Cornelius A. Ludmann e9f25f4224
Replace npx with pinned npm-tools and add security hardening (#21166)
* [dev] disable npm lifecycle scripts and npx

* Add npm-tools

* update npm-tools

* dev/image/Dockerfile

* update

Co-authored-by: Ona <no-reply@ona.com>

* Bump leeay version to 0.10.6

Co-authored-by: Ona <no-reply@ona.com>

* Fix npx removal to also delete the target script

The symlink at /root/.nvm/.../bin/npx points to npx-cli.js.
Remove both to ensure npx is fully disabled.

Co-authored-by: Ona <no-reply@ona.com>

* Remove gce-github-runner usage from all workflows

Replace self-hosted GCE runner pattern with GitHub-hosted ubuntu-latest runners across all workflows. This removes the three-phase pattern (create-runner, use-runner, delete-runner) and simplifies workflow execution.

Changes:
- Remove create-runner and delete-runner jobs from all workflows
- Replace runs-on: ${{ needs.create-runner.outputs.label }} with runs-on: ubuntu-latest
- Remove create-runner from job dependencies
- Preserve all other job dependencies and concurrency controls

Affected workflows:
- build.yml (8 jobs)
- workspace-integration-tests.yml (4 jobs)
- ide-integration-tests.yml (4 jobs)
- preview-env-check-regressions.yml (4 jobs)
- preview-env-gc.yml (2 jobs)
- jetbrains-auto-update-template.yml (1 job)
- jetbrains-integration-test.yml (1 job)
- code-nightly.yml (1 job)
- preview-env-delete.yml (1 job)

Co-authored-by: Ona <no-reply@ona.com>

* [dev] use ubuntu-latest-16-cores for builds

* Fix container permissions for GitHub-hosted runners

Add 'options: --user root' to all container configurations to resolve EACCES permission errors when GitHub Actions tries to write to internal directories.

GitHub-hosted runners require containers to run as root to allow the Actions runtime to write to /__w/_temp/_runner_file_commands/ and other internal paths.

Affected workflows:
- build.yml (3 container jobs)
- workspace-integration-tests.yml (2 container jobs)
- ide-integration-tests.yml (2 container jobs)
- preview-env-check-regressions.yml (1 container job)
- preview-env-gc.yml (1 container job)
- jetbrains-auto-update-template.yml (1 container job)
- jetbrains-integration-test.yml (1 container job)
- code-nightly.yml (1 container job)

Co-authored-by: Ona <no-reply@ona.com>

* Fix dev/image build by adding leeway dependency for npm-tools

Create leeway generic build for dev/npm-tools and use it as a dependency in dev/image:docker build. This resolves the build error where npm-tools files were not accessible during Docker build.

Changes:
- Add dev/npm-tools/BUILD.yaml with generic package containing package.json and package-lock.json
- Add dev/npm-tools:pkg as dependency in dev/image/BUILD.yaml
- Update Dockerfile to use COPY from leeway dependency path (dev-npm-tools--pkg/)

This follows the established pattern used in other builds like install/installer where dependencies are copied from leeway-generated paths.

Co-authored-by: Ona <no-reply@ona.com>

* Fix npm-tools installation permissions in dev/image

Add chown command to fix EACCES permission error when installing npm-tools. The COPY command creates files owned by root, but npm ci runs as gitpod user and needs write access to create node_modules.

Changes:
- Add 'sudo chown -R gitpod:gitpod /opt/npm-tools' before npm ci
- This ensures the gitpod user can write to /opt/npm-tools/node_modules/

Error fixed:
  npm error code EACCES
  npm error syscall mkdir
  npm error path /opt/npm-tools/node_modules
  npm error errno -13

Co-authored-by: Ona <no-reply@ona.com>

* [dev] Split builds into branch and main

Co-authored-by: Ona <no-reply@ona.com>

---------

Co-authored-by: Cornelius Ludmann <cornelius@ona.com>
Co-authored-by: Ona <no-reply@ona.com>
Co-authored-by: Gero Posmyk-Leinemann <gero@gitpod.io>
2025-12-05 16:25:19 +01:00
..
2022-12-08 13:05:19 -03:00
2025-05-28 13:32:00 -04:00
2025-05-20 16:01:05 -04:00
2022-12-08 13:05:19 -03:00
2025-10-09 06:32:42 -04:00

Integration Tests

This directory contains Gitpod's integration tests, including the framework that makes them possible.

Integration tests work by instrumenting Gitpod's components to modify and verify its state. Such tests are for example:

test case description
create bucket executing code within ws-daemon's context that loads the config file, creates a remote storage instance, and attempts to create a bucket.
start workspace obtaining a Gitpod API token, calling "createWorkspace" and watching for successful startup events.
task start starting a workspace using the ws-manager interface, instrumenting the workspace container and ensuring that tasks have run.

Integrations

  • instrumentation: agents that are compiled before/during the test, uploaded to a pod and executed there. They communicate with the test using net/rpc.
  • API access: to all internal APIs, including ws-manager, ws-daemon, image-builder, registry-facade, server
  • DB access to the Gitpod DB

Running the tests

Automatically at Gitpod

You can opt-in to run the integrations tests as part of the build job. that runs the integration tests against preview environments.

For tests that require an existing user the framework tries to automatically select one from the DB.

  • On preview envs make sure to create one before running tests against it!
  • If it's important to use a certain user (with fixed settings, for example) pass the additional username parameter.

Example command:

werft job run github -a with-preview=true -a with-integration-tests=webapp -f

Manually

You may want to run tests to assert whether a Gitpod installation is successfully integrated.

Use a preview environment with a large VM to run the tests. The tests run in parallel and can consume a large amount of recources. Create one as follows: TF_VAR_with_large_vm=true leeway run dev:preview

Go test

This is best for when you're actively developing Gitpod.

Test will work if images that they use are already cached by Gitpod instance. If not, they might fail if it takes too long to pull an image.

There are 4 different types of tests:

  1. Enterprise specific, that require valid license to be installed. Run those with -enterprise=true
  2. Tests that require correct user (user should have github OAuth integration setup with gitpod). Run those with -username=<gitpod_username>. Make sure to load https://github.com/gitpod-io/gitpod-test-repo and https://github.com/gitpod-io/gitpod workspaces inside your gitpod that you are testing to preload those images onto your node. Wait for it to finish pulling those image, this will ensure that test will not fail due to timeout while waiting to pull an image for the first time.
  3. To test gitlab integration, add -gitlab=true
  4. All other tests.

If you want to run an entire test suite, the easiest is to use ./test/run.sh:

# This will run all test suites
./test/run.sh

# This will run only the webapp test suite
./test/run.sh -s webapp

# This will run only the webapp test suite with the report
./test/run.sh -s webapp -r report.csv

If you're iterating on a single test, the easiest is to use go test directly.

If your integration tests depends on having having a user token available, then you'll have to set USER_NAME and USER_TOKEN environment variables. This can be done a couple ways:

  1. Get credentials persisted as secrets (either in Github Actions, or GCP Secret Manager via the core-dev project), which vary by job that trigger tests. Refer to run.sh for details.
  2. In your Gitpod (preview) environment, log into the preview environment, set USER_NAME to the user you logged in with, and set USER_TOKEN to any (does not have to be valid).
cd test
go test -v ./... \
    -run <test> \
    -namespace=default \
    -username=<gitpod_user_with_oauth_setup> \
    -enterprise=<true|false> \
    -gitlab=<true|false>

A concrete example would be

cd test
go test -v ./... \
    -namespace=default \
    -run TestWorkspaceInstrumentation

Tips

Workspace

Where should I start?

If you want to create a new test case, it is recommended that you copy example_test.go.

Be careful when writing tests

  • Be careful not to affect other test cases. e.g. Do not stop workspace at the end of the test

Be sure before merged your PR.

  • Have you run all tests?
  • Do you successfully test from werft? We are runinng the integration tests from werft everyday