Files
vercel__next.js/.github/workflows/integration_tests_reusable.yml
Sebastian "Sebbie" Silbermann 988a6ab727 [ci] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97590)
CI authenticated to Vercel Remote Cache with a long-lived Personal
Access Token in the `TURBO_TOKEN` repository secret. That token never
expired, is scoped to a team member rather than the team, and is
readable by every job that inherits secrets.

Each job now mints its own short-lived, cache-only token instead, using
`vercel/setup-turborepo-remote-cache-action` against a Turborepo CLI
OIDC policy configured on the Vercel team following
https://vercel.com/docs/monorepos/remote-caching/external-ci-cd#openid-connect-oidc

Forks skip the step entirely since they won't have access to repository
variables. During outages or any other permission errors, the steps
outcome will simply be ignore and we fall back to uncached behavior.

This could lead to silent regressions or hiding new, incorrect callsites
lacking necessary permissions. A Datadog monitor is not as simple as I'd
like since DD does not track outcome but conclusion (which is always
success for continue-on-error). Adding custom tags via DD CLI feels to
heavy. We'll revisit if this becomes a recurring issue.
2026-08-20 10:16:10 +02:00

192 lines
6.0 KiB
YAML

name: Integration Tests Reusable
on:
workflow_call:
inputs:
name:
description: A unique identifer used for uploaded assets
type: string
test_type:
description: '"development" or "production"'
required: true
type: string
run_before_test:
description: >
Bash code to run before executing the test (e.g. setting environment
variables). Runs in the same step as the test.
type: string
default: ''
e2e_groups:
description: >
Size of the matrix used for running e2e tests (controls parallelism)
type: number
default: 6
integration_groups:
description: >
Size of the matrix used for running legacy integration tests (controls
parallelism)
type: number
default: 6
e2e_timeout_minutes:
type: number
default: 30
integration_timeout_minutes:
type: number
default: 30
num_retries:
type: number
default: 2
nodeVersion:
description: 'version of Node.js to use'
type: string
default: 20.9.0
jobs:
# First, build Next.js to execute across tests.
build-next:
name: build-next
permissions:
contents: read
id-token: write
uses: ./.github/workflows/build_reusable.yml
with:
nodeVersion: ${{ inputs.nodeVersion }}
skipNativeBuild: yes
stepName: build-next
secrets: inherit
build-native:
name: build-native
permissions:
contents: read
id-token: write
uses: ./.github/workflows/build_reusable.yml
with:
nodeVersion: ${{ inputs.nodeVersion }}
skipInstallBuild: yes
stepName: build-native
secrets: inherit
generate-matrices:
runs-on: ubuntu-latest-4-core-oss
steps:
- id: out
run: |
printf 'e2e=[%s]\n' \
"$(seq -s, 1 ${{ inputs.e2e_groups }})" | \
tee -a "$GITHUB_OUTPUT"
printf 'integration=[%s]\n' \
"$(seq -s, 1 ${{ inputs.integration_groups }})" | \
tee -a "$GITHUB_OUTPUT"
outputs:
e2e: ${{ steps.out.outputs.e2e }}
integration: ${{ steps.out.outputs.integration }}
# Actual test scheduling. These jobs mimic the normal test jobs.
# Refer build_and_test.yml for more details.
#
# We run tests in two parts. Legacy integration tests are run separately:
# https://github.com/vercel/next.js/blob/canary/contributing/core/testing.md#test-types-in-nextjs
test-e2e:
# Name must match `integrationTestJobs` in
# `./.github/actions/next-integration-stat`
name: >-
Next.js integration test (E2E and ${{ inputs.test_type }})
(${{ matrix.group }}/${{ inputs.e2e_groups }})
needs: [build-next, build-native, generate-matrices]
strategy:
fail-fast: false
matrix:
group: ${{ fromJSON(needs.generate-matrices.outputs.e2e) }}
permissions:
contents: read
id-token: write
uses: ./.github/workflows/build_reusable.yml
with:
nodeVersion: ${{ inputs.nodeVersion }}
afterBuild: |
# e2e and ${{ inputs.test_type }} tests with `node run-tests.js`
export NEXT_TEST_MODE=${{
inputs.test_type == 'development' && 'dev' || 'start'
}}
export NEXT_TEST_EMIT_ALL_OUTPUT=1
${{ inputs.run_before_test }}
node run-tests.js \
--group ${{ matrix.group }}/${{ inputs.e2e_groups }} \
--retries ${{ inputs.num_retries }} \
--type ${{ inputs.test_type }}
stepName: test-${{ inputs.name }}-${{ matrix.group }}
timeout_minutes: ${{ inputs.e2e_timeout_minutes }}
secrets: inherit
test-integration:
# Name must match `integrationTestJobs` in
# `./.github/actions/next-integration-stat`
name: >-
Next.js integration test (Integration)
(${{ matrix.group }}/${{ inputs.e2e_groups }})
needs: [build-next, build-native, generate-matrices]
strategy:
fail-fast: false
matrix:
group: ${{ fromJSON(needs.generate-matrices.outputs.integration) }}
permissions:
contents: read
id-token: write
uses: ./.github/workflows/build_reusable.yml
with:
nodeVersion: ${{ inputs.nodeVersion }}
afterBuild: |
# legacy integration tests with `node run-tests.js`
# HACK: Despite the name, these environment variables are just used to
# gate tests, so they're applicable to both turbopack and rspack tests
export ${{
inputs.test_type == 'development' &&
'TURBOPACK_DEV=1' ||
'TURBOPACK_BUILD=1'
}}
export NEXT_TEST_EMIT_ALL_OUTPUT=1
${{ inputs.run_before_test }}
node run-tests.js \
--group ${{ matrix.group }}/${{ inputs.integration_groups }} \
--retries ${{ inputs.num_retries }} \
--type integration
stepName: test-${{ inputs.name }}-integration-${{ matrix.group }}
timeout_minutes: ${{ inputs.integration_timeout_minutes }}
secrets: inherit
# Collect integration test results from execute_tests,
# Store it as github artifact for next step to consume.
collect_nextjs_development_integration_stat:
needs: [test-e2e, test-integration]
name: Next.js integration test development status report
runs-on: ubuntu-latest-4-core-oss
if: always()
permissions:
pull-requests: write
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Collect integration test stat
uses: ./.github/actions/next-integration-stat
with:
token: ${{ secrets.GITHUB_TOKEN }}
- name: Store artifacts
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: test-results-${{ inputs.name }}
path: |
nextjs-test-results.json
failed-test-path-list.json
passed-test-path-list.json