Merge remote-tracking branch 'origin/master' into launch.next

Author: taeold

.github/workflows/postmerge.yaml

@@ -0,0 +1,55 @@
+# Copyright 2022 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+name: Post-merge tests
+
+on:
+  workflow_dispatch:
+  workflow_run:
+    workflows: ['CI Tests']
+    types: [completed]
+    branches: [master]
+
+concurrency:
+  group: postmerge-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CI: true
+
+jobs:
+  postmerge:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16
+
+      - uses: google-github-actions/auth@v0
+        with:
+          credentials_json: '${{ secrets.CF3_INTEGRATION_TEST_GOOGLE_CREDENTIALS }}'
+          create_credentials_file: true
+
+      - name: 'Set up Cloud SDK'
+        uses: google-github-actions/setup-gcloud@v0
+
+      - name: 'Setup Firebase CLI'
+        run: npm i -g firebase-tools
+
+      - name: 'Run integration test'
+        run: npm run test:postmerge
+
+      - name: Print debug logs
+        if: failure()
+        run: find . -type f -name "*debug.log" | xargs cat

integration_test/README.md

@@ -8,6 +8,15 @@ Run the integration test as follows:
 ./run_tests.sh <project_id> [<project_id2>]
 ```
 
-If just one project_id is provided, the both the node6 and node8 tests will be run on that project, in series. If two project_ids are provided, the node6 tests will be run on the first project and the node8 tests will be run on the second one, in parallel.
+Test runs cycles of testing, once for Node.js 14 and another for Node.js 16.
 
-The tests run fully automatically, and will print the result on standard out. The integration test for HTTPS is that it properly kicks off other integration tests and returns a result. From there the other integration test suites will write their results back to the database, where you can check the detailed results if you'd like.
+Test uses locally installed firebase to invoke commands for deploying function. The test also requires that you have
+gcloud CLI installed and authenticated (`gcloud auth login`).
+
+Integration test is triggered by invoking HTTP function integrationTest which in turns invokes each function trigger
+by issuing actions necessary to trigger it (e.g. write to storage bucket).
+
+### Debugging
+
+The status and result of each test is stored in RTDB of the project used for testing. You can also inspect Cloud Logging
+for more clues.

integration_test/firebase.json

@@ -8,6 +8,7 @@
   },
   "functions": {
     "source": "functions",
-    "codebase": "integration-tests"
+    "codebase": "integration-tests",
+    "predeploy": ["npm --prefix \"$RESOURCE_DIR\" run build"]
   }
 }

integration_test/functions/src/index.ts

@@ -1,4 +1,5 @@
 import { PubSub } from '@google-cloud/pubsub';
+import { GoogleAuth } from 'google-auth-library';
 import { Request, Response } from 'express';
 import * as admin from 'firebase-admin';
 import * as functions from 'firebase-functions';
@@ -22,17 +23,19 @@ const firebaseConfig = JSON.parse(process.env.FIREBASE_CONFIG);
 admin.initializeApp();
 
 async function callHttpsTrigger(name: string, data: any) {
-  const resp = await fetch(
-    `https://${REGION}-${firebaseConfig.projectId}.cloudfunctions.net/${name}`,
-    {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({ data }),
-    }
+  const url = `https://${REGION}-${firebaseConfig.projectId}.cloudfunctions.net/${name}`;
+  const client = await new GoogleAuth().getIdTokenClient(
+    '32555940559.apps.googleusercontent.com'
   );
-  if (!resp.ok) {
+  const resp = await client.request({
+    url,
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({ data }),
+  });
+  if (resp.status > 200) {
     throw Error(resp.statusText);
   }
 }
@@ -42,31 +45,36 @@ async function callV2HttpsTrigger(
   data: any,
   accessToken: string
 ) {
-  let resp = await fetch(
+  const getFnResp = await fetch(
     `https://cloudfunctions.googleapis.com/v2beta/projects/${firebaseConfig.projectId}/locations/${REGION}/functions/${name}`,
     {
       headers: {
         Authorization: `Bearer ${accessToken}`,
       },
     }
   );
-  if (!resp.ok) {
-    throw new Error(resp.statusText);
+  if (!getFnResp.ok) {
+    throw new Error(getFnResp.statusText);
   }
-  const fn = await resp.json();
+  const fn = await getFnResp.json();
   const uri = fn.serviceConfig?.uri;
   if (!uri) {
     throw new Error(`Cannot call v2 https trigger ${name} - no uri found`);
   }
-  resp = await fetch(uri, {
+
+  const client = await new GoogleAuth().getIdTokenClient(
+    '32555940559.apps.googleusercontent.com'
+  );
+  const invokeFnREsp = await client.request({
+    url: uri,
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
     },
     body: JSON.stringify({ data }),
   });
-  if (!resp.ok) {
-    throw new Error(resp.statusText);
+  if (invokeFnREsp.status > 200) {
+    throw Error(invokeFnREsp.statusText);
   }
 }
 
@@ -163,6 +171,7 @@ export const integrationTests: any = functions
   .region(REGION)
   .runWith({
     timeoutSeconds: 540,
+    invoker: 'private',
   })
   .https.onRequest(async (req: Request, resp: Response) => {
     const testId = admin.database().ref().push().key;

integration_test/functions/src/v1/https-tests.ts

@@ -2,10 +2,13 @@ import * as functions from 'firebase-functions';
 import { REGION } from '../region';
 import { expectEq, TestSuite } from '../testing';
 
-export const callableTests: any = functions.region(REGION).https.onCall((d) => {
-  return new TestSuite('https onCall')
-    .it('should have the correct data', (data: any) =>
-      expectEq(data?.foo, 'bar')
-    )
-    .run(d.testId, d);
-});
+export const callableTests: any = functions
+  .runWith({ invoker: 'private' })
+  .region(REGION)
+  .https.onCall((d) => {
+    return new TestSuite('https onCall')
+      .it('should have the correct data', (data: any) =>
+        expectEq(data?.foo, 'bar')
+      )
+      .run(d.testId, d);
+  });

integration_test/functions/src/v2/https-tests.ts

@@ -1,7 +1,7 @@
 import { onCall } from 'firebase-functions/v2/https';
 import { expectEq, TestSuite } from '../testing';
 
-export const callabletests = onCall((req) => {
+export const callabletests = onCall({ invoker: 'private' }, (req) => {
   return new TestSuite('v2 https onCall')
     .it('should have the correct data', (data: any) =>
       expectEq(data?.foo, 'bar')

integration_test/functions/tsconfig.json

@@ -2,7 +2,7 @@
   "compilerOptions": {
     "lib": ["es6", "dom"],
     "module": "commonjs",
-    "target": "es6",
+    "target": "es2020",
     "noImplicitAny": false,
     "outDir": "lib",
     "declaration": true,

integration_test/run_tests.sh

@@ -3,26 +3,14 @@
 # Exit immediately if a command exits with a non-zero status.
 set -e
 
-function usage {
-  echo "Usage: ${0} <project_id> [<token>]"
-  exit 1
-}
+PROJECT_ID="${GCLOUD_PROJECT}"
+TIMESTAMP=$(date +%s)
 
-# This script takes in one required argument specifying a project_id and an
-# optional arguement for a CI token that can be obtained by running
-# `firebase login:ci`
-# Example usage (from root dir) without token:
-# ./integration_test/run_tests.sh chenky-test-proj
-# Example usage (from root dir) with token:
-# ./integration_test/run_tests.sh chenky-test-proj $TOKEN
-if [[ "${1}" == "" ]]; then
-  usage
+if [[ "${PROJECT_ID}" == "" ]]; then
+  echo "process.env.GCLOUD_PROJECT cannot be empty"
+  exit 1
 fi
 
-PROJECT_ID="${1}"
-TIMESTAMP=$(date +%s)
-TOKEN="${2}"
-
 # Directory where this script lives.
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
@@ -64,24 +52,14 @@ function delete_all_functions {
   cd "${DIR}"
   # Try to delete, if there are errors it is because the project is already empty,
   # in that case do nothing.
-  if [[ "${TOKEN}" == "" ]]; then
-    firebase functions:delete integration-tests --force --project=$PROJECT_ID || : &
-  else
-    firebase functions:delete integration-tests --force --project=$PROJECT_ID --token=$TOKEN || : &
-  fi
+  firebase functions:delete integrationTests v1 v2 --force --project=$PROJECT_ID || : &
   wait
   announce "Project emptied."
 }
 
 function deploy {
-  cd "${DIR}"
-  ./functions/node_modules/.bin/tsc -p functions/
   # Deploy functions, and security rules for database and Firestore. If the deploy fails, retry twice
-  if [[ "${TOKEN}" == "" ]]; then
-    for i in 1 2 3; do firebase deploy --project="${PROJECT_ID}" --only functions:integration-tests,database,firestore && break; done
-  else
-    for i in 1 2 3; do firebase deploy --project="${PROJECT_ID}" --token="${TOKEN}" --only functions:integration-tests,database,firestore && break; done
-  fi
+  for i in 1 2; do firebase deploy --project="${PROJECT_ID}" --only functions,database,firestore && break; done
 }
 
 function run_tests {
@@ -97,7 +75,7 @@ function run_tests {
   TEST_URL="https://${FIREBASE_FUNCTIONS_TEST_REGION}-${PROJECT_ID}.${TEST_DOMAIN}/integrationTests"
   echo "${TEST_URL}"
 
-  curl --fail "${TEST_URL}"
+  curl --fail -H "Authorization: Bearer $(gcloud auth print-identity-token)" "${TEST_URL}"
 }
 
 function cleanup {