chore(release): v9.2.2 — check_policy redacts PII on its allow path (… #752
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test Suite (Community) | |
| # Community test workflow - tests community edition code. | |
| # | |
| # Runs ONLY in the public `axonflow` (community-mirror) repo. In the | |
| # `axonflow-enterprise` repo this workflow is a no-op — every job is gated on | |
| # `github.repository == 'getaxonflow/axonflow'`. The same platform/ tests are | |
| # already covered there by `test.yml` (community-mode is the default, no | |
| # build-tag flag means the `enterprise`-tagged files are excluded), so running | |
| # this here was duplicate work (~2,591 billable min/14d). The workflow file | |
| # itself still syncs to the community repo via `sync-community-repo.yml`. | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - 'platform/**/*.go' | |
| - 'go.mod' | |
| - 'go.sum' | |
| - '.github/workflows/test-community.yml' | |
| merge_group: | |
| branches: | |
| - main | |
| # Cancel orphaned PR runs when a new commit is pushed. Pushes to main / merge_group | |
| # runs use the SHA so they never share a group and never cancel each other. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| env: | |
| AXONFLOW_TELEMETRY: 'off' | |
| jobs: | |
| # ============================================================================= | |
| # Change Detection (pull_request and merge_group only) | |
| # ============================================================================= | |
| detect-changes: | |
| name: Detect Changes | |
| runs-on: ubuntu-latest | |
| if: | | |
| github.repository == 'getaxonflow/axonflow' && | |
| (github.event_name == 'pull_request' || github.event_name == 'merge_group') | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| go-code: ${{ steps.filter.outputs.go-code }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Detect Go code changes | |
| uses: dorny/paths-filter@v4 | |
| id: filter | |
| with: | |
| filters: | | |
| go-code: | |
| - 'platform/**/*.go' | |
| - '**/go.mod' | |
| - '**/go.sum' | |
| - '.github/workflows/test-community.yml' | |
| unit-tests: | |
| name: Unit Tests (All Modules) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| needs: [detect-changes] | |
| if: | | |
| github.repository == 'getaxonflow/axonflow' && | |
| always() && | |
| (github.event_name == 'push' || | |
| (needs.detect-changes.result == 'success' && needs.detect-changes.outputs.go-code == 'true')) | |
| services: | |
| postgres: | |
| image: postgres:15-alpine | |
| env: | |
| POSTGRES_USER: test_user | |
| POSTGRES_PASSWORD: test_password | |
| POSTGRES_DB: test_db | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| ports: | |
| - 5432:5432 | |
| redis: | |
| image: redis:7-alpine | |
| options: >- | |
| --health-cmd "redis-cli ping" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| ports: | |
| - 6379:6379 | |
| mysql: | |
| image: mysql:8.0 | |
| env: | |
| MYSQL_ROOT_PASSWORD: testpassword | |
| MYSQL_DATABASE: testdb | |
| options: >- | |
| --health-cmd "mysqladmin ping -h localhost" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| ports: | |
| - 3306:3306 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| cache-dependency-path: platform/go.sum | |
| - name: Install dependencies | |
| run: | | |
| cd platform | |
| go mod download | |
| go mod verify | |
| - name: Set up test database | |
| env: | |
| PGPASSWORD: test_password | |
| run: | | |
| echo "=== Applying core migrations ===" | |
| for migration in migrations/core/*.sql; do | |
| if [ -f "$migration" ] && [[ ! "$migration" =~ _down\.sql$ ]]; then | |
| echo "Applying $migration..." | |
| psql -h localhost -U test_user -d test_db -f "$migration" || echo "Migration $migration failed or already applied, continuing..." | |
| fi | |
| done | |
| - name: Test Orchestrator | |
| env: | |
| DATABASE_URL: postgresql://test_user:test_password@localhost:5432/test_db?sslmode=disable | |
| run: | | |
| cd platform/orchestrator | |
| go test -v -cover -coverprofile=coverage.out -timeout 10m | |
| - name: Check Orchestrator Coverage | |
| run: | | |
| cd platform/orchestrator | |
| coverage=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//') | |
| echo "Orchestrator Coverage: $coverage%" | |
| # Raised to 76.0% — consistent with Agent threshold (PR #1163 brought coverage to 76.8%) | |
| threshold=76.0 | |
| if (( $(echo "$coverage < $threshold" | bc -l) )); then | |
| echo "❌ Orchestrator coverage $coverage% is below threshold $threshold%" | |
| exit 1 | |
| fi | |
| echo "✅ Orchestrator coverage $coverage% meets threshold $threshold%" | |
| - name: Test Agent | |
| env: | |
| DATABASE_URL: postgresql://test_user:test_password@localhost:5432/test_db?sslmode=disable | |
| run: | | |
| cd platform/agent | |
| go test -v -cover -coverprofile=coverage.out -timeout 5m | |
| - name: Check Agent Coverage | |
| run: | | |
| cd platform/agent | |
| coverage=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//') | |
| echo "Agent Coverage: $coverage%" | |
| # Raised 75.9 → 76.3 in #2384 PR-D follow-up: the prior | |
| # PR-D commit lowered the floor from 76.0 to 75.9 to track | |
| # the post-#2402 reality; this commit ADDS the missing tests | |
| # instead (community-build coverage for auth_daily_limit / | |
| # auth_plugin_license_lookup / db_connection role-asserting | |
| # open helpers / community shims) and pushes the floor back | |
| # UP to 76.3 with a small buffer above the previous 76.0 | |
| # baseline. Local measurement showed 76.6% on the new test | |
| # suite. | |
| threshold=76.3 | |
| if (( $(echo "$coverage < $threshold" | bc -l) )); then | |
| echo "Agent coverage $coverage% is below threshold $threshold%" | |
| exit 1 | |
| fi | |
| echo "Agent coverage $coverage% meets threshold $threshold%" | |
| - name: Test Connectors | |
| env: | |
| DATABASE_URL: postgresql://test_user:test_password@localhost:5432/test_db?sslmode=disable | |
| TEST_DATABASE_URL: postgresql://test_user:test_password@localhost:5432/test_db?sslmode=disable | |
| REDIS_URL: redis://localhost:6379 | |
| MYSQL_TEST_DSN: root:testpassword@tcp(localhost:3306)/testdb?parseTime=true | |
| run: | | |
| cd platform/connectors | |
| go test -v -cover -coverprofile=coverage.out ./... -timeout 10m | |
| - name: Check Connector Coverage | |
| run: | | |
| cd platform/connectors | |
| coverage=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//') | |
| echo "Connector Coverage: $coverage%" | |
| # Raised to 76.0% — consistent with Agent/Orchestrator (PR #1163 brought coverage to 77.1%) | |
| threshold=76.0 | |
| if (( $(echo "$coverage < $threshold" | bc -l) )); then | |
| echo "Connector coverage $coverage% is below threshold $threshold%" | |
| exit 1 | |
| fi | |
| echo "Connector coverage $coverage% meets threshold $threshold%" | |
| - name: Test Shared | |
| run: | | |
| cd platform/shared/logger | |
| go test -v -cover -timeout 5m | |
| - name: Generate coverage reports | |
| if: success() | |
| run: | | |
| cd platform/orchestrator && go tool cover -html=coverage.out -o coverage.html | |
| cd ../agent && go tool cover -html=coverage.out -o coverage.html | |
| cd ../connectors && go tool cover -html=coverage.out -o coverage.html | |
| - name: Upload coverage reports | |
| if: success() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: coverage-reports | |
| path: | | |
| platform/orchestrator/coverage.html | |
| platform/agent/coverage.html | |
| platform/connectors/coverage.html | |
| retention-days: 30 | |
| race-detector: | |
| name: Race Condition Detection | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| needs: [detect-changes] | |
| if: | | |
| github.repository == 'getaxonflow/axonflow' && | |
| always() && | |
| (github.event_name == 'push' || | |
| (needs.detect-changes.result == 'success' && needs.detect-changes.outputs.go-code == 'true')) | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| cache-dependency-path: platform/go.sum | |
| - name: Install dependencies | |
| run: | | |
| cd platform | |
| go mod download | |
| go mod verify | |
| - name: Run tests with race detector | |
| run: | | |
| cd platform/orchestrator | |
| go test -race -timeout 10m | |
| integration-tests: | |
| name: Integration Tests | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| needs: [detect-changes, unit-tests, race-detector] | |
| if: | | |
| github.repository == 'getaxonflow/axonflow' && | |
| always() && | |
| needs.unit-tests.result != 'failure' && | |
| needs.race-detector.result != 'failure' && | |
| (github.event_name == 'push' || | |
| (needs.detect-changes.result == 'success' && needs.detect-changes.outputs.go-code == 'true')) | |
| services: | |
| postgres: | |
| image: postgres:15-alpine | |
| env: | |
| POSTGRES_USER: test_user | |
| POSTGRES_PASSWORD: test_password | |
| POSTGRES_DB: test_db | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| ports: | |
| - 5432:5432 | |
| redis: | |
| image: redis:7-alpine | |
| options: >- | |
| --health-cmd "redis-cli ping" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| ports: | |
| - 6379:6379 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| cache-dependency-path: platform/go.sum | |
| - name: Install dependencies | |
| run: | | |
| cd platform | |
| go mod download | |
| go mod verify | |
| - name: Set up test database | |
| env: | |
| PGPASSWORD: test_password | |
| run: | | |
| echo "=== Applying core migrations ===" | |
| for migration in migrations/core/*.sql; do | |
| if [ -f "$migration" ] && [[ ! "$migration" =~ _down\.sql$ ]]; then | |
| echo "Applying $migration..." | |
| psql -h localhost -U test_user -d test_db -f "$migration" || echo "Migration $migration failed or already applied, continuing..." | |
| fi | |
| done | |
| - name: Run integration tests | |
| env: | |
| DATABASE_URL: postgresql://test_user:test_password@localhost:5432/test_db?sslmode=disable | |
| TEST_DATABASE_URL: postgresql://test_user:test_password@localhost:5432/test_db?sslmode=disable | |
| REDIS_URL: redis://localhost:6379 | |
| run: | | |
| cd platform/orchestrator | |
| go test -v -run "TestIntegration|TestEndToEnd" -timeout 10m | |
| test-summary: | |
| name: Test Summary | |
| runs-on: ubuntu-latest | |
| needs: [detect-changes, unit-tests, race-detector, integration-tests] | |
| if: always() | |
| steps: | |
| - name: Check test results | |
| run: | | |
| echo "Test Suite Complete" | |
| echo "" | |
| echo "Results:" | |
| echo " Detect Changes: ${{ needs.detect-changes.result }}" | |
| echo " Unit Tests: ${{ needs.unit-tests.result }}" | |
| echo " Race Detector: ${{ needs.race-detector.result }}" | |
| echo " Integration Tests: ${{ needs.integration-tests.result }}" | |
| - name: Fail if any test failed | |
| if: | | |
| needs.detect-changes.result == 'failure' || | |
| (needs.unit-tests.result != 'success' && needs.unit-tests.result != 'skipped') || | |
| (needs.race-detector.result != 'success' && needs.race-detector.result != 'skipped') || | |
| (needs.integration-tests.result != 'success' && needs.integration-tests.result != 'skipped') | |
| run: | | |
| echo "One or more test jobs failed" | |
| exit 1 | |
| - name: Success message | |
| if: success() | |
| run: | | |
| echo "" | |
| echo "All tests passed!" | |
| echo "" | |
| echo "Coverage thresholds verified:" | |
| echo " - Orchestrator: 76%" | |
| echo " - Agent: 76%" | |
| echo " - Connectors: 76%" |