From 2bf125f22dc5660f9436033aa6a4167711f3ec2c Mon Sep 17 00:00:00 2001 From: Davide Vacca Date: Wed, 8 Jul 2026 10:02:35 +0200 Subject: [PATCH 1/5] ci: use distributed lock for integration tests Replace inline conditions with onfido-actions/lock acquire/release steps to prevent parallel integration test execution across SDK repositories. The lock uses a git branch in onfido/ci-lock as an atomic mutex. A should-run-integration-tests step centralizes the condition check, keeping subsequent steps DRY. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/node.yml | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/.github/workflows/node.yml b/.github/workflows/node.yml index 7e33696..71f40ab 100644 --- a/.github/workflows/node.yml +++ b/.github/workflows/node.yml @@ -41,13 +41,22 @@ jobs: run: npm ci - name: Run linter over tests run: npx prettier -c test/**/*.ts - - name: Run integration tests with API token auth + - name: Should run integration tests + id: should-run-integration-tests if: ${{ matrix.node-version == '20.x' && github.repository_owner == 'onfido' && (github.event_name == 'pull_request' || github.event_name == 'release' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') }} + run: echo "result=true" >> "$GITHUB_OUTPUT" + - name: Acquire integration test lock + if: steps.should-run-integration-tests.outputs.result == 'true' + uses: onfido/onfido-actions/lock/acquire@main + with: + github-token: ${{ secrets.CI_LOCK_TOKEN }} + - name: Run integration tests with API token auth + if: steps.should-run-integration-tests.outputs.result == 'true' run: npm test -- -i env: ONFIDO_API_TOKEN: ${{ secrets.ONFIDO_API_TOKEN }} @@ -57,11 +66,8 @@ jobs: ONFIDO_SAMPLE_MOTION_ID_1: ${{ secrets.ONFIDO_SAMPLE_MOTION_ID_1 }} ONFIDO_SAMPLE_MOTION_ID_2: ${{ secrets.ONFIDO_SAMPLE_MOTION_ID_2 }} - name: Run integration tests with OAuth client credentials auth - if: ${{ matrix.node-version == '20.x' && - github.repository_owner == 'onfido' && - (github.event_name == 'pull_request' || - github.event_name == 'release' || - github.event_name == 'workflow_dispatch') }} + if: ${{ steps.should-run-integration-tests.outputs.result == 'true' && + github.event_name != 'schedule' }} run: npm test -- -i env: ONFIDO_OAUTH_CLIENT_ID: ${{ secrets.ONFIDO_OAUTH_CLIENT_ID }} @@ -71,6 +77,11 @@ jobs: ONFIDO_SAMPLE_VIDEO_ID_2: ${{ secrets.ONFIDO_SAMPLE_VIDEO_ID_2 }} ONFIDO_SAMPLE_MOTION_ID_1: ${{ secrets.ONFIDO_SAMPLE_MOTION_ID_1 }} ONFIDO_SAMPLE_MOTION_ID_2: ${{ secrets.ONFIDO_SAMPLE_MOTION_ID_2 }} + - name: Release integration test lock + if: always() && steps.should-run-integration-tests.outputs.result == 'true' + uses: onfido/onfido-actions/lock/release@main + with: + github-token: ${{ secrets.CI_LOCK_TOKEN }} publish: runs-on: ubuntu-latest From 5d1e2505662243c6c42ccd00a4321382aaa37dc3 Mon Sep 17 00:00:00 2001 From: Davide Vacca Date: Wed, 8 Jul 2026 10:02:44 +0200 Subject: [PATCH 2/5] test: temporarily target add-lock-action branch for lock actions This commit should be reverted before merging. --- .github/workflows/node.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/node.yml b/.github/workflows/node.yml index 71f40ab..7c13b6f 100644 --- a/.github/workflows/node.yml +++ b/.github/workflows/node.yml @@ -52,7 +52,7 @@ jobs: run: echo "result=true" >> "$GITHUB_OUTPUT" - name: Acquire integration test lock if: steps.should-run-integration-tests.outputs.result == 'true' - uses: onfido/onfido-actions/lock/acquire@main + uses: onfido/onfido-actions/lock/acquire@add-lock-action with: github-token: ${{ secrets.CI_LOCK_TOKEN }} - name: Run integration tests with API token auth @@ -79,7 +79,7 @@ jobs: ONFIDO_SAMPLE_MOTION_ID_2: ${{ secrets.ONFIDO_SAMPLE_MOTION_ID_2 }} - name: Release integration test lock if: always() && steps.should-run-integration-tests.outputs.result == 'true' - uses: onfido/onfido-actions/lock/release@main + uses: onfido/onfido-actions/lock/release@add-lock-action with: github-token: ${{ secrets.CI_LOCK_TOKEN }} From 3fa520a8df69a464884f32fa61e2dcad72662b8a Mon Sep 17 00:00:00 2001 From: Davide Vacca Date: Thu, 9 Jul 2026 09:21:02 +0200 Subject: [PATCH 3/5] ci: use shared should-run-integration-tests action Use onfido-actions/should-run-integration-tests to determine when to run integration tests. This adds support for running tests on push events from merged fork PRs (where secrets aren't available pre-merge). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/node.yml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/.github/workflows/node.yml b/.github/workflows/node.yml index 7c13b6f..413c03b 100644 --- a/.github/workflows/node.yml +++ b/.github/workflows/node.yml @@ -44,12 +44,8 @@ jobs: - name: Should run integration tests id: should-run-integration-tests if: ${{ matrix.node-version == '20.x' && - github.repository_owner == 'onfido' && - (github.event_name == 'pull_request' || - github.event_name == 'release' || - github.event_name == 'workflow_dispatch' || - github.event_name == 'schedule') }} - run: echo "result=true" >> "$GITHUB_OUTPUT" + github.repository_owner == 'onfido' }} + uses: onfido/onfido-actions/should-run-integration-tests@add-lock-action - name: Acquire integration test lock if: steps.should-run-integration-tests.outputs.result == 'true' uses: onfido/onfido-actions/lock/acquire@add-lock-action From 52c7301941405d1fdd76ff6dc4a5fa6c19815620 Mon Sep 17 00:00:00 2001 From: Davide Vacca Date: Fri, 10 Jul 2026 12:12:39 +0200 Subject: [PATCH 4/5] ci: use GitHub App for lock authentication Replace CI_LOCK_TOKEN with GitHub App credentials (ONFIDO_CI_LOCK_APP_ID, ONFIDO_CI_LOCK_PRIVATE_KEY, ONFIDO_CI_LOCK_INSTALLATION_ID) for the distributed lock mechanism. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/node.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/node.yml b/.github/workflows/node.yml index 413c03b..b0926e5 100644 --- a/.github/workflows/node.yml +++ b/.github/workflows/node.yml @@ -50,7 +50,8 @@ jobs: if: steps.should-run-integration-tests.outputs.result == 'true' uses: onfido/onfido-actions/lock/acquire@add-lock-action with: - github-token: ${{ secrets.CI_LOCK_TOKEN }} + app-id: ${{ secrets.ONFIDO_CI_LOCK_APP_ID }} + app-private-key: ${{ secrets.ONFIDO_CI_LOCK_PRIVATE_KEY }} - name: Run integration tests with API token auth if: steps.should-run-integration-tests.outputs.result == 'true' run: npm test -- -i @@ -77,7 +78,8 @@ jobs: if: always() && steps.should-run-integration-tests.outputs.result == 'true' uses: onfido/onfido-actions/lock/release@add-lock-action with: - github-token: ${{ secrets.CI_LOCK_TOKEN }} + app-id: ${{ secrets.ONFIDO_CI_LOCK_APP_ID }} + app-private-key: ${{ secrets.ONFIDO_CI_LOCK_PRIVATE_KEY }} publish: runs-on: ubuntu-latest From 81254956e744dc3228b37053209b2123a050c6ca Mon Sep 17 00:00:00 2001 From: Davide Vacca Date: Fri, 10 Jul 2026 16:17:11 +0200 Subject: [PATCH 5/5] ci: point lock actions to onfido-actions@main Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/node.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/node.yml b/.github/workflows/node.yml index b0926e5..241c8b5 100644 --- a/.github/workflows/node.yml +++ b/.github/workflows/node.yml @@ -45,10 +45,10 @@ jobs: id: should-run-integration-tests if: ${{ matrix.node-version == '20.x' && github.repository_owner == 'onfido' }} - uses: onfido/onfido-actions/should-run-integration-tests@add-lock-action + uses: onfido/onfido-actions/should-run-integration-tests@main - name: Acquire integration test lock if: steps.should-run-integration-tests.outputs.result == 'true' - uses: onfido/onfido-actions/lock/acquire@add-lock-action + uses: onfido/onfido-actions/lock/acquire@main with: app-id: ${{ secrets.ONFIDO_CI_LOCK_APP_ID }} app-private-key: ${{ secrets.ONFIDO_CI_LOCK_PRIVATE_KEY }} @@ -76,7 +76,7 @@ jobs: ONFIDO_SAMPLE_MOTION_ID_2: ${{ secrets.ONFIDO_SAMPLE_MOTION_ID_2 }} - name: Release integration test lock if: always() && steps.should-run-integration-tests.outputs.result == 'true' - uses: onfido/onfido-actions/lock/release@add-lock-action + uses: onfido/onfido-actions/lock/release@main with: app-id: ${{ secrets.ONFIDO_CI_LOCK_APP_ID }} app-private-key: ${{ secrets.ONFIDO_CI_LOCK_PRIVATE_KEY }}