lifecycle: better pre release test (#12806)

* move pre-release docker test to script

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* set pipefail in ak

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* don't reinstall wheels since they don't exist anymore

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* fix image

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* fix config error on startup

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

---------

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

.github/workflows/release-tag.yml

@@ -14,16 +14,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Pre-release test
         run: |
-          echo "PG_PASS=$(openssl rand 32 | base64 -w 0)" >> .env
+          make test-docker
-          echo "AUTHENTIK_SECRET_KEY=$(openssl rand 32 | base64 -w 0)" >> .env
-          docker buildx install
-          mkdir -p ./gen-ts-api
-          docker build -t testing:latest .
-          echo "AUTHENTIK_IMAGE=testing" >> .env
-          echo "AUTHENTIK_TAG=latest" >> .env
-          docker compose up --no-start
-          docker compose start postgresql redis
-          docker compose run -u root server test-all
       - id: generate_token
         uses: tibdex/github-app-token@v2
         with:

Makefile

@@ -45,15 +45,6 @@ help:  ## Show this help
 go-test:
 	go test -timeout 0 -v -race -cover ./...
 
-test-docker:  ## Run all tests in a docker-compose
-	echo "PG_PASS=$(shell openssl rand 32 | base64 -w 0)" >> .env
-	echo "AUTHENTIK_SECRET_KEY=$(shell openssl rand 32 | base64 -w 0)" >> .env
-	docker compose pull -q
-	docker compose up --no-start
-	docker compose start postgresql redis
-	docker compose run -u root server test-all
-	rm -f .env
-
 test: ## Run the server tests and produce a coverage report (locally)
 	coverage run manage.py test --keepdb authentik
 	coverage html
@@ -263,6 +254,9 @@ docker:  ## Build a docker image of the current source tree
 	mkdir -p ${GEN_API_TS}
 	DOCKER_BUILDKIT=1 docker build . --progress plain --tag ${DOCKER_IMAGE}
 
+test-docker:
+	./scripts/test_docker.sh
+
 #########################
 ## CI
 #########################

authentik/lib/config.py

@@ -283,7 +283,8 @@ class ConfigLoader:
     def get_optional_int(self, path: str, default=None) -> int | None:
         """Wrapper for get that converts value into int or None if set"""
         value = self.get(path, default)
-
+        if value is UNSET:
+            return default
         try:
             return int(value)
         except (ValueError, TypeError) as exc:

lifecycle/ak

@@ -1,4 +1,5 @@
-#!/usr/bin/env -S bash -e
+#!/usr/bin/env -S bash
+set -e -o pipefail
 MODE_FILE="${TMPDIR}/authentik-mode"
 
 function log {
@@ -87,7 +88,6 @@ elif [[ "$1" == "bash" ]]; then
 elif [[ "$1" == "test-all" ]]; then
     prepare_debug
     chmod 777 /root
-    pip install --force-reinstall /wheels/*
     check_if_root "python -m manage test authentik"
 elif [[ "$1" == "healthcheck" ]]; then
     run_authentik healthcheck $(cat $MODE_FILE)

scripts/test_docker.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+set -e -x -o pipefail
+
+export PG_PASS=$(openssl rand -base64 36 | tr -d '\n')
+export AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')
+export AUTHENTIK_IMAGE="xghcr.io/goauthentik/server"
+export AUTHENTIK_TAG=$(git rev-parse HEAD | cut -c1-15)
+export COMPOSE_PROJECT_NAME="authentik-test-${AUTHENTIK_TAG}"
+
+# Ensure buildx is installed
+docker buildx install
+# For release builds we have an empty client here as we use the NPM package
+mkdir -p ./gen-ts-api
+docker build -t ${AUTHENTIK_IMAGE}:${AUTHENTIK_TAG} .
+docker compose up --no-start
+docker compose start postgresql redis
+docker compose run -u root server test-all
+docker compose down -v