37Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

fortify-pr-scan · 2024-10-09T19:49:05Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

fortify-pr-scan · 2024-10-16T21:55:50Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

fortify-pr-scan · 2024-10-16T22:17:44Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

fortify-pr-scan · 2024-10-16T22:48:53Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

fortify-pr-scan · 2024-10-16T22:59:00Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

…LOAD-1798/gha-playwright

fortify-pr-scan · 2024-10-17T13:33:46Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

thetif · 2024-10-17T13:35:14Z

tests/smoke/playwright/test/upload-test-pages.spec.ts


        await expect((await uploadPatchResponsePromise).ok()).toBeTruthy()
        await expect((await uploadHeadResponsePromise).ok()).toBeTruthy()

        await page.reload();
+        // var refreshes = 0;


temporarily commented these tests out while we work out the new delivery situation, will probably need to make tests read from the delivery configs to know what the location should be

Would it be simpler to wait a certain amount of time (like 5 seconds) after an upload completes, and then check the status page as apposed to refreshing the page? It's more of a "did we deliver the file in time" kind of approach, and that's what the kotlin tests do.

Regarding the new delivery config, you should be able to use the DEX_DELIVERY_CONFIG_FILE env var and the yml files defined in upload-server/configs/testing

yeah we definitely need to switch to using the config file, but that was outside the scope of this ticket. I had made that fix before the delivery stuff changed and then commented it out when it did.

we need to make a separate ticket to update everything based on the new configs, should make things easier too

thetif · 2024-10-17T13:35:42Z

tests/smoke/playwright/test/upload-test-pages.spec.ts


        const fileHeaderContainer= page.locator('.file-header-container')
        await expect(fileHeaderContainer.getByRole('heading', { level: 1 }).nth(0)).toHaveText(expectedFileName)
        await expect(fileHeaderContainer.getByRole('heading', { level: 1 }).nth(1)).toHaveText("Upload Status: Complete")
-        await expect(fileHeaderContainer).toContainText(`ID: ${uploadId}`)
+        await expect(fileHeaderContainer).toContainText(`ID: ${uploadId.split('+')[0]}`)


added this to remove the tus id from the uploadId that happens on s3

Hoping we can avoid this. Ideally, these tests should have no awareness of the storage impl that the service under test is using. Let's have a convo on how we are manipulating the ID at the presentation layer.

Were we not able so resolve that filename tus string issue in S3? Or did Nicole run out of time before leaving? We should make a ticket to fix it if she just wasn't able to get to it in time

thetif · 2024-10-17T13:36:03Z

tests/smoke/playwright/test/upload-test-pages.spec.ts

-        await expect(fileDeliveryNcirdContainer.getByRole('heading', { level: 2 })).toHaveText('NCIRD')
-        await expect(fileDeliveryNcirdContainer.getByRole('heading', { level: 3 })).toHaveText('Delivery Status: SUCCESS')
-        await expect(fileDeliveryNcirdContainer).toContainText(`Location: uploads/ncird/${uploadId}`)
+        // const fileDeliveriesContainer = page.locator('.file-deliveries-container');


temporarily commented these tests out while we work out the new delivery situation, will probably need to make tests read from the delivery configs to know what the location should be

Can the expected destinations be part of the test case? (again, this is how the kotlin tests do it)

yes, that's what I was trying to do before the delivery stuff changed, and the delivery configs make it every easier to dynamically check for destinations

thetif · 2024-10-17T13:36:31Z

tests/smoke/playwright/test/upload-test.spec.ts

@@ -16,7 +16,7 @@ test.describe.skip('File Upload and Trace Response Flow', () => {
  const password = process.env.SAMS_PASSWORD;
  const url = process.env.UPLOAD_URL;
  const PS_API_URL = process.env.PS_API_URL;
-  const fileName = path.resolve(__dirname, '..', '..', 'upload-files', '10KB-test-file');
+  const fileName = path.resolve(__dirname, 'test-data', '10KB-test-file');


moved the test file into the same directory so it's all contained

thetif · 2024-10-17T13:39:45Z

upload-server/internal/appconfig/appconfig.go

-	UIPort    string `env:"UI_PORT, default=:8081"`
+	// User Interface Configs
+	UIPort    string `env:"UI_PORT, default=8081"`
+	UIUrl     string


Before the port for the UI had to include the leading : which wasn't super intuitive, so I created the UIUrl field so that the port could just be the port

If this is the only reason for splitting this config field, maybe we can change the underlying code to just include the :. Unless there's a need for the service to be aware of the hostname, which I don't see any need for.

the NewServer expects it to be in that format and I was just going to set it there, but it seemed more sticking with the convention to set it in the appconfig because that's where we are creating all the other configs and maybe we will want to give the UI a hostname eventually

thetif · 2024-10-17T13:41:07Z

upload-server/internal/appconfig/appconfig.go

@@ -213,6 +219,12 @@ func ParseConfig(ctx context.Context) (AppConfig, error) {
 	ac.ServerFileEndpointUrl = ac.ServerUrl + ac.TusdHandlerBasePath
 	ac.ServerInfoEndpointUrl = ac.ServerUrl + ac.TusdHandlerInfoPath

+	if ac.UIPort != "" {


creating the UIUrl if the port is set, otherwise UIUrl is set to empty string so that the UI won't start up if the UI_PORT is nil

thetif · 2024-10-17T13:43:24Z

upload-server/internal/ui/ui.go

@@ -240,18 +241,19 @@ func GetRouter(uploadUrl string, infoUrl string) *mux.Router {
 			return
 		}

-		uploadUrl, err := url.JoinPath(uploadUrl, id)
+		uploadDestinationUrl, err := url.JoinPath(uploadUrl, id)


Removed the Endpoint field from the upload form because it wasn't needed, now passing in the uploadUrl that we are using as the endpoint for tus

cfarmer-fearless · 2024-10-17T15:04:49Z

tests/smoke/playwright/test/upload-test-pages.spec.ts


        await expect((await uploadPatchResponsePromise).ok()).toBeTruthy()
        await expect((await uploadHeadResponsePromise).ok()).toBeTruthy()

        await page.reload();
+        // var refreshes = 0;


Would it be simpler to wait a certain amount of time (like 5 seconds) after an upload completes, and then check the status page as apposed to refreshing the page? It's more of a "did we deliver the file in time" kind of approach, and that's what the kotlin tests do.

cfarmer-fearless · 2024-10-17T15:10:35Z

tests/smoke/playwright/test/upload-test-pages.spec.ts


        const fileHeaderContainer= page.locator('.file-header-container')
        await expect(fileHeaderContainer.getByRole('heading', { level: 1 }).nth(0)).toHaveText(expectedFileName)
        await expect(fileHeaderContainer.getByRole('heading', { level: 1 }).nth(1)).toHaveText("Upload Status: Complete")
-        await expect(fileHeaderContainer).toContainText(`ID: ${uploadId}`)
+        await expect(fileHeaderContainer).toContainText(`ID: ${uploadId.split('+')[0]}`)


Hoping we can avoid this. Ideally, these tests should have no awareness of the storage impl that the service under test is using. Let's have a convo on how we are manipulating the ID at the presentation layer.

cfarmer-fearless · 2024-10-17T15:11:42Z

tests/smoke/playwright/test/upload-test-pages.spec.ts

-        await expect(fileDeliveryNcirdContainer.getByRole('heading', { level: 2 })).toHaveText('NCIRD')
-        await expect(fileDeliveryNcirdContainer.getByRole('heading', { level: 3 })).toHaveText('Delivery Status: SUCCESS')
-        await expect(fileDeliveryNcirdContainer).toContainText(`Location: uploads/ncird/${uploadId}`)
+        // const fileDeliveriesContainer = page.locator('.file-deliveries-container');


Can the expected destinations be part of the test case? (again, this is how the kotlin tests do it)

tests/smoke/playwright/wait-for-it.sh

cfarmer-fearless · 2024-10-17T15:13:43Z

upload-server/Dockerfile

@@ -29,7 +29,7 @@ RUN mkdir -p ./configs/local
 COPY --from=builder /app/configs/local/deliver.yml ./configs/local/deliver.yml

 # Create the 'app' user and group
-RUN addgroup -S app && adduser -S -G app app
+RUN addgroup -S -g 101 app && adduser -S -u 100 -G app app


What's the purpose of this change? Maybe belongs in another PR

when Candace made her change to the previous part, it didn't seem to want to work for me until I did that. I can back it out and make it's not necessary now

cfarmer-fearless · 2024-10-17T15:17:57Z

tests/smoke/playwright/test/upload-test-pages.spec.ts


        await expect((await uploadPatchResponsePromise).ok()).toBeTruthy()
        await expect((await uploadHeadResponsePromise).ok()).toBeTruthy()

        await page.reload();
+        // var refreshes = 0;


Regarding the new delivery config, you should be able to use the DEX_DELIVERY_CONFIG_FILE env var and the yml files defined in upload-server/configs/testing

cfarmer-fearless · 2024-10-17T15:26:37Z

upload-server/internal/appconfig/appconfig.go

-	UIPort    string `env:"UI_PORT, default=:8081"`
+	// User Interface Configs
+	UIPort    string `env:"UI_PORT, default=8081"`
+	UIUrl     string


If this is the only reason for splitting this config field, maybe we can change the underlying code to just include the :. Unless there's a need for the service to be aware of the hostname, which I don't see any need for.

tests/smoke/playwright/package.json

cyber-decker · 2024-10-17T16:25:16Z

tests/smoke/playwright/package.json

-    "test": "npx playwright test"
+    "wait": "./wait-for-it.sh ${UI_URL:-http://localhost:8081}",
+    "test": "npm run wait; npx playwright test",
+    "test:docker": "npm install; npm run test"


I think the wait step is good, and should be explicitly done here and not in the run test script.

Also... for this, can we include a --workers=2 (or 4 maybe?) to have tests run multithreaded? That might speed up the runs. Podman seems to handle it, can our GHA runners do that?

So scratch this maybe? I see below we have a workers config.

tests/smoke/playwright/playwright.config.ts

cyber-decker · 2024-10-17T16:32:14Z

tests/smoke/playwright/playwright.config.ts

 const config: PlaywrightTestConfig = {
  // Specify the directory where your tests are located
  testDir: "./test",

  // Use this to change the number of browsers/contexts to run in parallel
  // Setting this to 1 will run tests serially which can help if you're seeing issues with parallel execution
-  workers: 1,
+  // Opt out of parallel tests on CI.
+  workers: process.env.CI ? 1 : 4,


Do we have to opt out of parallel tests on CI? Should we? Parallel tests might let things run faster. Does 2 workers work? Have we tried 4 with the GHA runner?

Playwright recommends only use 1 https://playwright.dev/docs/ci

cyber-decker · 2024-10-17T16:39:04Z

tests/smoke/playwright/test/upload-test-accessibility.spec.ts

@@ -31,7 +31,7 @@ test.describe('Upload Manifest Page', () => {

 test.describe('File Upload Page', () => {
    test(`Checks accessibliity for the upload page for the dextesting/testevent1 manifest`, async ({ page }) => {
-        await page.goto(`/manifest?data_stream_id=dextesting&data_stream_route=testevent1`);
+        await page.goto(`/manifest?data_stream_id=dextesting&data_stream_route=testevent1`, { waitUntil: 'load' });


How necessary do we think this is here? For the accessibility tests, I can see where it might be useful because we're not doing some kind of element get that will retry until a timeout is hit.

But here, the next action we do is a getByLabel which will retry until its found or it will fail (which is kind of what we want, right?). This seems heavy to have to do on EVERY page.goto()

I think we could probably get rid of those, that was my first attempt before adding the wait-for-it

.github/workflows/e2e-test-template.yml

fortify-pr-scan · 2024-10-17T17:16:37Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

cyber-decker

Looks great!

…LOAD-1798/gha-playwright

fortify-pr-scan · 2024-10-21T13:46:20Z

Fortify Scan Results

🟢 Status: ✅ Passed

Summary

🚨 Critical Issues: 0
🛑 High Issues: 0
⚠️ Medium Issues: 0
🔍 Low Issues: 0

✅ No Action Required

No vulnerabilities were identified in this scan.

Detailed Results

📂 Scanned Path(s)

upload-server

📊 Detailed Scan Results


sourceanalyzer is installed.
FPRUtility is installed.
fortifyclient is installed.
Using Fortify Source Analyzer to scan the code from upload-server. Results will be upload-server.fpr.
Printing the results using Fortify FPRUtility, FPRUtility summarizes and translate results.
Summary of all issues:

Total for all categories => 0 Issues

****************************************************
Number of critical issues:
No issues matched search query.
****************************************************
Number of high issues:
No issues matched search query.
****************************************************
Number of medium issues:
No issues matched search query.
****************************************************
Number of low issues:
No issues matched search query.
****************************************************

Details of all issues in csv format:

thetif added 7 commits October 8, 2024 10:15

in progress commit

1b7d99c

temp

686adaf

Merge branch 'main' of github.com:CDCgov/data-exchange-upload into UP…

a0e0d97

…LOAD-1798/gha-playwright

updated to reporting back to PR

5faa6f9

Merge branch 'main' of github.com:CDCgov/data-exchange-upload into UP…

f1adcf8

…LOAD-1798/gha-playwright

removed reporting steps from playwright job because it wasn't allowed

994c3a8

commented out e2e job

ddfc976

fixed test I forgot to change with the new server url creation

6b5440b

updating the second image to have the same permissions as the first

27b5f0e

uncommenting part of e2e-test job

154e765

trying to run the jobs in sequence in case that's causing the issue

5841cc3

explicitly stopping containers on simulation tests

9dc2f34

testing

b22c254

copied the test upload file into the playwright directory; updated th…

2206025

…e docker compose to call install before running the tests

thetif added 2 commits October 9, 2024 15:43

putting e2e before sim

79d5c17

removed other docker-compose from the run command

a6afc54

thetif added 2 commits October 9, 2024 17:10

updating the playwright command

eb47f5c

fixed run in workflow

152c291

rename title

ce7fee0

removed outputting to a github report file

4c0c2e4

shortened test titles

d2a97fa

Merge branch 'main' of github.com:CDCgov/data-exchange-upload into UP…

1c23aed

…LOAD-1798/gha-playwright

thetif commented Oct 17, 2024

View reviewed changes

thetif requested review from cfarmer-fearless and whytheplatypus October 17, 2024 13:43

thetif marked this pull request as ready for review October 17, 2024 13:43

thetif requested review from cyber-decker and candace-campbell October 17, 2024 13:46

cfarmer-fearless requested changes Oct 17, 2024

View reviewed changes

cyber-decker requested changes Oct 17, 2024

View reviewed changes

addressing comments in PR

ce3ef5a

thetif requested a review from cfarmer-fearless October 17, 2024 20:30

cyber-decker approved these changes Oct 17, 2024

View reviewed changes

thetif added 2 commits October 21, 2024 09:38

Merge branch 'main' of github.com:CDCgov/data-exchange-upload into UP…

f0c52ca

…LOAD-1798/gha-playwright

removed UIUrl from appconfig

b1609dd

UPLOAD-1798/gha-playwright #528

Are you sure you want to change the base?

UPLOAD-1798/gha-playwright #528

Conversation

thetif commented Oct 9, 2024

fortify-pr-scan bot commented Oct 9, 2024

Fortify Scan Results

Summary

✅ No Action Required

📂 Scanned Path(s)

📊 Detailed Scan Results

fortify-pr-scan bot commented Oct 9, 2024

Fortify Scan Results

Summary

✅ No Action Required

📂 Scanned Path(s)

📊 Detailed Scan Results

fortify-pr-scan bot commented Oct 9, 2024

Fortify Scan Results

Summary

✅ No Action Required

📂 Scanned Path(s)

📊 Detailed Scan Results

fortify-pr-scan bot commented Oct 9, 2024

Fortify Scan Results

Summary

✅ No Action Required

📂 Scanned Path(s)

📊 Detailed Scan Results

fortify-pr-scan bot commented Oct 9, 2024

Fortify Scan Results

Summary

✅ No Action Required

📂 Scanned Path(s)

📊 Detailed Scan Results

fortify-pr-scan bot commented Oct 9, 2024

Fortify Scan Results

Summary

✅ No Action Required

📂 Scanned Path(s)

📊 Detailed Scan Results

fortify-pr-scan bot commented Oct 9, 2024

Fortify Scan Results

Summary

✅ No Action Required

📂 Scanned Path(s)

📊 Detailed Scan Results

fortify-pr-scan bot commented Oct 9, 2024

Fortify Scan Results

Summary

✅ No Action Required

📂 Scanned Path(s)

📊 Detailed Scan Results

fortify-pr-scan bot commented Oct 9, 2024

Fortify Scan Results

Summary

✅ No Action Required

📂 Scanned Path(s)

📊 Detailed Scan Results

fortify-pr-scan bot commented Oct 9, 2024

Fortify Scan Results

Summary

✅ No Action Required

📂 Scanned Path(s)

📊 Detailed Scan Results

fortify-pr-scan bot commented Oct 9, 2024

Fortify Scan Results

Summary

✅ No Action Required

📂 Scanned Path(s)

📊 Detailed Scan Results

fortify-pr-scan bot commented Oct 16, 2024

Fortify Scan Results

Summary

✅ No Action Required

📂 Scanned Path(s)

📊 Detailed Scan Results

fortify-pr-scan bot commented Oct 16, 2024

Fortify Scan Results

Summary