integration-testing.yml

name: Secure Integration test

on:
  push:
    branches: [ main ]
    tags:
      - 'v*'
  pull_request_target:
    branches: [ main ]
    types: [opened, synchronize, reopened]

# Global permissions - most restrictive by default
permissions:
  contents: read

jobs:
  authorization-check:
    permissions: read-all
    runs-on: ubuntu-latest
    # Skip entirely for Dependabot PRs — they are not collaborators so they
    # would always route to manual-approval, blocking auto-merge indefinitely.
    # Dependabot PRs are validated by ci.yml (lint, test, build) which are
    # the required status checks in the main-status-checks Ruleset.
    if: github.actor != 'dependabot[bot]'
    outputs:
      approval-env: ${{ steps.collab-check.outputs.result }}
      should-run: ${{ steps.safety-check.outputs.result }}
    steps:
      - name: Checkout base branch for safety check
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.base.sha }}

      - name: Safety Check - Prevent Workflow Modification Attacks
        id: safety-check
        uses: actions/github-script@v8
        with:
          result-encoding: string
          script: |
            if (!context.payload.pull_request) {
              console.log('Not a pull request, proceeding');
              return 'true';
            }

            const { data: files } = await github.rest.pulls.listFiles({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.payload.pull_request.number,
            });

            const dangerousPatterns = [
              /^\.github\/workflows\//,
              /^\.github\/actions\//,
              /conftest\.py$/,
              /pytest\.ini$/,
            ];

            const dangerousFiles = files.filter(file =>
              dangerousPatterns.some(pattern => pattern.test(file.filename))
            );

            if (dangerousFiles.length > 0) {
              console.log('⚠️ SECURITY: PR modifies sensitive files:');
              dangerousFiles.forEach(f => console.log(`  - ${f.filename}`));
              console.log('Manual review required before running integration tests');
              return 'false';
            }

            console.log('✓ Safety check passed - no sensitive files modified');
            return 'true';

      - name: Check authorization
        id: authz
        uses: aws/agentcore-devx-devtools/.github/actions/check-collaborator@31aa3b031a86664e29861d68956e44b07cf21a74
        with:
          subject: ${{ github.event.pull_request.user.login || github.actor }}
          required-permission: write

      - name: Map authorization to approval environment
        uses: actions/github-script@v8
        id: collab-check
        env:
          IS_AUTHORIZED: ${{ steps.authz.outputs.is-authorized }}
        with:
          result-encoding: string
          script: |
            if (process.env.IS_AUTHORIZED === 'true') {
              console.log('User has write access. Auto Approving PR Checks.');
              return "auto-approve"
            } else {
              console.log('User does not have write access. Requiring Manual Approval to run PR Checks.');
              return "manual-approval"
            }

  check-access-and-checkout:
    name: Test (${{ matrix.group }})
    runs-on: ubuntu-latest
    needs: authorization-check
    if: needs.authorization-check.outputs.should-run == 'true'
    environment: ${{ needs.authorization-check.outputs.approval-env }}
    permissions:
      id-token: write        # Required for AWS OIDC
      pull-requests: read    # Required to read PR info
      contents: read         # Required to checkout code
    strategy:
      fail-fast: false
      matrix:
        include:
          - group: runtime
            path: tests_integ/runtime
            timeout: 10
            extra-deps: ""
            ignore: ""
          # TODO: expand to full tests_integ/memory once test stability is addressed
          - group: memory
            path: tests_integ/memory/test_controlplane.py tests_integ/memory/test_memory_client.py tests_integ/memory/integrations/test_session_manager.py
            timeout: 15
            extra-deps: ""
            ignore: ""
          - group: evaluation
            path: tests_integ/evaluation
            timeout: 15
            extra-deps: "strands-agents-evals deepeval autoevals ragas langchain-community<0.4.2"
            ignore: ""
          - group: services
            path: tests_integ/services
            timeout: 5
            extra-deps: ""
            ignore: ""
          - group: policy
            path: tests_integ/policy
            timeout: 15
            extra-deps: ""
            ignore: ""
          - group: gateway
            path: tests_integ/gateway
            timeout: 15
            extra-deps: "mcp-proxy-for-aws"
            ignore: ""
          - group: identity
            path: tests_integ/identity/test_identity_client.py
            timeout: 15
            extra-deps: ""
            ignore: ""
          - group: payments
            path: tests_integ/payments
            timeout: 15
            extra-deps: "strands-agents strands-agents-tools"
            ignore: ""
          # TODO: expand to full tools tests once test resources are setup
          - group: tools
            path: tests_integ/tools
            timeout: 15
            extra-deps: ""
            ignore: "--ignore=tests_integ/tools/test_browser_proxy.py"
    steps:
      - name: Fetch secrets from Secrets Manager
        uses: aws/agentcore-devx-devtools/.github/actions/fetch-secrets@31aa3b031a86664e29861d68956e44b07cf21a74
        with:
          role-arn: ${{ secrets.WORKFLOW_SECRETS_READER_ROLE_ARN }}
          shared: AGENTCORE_INTEG_TEST_ROLE
          repo: MEMORY_KINESIS_ARN MEMORY_ROLE_ARN MEMORY_PREPOPULATED_ID RESOURCE_POLICY_TEST_ARN RESOURCE_POLICY_TEST_PRINCIPAL GATEWAY_ROLE_ARN GATEWAY_LAMBDA_ARN KB_ROLE_ARN EVAL_ROLE_ARN EVAL_LOG_GROUP RUNTIME_ROLE_ARN RUNTIME_S3_CODE_URI COGNITO_POOL_ID COGNITO_CLIENT_ID COGNITO_CLIENT_SECRET OPENAI_API_KEY

      - name: Configure Credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
         role-to-assume: ${{ env.AGENTCORE_INTEG_TEST_ROLE }}
         aws-region: us-west-2
         mask-aws-account-id: true
         unset-current-credentials: true

      - name: Checkout PR head commit
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.10'

      - name: Install dependencies
        env:
          EXTRA_DEPS: ${{ matrix.extra-deps }}
        run: |
          pip install -e .
          pip install --no-cache-dir pytest pytest-xdist pytest-order pytest-rerunfailures requests strands-agents uvicorn httpx starlette websockets $EXTRA_DEPS

      - name: Run integration tests
        env:
          AWS_REGION: us-west-2
          PYTHONUNBUFFERED: 1
          MEMORY_KINESIS_ARN: ${{ env.MEMORY_KINESIS_ARN }}
          MEMORY_ROLE_ARN: ${{ env.MEMORY_ROLE_ARN }}
          MEMORY_PREPOPULATED_ID: ${{ env.MEMORY_PREPOPULATED_ID }}
          RESOURCE_POLICY_TEST_ARN: ${{ env.RESOURCE_POLICY_TEST_ARN }}
          RESOURCE_POLICY_TEST_PRINCIPAL: ${{ env.RESOURCE_POLICY_TEST_PRINCIPAL }}
          GATEWAY_ROLE_ARN: ${{ env.GATEWAY_ROLE_ARN }}
          GATEWAY_LAMBDA_ARN: ${{ env.GATEWAY_LAMBDA_ARN }}
          KB_ROLE_ARN: ${{ env.KB_ROLE_ARN }}
          EVAL_ROLE_ARN: ${{ env.EVAL_ROLE_ARN }}
          EVAL_LOG_GROUP: ${{ env.EVAL_LOG_GROUP }}
          RUNTIME_ROLE_ARN: ${{ env.RUNTIME_ROLE_ARN }}
          RUNTIME_S3_CODE_URI: ${{ env.RUNTIME_S3_CODE_URI }}
          COGNITO_POOL_ID: ${{ env.COGNITO_POOL_ID }}
          COGNITO_CLIENT_ID: ${{ env.COGNITO_CLIENT_ID }}
          COGNITO_CLIENT_SECRET: ${{ env.COGNITO_CLIENT_SECRET }}
          OPENAI_API_KEY: ${{ env.OPENAI_API_KEY }}
          PYTEST_PATH: ${{ matrix.path }}
          PYTEST_IGNORE: ${{ matrix.ignore }}
        id: tests
        timeout-minutes: ${{ matrix.timeout }}
        # PYTEST_PATH/PYTEST_IGNORE come from the job matrix and hold space-separated
        # pytest path/ignore args; left unquoted intentionally so they word-split.
        run: |
          pytest $PYTEST_PATH $PYTEST_IGNORE -n auto --dist=loadscope -s --log-cli-level=INFO

  safety-gate:
    runs-on: ubuntu-latest
    needs: authorization-check
    if: needs.authorization-check.outputs.should-run == 'false'
    permissions: {}
    steps:
      - name: Security Block
        run: |
          echo "🚨 SECURITY BLOCK: This PR modifies sensitive files"
          echo ""
          echo "The following types of files trigger manual review:"
          echo "  - Workflow files (.github/workflows/)"
          echo "  - Action files (.github/actions/)"
          echo "  - Test setup files (conftest.py, pytest.ini)"
          echo ""
          echo "⚠️  Integration tests will NOT run automatically"
          echo "👀 A maintainer must review the changes and manually trigger tests"
          echo ""
          echo "This is a security measure to prevent:"
          echo "  - Workflow modification attacks"
          echo "  - Secret exfiltration"
          echo "  - Test manipulation"
          exit 1