fix(ci): repair Lint, Integration, Security and E2E jobs failing on main

.github/workflows/ci.yml

@@ -306,7 +306,7 @@ jobs:
           # so scanning the root would silently miss pkg/ and providers/*.
           # Walk every module independently and fail on any HIGH/CRITICAL.
           set -e
-          for mod in . pkg providers/aws providers/azure providers/gcp; do
+          for mod in . pkg providers/aws providers/azure providers/gcp tests/e2e; do
             echo "==> govulncheck in $mod"
             (cd "$mod" && govulncheck ./...)
           done
@@ -372,13 +372,13 @@ jobs:
         with:
           args: --severity-threshold=high
 
-  # Docker Compose E2E tests
-  # NOTE: Dockerfile.test and docker-compose.test.yml are not yet implemented.
-  # continue-on-error prevents this unimplemented job from blocking the ci-success gate.
+  # Docker Compose E2E tests: build the app + test-runner images, bring up
+  # postgres + cudly-app, then run the black-box suite in tests/e2e against
+  # the app over HTTP. The test-runner service is profile-gated, so every
+  # compose invocation needs --profile test (issue #1180).
   e2e-tests:
     name: E2E Tests
     runs-on: ubuntu-latest
-    continue-on-error: true
 
     steps:
       - name: Checkout code
@@ -389,20 +389,20 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
-      - name: Build test image
+      - name: Build images
         run: |
-          docker build -t cudly:test -f Dockerfile.test .
+          docker compose -f docker-compose.test.yml --profile test build
 
-      - name: Run E2E tests with docker-compose
+      - name: Run E2E tests with docker compose
         run: |
-          docker compose -f docker-compose.test.yml up --abort-on-container-exit --exit-code-from test-runner
+          docker compose -f docker-compose.test.yml --profile test up --abort-on-container-exit --exit-code-from test-runner
         env:
           COMPOSE_INTERACTIVE_NO_CLI: 1
 
       - name: Cleanup
         if: always()
         run: |
-          docker compose -f docker-compose.test.yml down -v
+          docker compose -f docker-compose.test.yml --profile test down -v
 
   # Assert that the Azure custom-role actions list is identical in the TF module
   # and the ARM onboarding template.  Fast (shell + jq only), so it always runs.

.gitignore

@@ -22,6 +22,8 @@ cmd.test
 
 # Test binary, built with `go test -c`
 *.test
+# ... but not the E2E test-runner image definition
+!Dockerfile.test
 
 # Output of the go coverage tool
 *.out

Dockerfile.test

@@ -0,0 +1,20 @@
+# Test-runner image for the docker-compose E2E suite (docker-compose.test.yml,
+# profile "test"). It only needs the Go toolchain and the stdlib-only module
+# under tests/e2e, so the build is fast and independent of the app's
+# dependency tree.
+#
+# Base image pinned by digest for the same supply-chain reasons as Dockerfile;
+# keep the digest in sync with the builder stage there.
+FROM golang:1.25.4-alpine3.21@sha256:3289aac2aac769e031d644313d094dbda745f28af81cd7a94137e73eefd58b33
+
+WORKDIR /e2e
+
+COPY tests/e2e/ ./
+
+# Pre-compile the test binary so `docker compose up` failures are runtime
+# failures, not compile errors discovered after the stack is already up.
+RUN go vet -tags=e2e ./... && go test -tags=e2e -run NONE ./...
+
+# docker-compose.test.yml overrides the command; this default keeps the image
+# usable standalone.
+CMD ["go", "test", "-v", "-tags=e2e", "./..."]

docker-compose.test.yml

@@ -48,8 +48,19 @@ services:
       DB_AUTO_MIGRATE: "true"
       DB_MIGRATIONS_PATH: /app/migrations
 
-      # Secret provider (use env for testing)
+      # Secret provider (use env for testing). With the env provider,
+      # *_SECRET variables name the environment variable holding the value.
       SECRET_PROVIDER: env
+      ADMIN_EMAIL: admin@test.example
+      ADMIN_PASSWORD_SECRET: TEST_ADMIN_PASSWORD
+      TEST_ADMIN_PASSWORD: e2e-local-test-only-password
+      # Allow the all-zero dev encryption key; this stack never holds real
+      # cloud credentials.
+      CREDENTIAL_ENCRYPTION_ALLOW_DEV_KEY: "1"
+
+      # Scheduled-task auth: disabled for the local/CI compose stack (no
+      # cloud OIDC issuer or bearer secret available)
+      SCHEDULED_TASK_AUTH_MODE: disabled
 
       # DynamoDB tables (for backward compatibility testing)
       CONFIG_TABLE: test-config
@@ -59,7 +70,9 @@ services:
       GROUPS_TABLE: test-groups
       SESSIONS_TABLE: test-sessions
 
-      # Email configuration (mock)
+      # Email configuration: disabled, the app falls back to a no-op sender
+      # (SECRET_PROVIDER=env is not a supported email backend)
+      EMAIL_ENABLED: "false"
       EMAIL_ADDRESS: test@example.com
 
       # Feature flags
@@ -79,7 +92,7 @@ services:
       retries: 3
       start_period: 10s
 
-  # Test runner (optional - for running integration tests in container)
+  # Test runner: black-box E2E suite (tests/e2e) against cudly-app over HTTP.
   test-runner:
     build:
       context: .
@@ -101,15 +114,9 @@ services:
       DB_SSL_MODE: disable
     networks:
       - cudly-test
-    command: >
-      sh -c "
-        echo 'Waiting for services to be ready...';
-        sleep 5;
-        echo 'Running E2E tests...';
-        go test -v -tags=integration ./...;
-      "
+    command: ["go", "test", "-v", "-tags=e2e", "./..."]
     profiles:
-      - test  # Only start with: docker-compose --profile test up
+      - test  # Only start with: docker compose --profile test up
 
 networks:
   cudly-test:

go.mod

@@ -60,18 +60,18 @@ require (
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/stretchr/objx v0.5.3 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
 	go.opentelemetry.io/otel v1.42.0 // indirect
 	go.opentelemetry.io/otel/metric v1.42.0 // indirect
 	go.opentelemetry.io/otel/trace v1.42.0 // indirect
-	golang.org/x/crypto v0.49.0
-	golang.org/x/net v0.52.0 // indirect
+	golang.org/x/crypto v0.53.0
+	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.20.0
-	golang.org/x/sys v0.42.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
+	golang.org/x/sync v0.21.0
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/api v0.274.0
 	google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect
@@ -111,9 +111,9 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/jackc/pgx/v5 v5.8.0
 	github.com/pashagolub/pgxmock/v4 v4.9.0
-	github.com/testcontainers/testcontainers-go v0.40.0
-	github.com/testcontainers/testcontainers-go/modules/postgres v0.40.0
-	golang.org/x/term v0.41.0
+	github.com/testcontainers/testcontainers-go v0.42.0
+	github.com/testcontainers/testcontainers-go/modules/postgres v0.42.0
+	golang.org/x/term v0.44.0
 )
 
 require (
@@ -128,7 +128,7 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/cosmos/armcosmos/v2 v2.7.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/search/armsearch v1.4.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
@@ -149,36 +149,35 @@ require (
 	github.com/docker/docker v28.5.1+incompatible // indirect
 	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/ebitengine/purego v0.8.4 // indirect
+	github.com/ebitengine/purego v0.10.0 // indirect
 	github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.6 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/klauspost/compress v1.18.5 // indirect
 	github.com/lib/pq v1.10.9 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/magiconair/properties v1.8.10 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/go-archive v0.1.0 // indirect
-	github.com/moby/patternmatcher v0.6.0 // indirect
+	github.com/moby/go-archive v0.2.0 // indirect
+	github.com/moby/moby/api v1.54.1 // indirect
+	github.com/moby/moby/client v0.4.0 // indirect
+	github.com/moby/patternmatcher v0.6.1 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
-	github.com/moby/term v0.5.0 // indirect
-	github.com/morikuni/aec v1.0.0 // indirect
+	github.com/moby/term v0.5.2 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
-	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
-	github.com/shirou/gopsutil/v4 v4.25.6 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
+	github.com/shirou/gopsutil/v4 v4.26.3 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
-	github.com/tklauser/go-sysconf v0.3.12 // indirect
-	github.com/tklauser/numcpus v0.6.1 // indirect
+	github.com/tklauser/go-sysconf v0.3.16 // indirect
+	github.com/tklauser/numcpus v0.11.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect