gitlab-qa 15.7.2 → 15.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e2f5e12b0e4b1d6949c3bf2ac7b988ab0f4b42a1c9e039828da20d0611f0e284
-  data.tar.gz: c41f28650cf5a9da55dbe1e97b6c9d4d04f08457e8d19f57982ecf193879603a
+  metadata.gz: 2f712be690928e97a469fb1845b7032a8064df288ea7110c98aa782a01c84a41
+  data.tar.gz: df0a1fc951cacee6d314fcbdc9e02b1b7e7628d8ae489807a42a1b8713bbb3b4
 SHA512:
-  metadata.gz: afdb8a6544dd8aa320f1b076d16ce0aa6dc453e014f3bf8b7b30fd1b29a2abd0d1d99df34755ae4812e9bc1c83da7d154a7bfdc7a68894a1d2ef71b8bfacc17a
-  data.tar.gz: 6ddd0641fe2d3cf5e5f63915854bea06b4fac93ec18d2f6651f85dbd581621aa952741d35575f4ee56b91709c383c2c12318825e8250345857ff16c4930f086a
+  metadata.gz: 057716e20ffafc661fdb6489dc7f23cdb57252f097b8b9c6cf55f62dadcf326140d3725010418c3121f403771779b9ebd8b7f4df290030dd6a906b372df05dc7
+  data.tar.gz: 660b043282d0d028ea8790c52ec10f0696c1236a15533e469b7514355bfba98f1870144c08b682b40a720464cc1153b5d0a69ca5f75a4f3651920454aabcda81

data/.rubocop_todo.yml

@@ -45,7 +45,6 @@ Metrics/AbcSize:
     - 'lib/gitlab/qa/scenario/test/integration/gitlab_pages.rb'
     - 'lib/gitlab/qa/scenario/test/integration/integrations.rb'
     - 'lib/gitlab/qa/scenario/test/integration/jira.rb'
-    - 'lib/gitlab/qa/scenario/test/integration/mattermost.rb'
     - 'lib/gitlab/qa/scenario/test/integration/metrics.rb'
     - 'lib/gitlab/qa/scenario/test/integration/mtls.rb'
     - 'lib/gitlab/qa/scenario/test/integration/oauth.rb'

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    gitlab-qa (15.7.2)
+    gitlab-qa (15.8.0)
       activesupport (>= 6.1, < 8)
       ffi (~> 1.17)
       gitlab (~> 4.19)

data/docs/what_tests_can_be_run.md

@@ -640,34 +640,6 @@ $ export EE_LICENSE=$(cat /path/to/gitlab_license)
 $ gitlab-qa Test::Integration::OAuth EE
 ```
 
-### `Test::Integration::Mattermost CE|EE|<full image address>`
-
-This tests that a GitLab instance works as expected when enabling the embedded
-Mattermost server (see `Test::Instance::Image` above).
-
-To run tests against the GitLab container, a GitLab QA (`gitlab/gitlab-qa`)
-container is spun up and tests are run from it by running the
-`Test::Integration::Mattermost` scenario (located under
-[`gitlab-org/gitlab/qa/qa/scenario/test/integration/mattermost.rb`][test-integration-mattermost]
-in the GitLab project).
-
-**Required environment variables:**
-
-- [For EE only] `EE_LICENSE`: A valid EE license.
-
-Example:
-
-```shell
-$ gitlab-qa Test::Integration::Mattermost CE
-
-# For EE
-$ export EE_LICENSE=$(cat /path/to/Geo.gitlab_license)
-
-$ gitlab-qa Test::Integration::Mattermost EE
-```
-
-[test-integration-mattermost]: https://gitlab.com/gitlab-org/gitlab/blob/master/qa/qa/scenario/test/integration/mattermost.rb
-
 ### `Test::Integration::Packages CE|EE|<full image address>`
 
 **Note: This Scenario no longer exists.  See https://gitlab.com/gitlab-org/gitlab-qa/-/merge_requests/662**
@@ -1239,6 +1211,7 @@ $ export GITLAB_LICENSE_MODE="test"
 
 - Runs tests tagged with `:ai_gateway`
 - GitLab instance has a cloud license with either a Duo Pro add-on or Duo Enterprise add-on, and a seat is assigned to the admin user. Choose Duo Enterprise over Duo Pro when available.
+- Serves the Duo Chat and Code Suggestions feature areas. It does not boot the Duo Workflow Service (DWS); the Duo Agent Platform foundational flow runs under the dedicated `Test::Integration::DuoAgentPlatform` scenario (below).
 
 Example:
 
@@ -1248,6 +1221,21 @@ $ gitlab-qa Test::Integration::AiGateway EE
 
 ----
 
+#### `Test::Integration::DuoAgentPlatform EE|<full image address>`
+
+- Runs tests tagged with `:duo_agent_platform`
+- Subclass of `Test::Integration::AiGateway`, so it inherits the same setup (cloud license + Duo add-on + assigned seat, plus the mock AI Gateway).
+- In addition, this scenario boots a mock Duo Workflow Service (DWS) container in agentic-mock mode (`duo-workflow-service`, from the same `model-gateway` image switched to the DWS gRPC server) and points GitLab at it via the `GITLAB_DUO_WORKFLOW_SERVICE_URL` / `GITLAB_DUO_WORKFLOW_SECURE` environment variables. This lets the Duo Agent Platform foundational-flow spec drive a flow end-to-end without a real LLM.
+- DWS container logs are captured to the job artifacts (`duo-workflow-service/logs/duo-workflow-service.log`) on teardown.
+
+Example:
+
+```shell
+$ gitlab-qa Test::Integration::DuoAgentPlatform EE
+```
+
+----
+
 #### `Test::Integration::AiGatewayNoSeatAssigned EE|<full image address>`
 
 - Runs tests tagged with `:ai_gateway_no_seat_assigned`

data/lib/gitlab/qa/component/duo_workflow_service.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+
+module Gitlab
+  module QA
+    module Component
+      # Boots the Duo Workflow Service (DWS) gRPC server in agentic-mock mode for Duo Agent
+      # Platform foundational-flow E2E tests. DWS ships inside the same model-gateway image as
+      # the AI Gateway; we reuse that image and switch the container to the DWS server via
+      # ENABLE_DUO_WORKFLOW_SERVICE / DISABLE_AI_GATEWAY (handled by the image's scripts/run.sh).
+      class DuoWorkflowService < Base
+        # Same artifact as the AI Gateway container, so the agentic mock model and DWS agree.
+        DOCKER_IMAGE = AiGateway::DOCKER_IMAGE
+        DOCKER_IMAGE_TAG = AiGateway::DOCKER_IMAGE_TAG
+
+        GRPC_PORT = 50052
+        LOG_FILE_NAME = 'duo-workflow-service.log'
+
+        def initialize
+          super
+
+          @secrets << AiGateway::TEST_SIGNING_KEY
+          @secrets << AiGateway::TEST_VALIDATION_KEY
+        end
+
+        def name
+          @name ||= 'duo-workflow-service'
+        end
+
+        def configure_environment(gitlab_hostname:)
+          @environment = {
+            # Switch the shared image from the AIGW FastAPI app to the DWS gRPC server.
+            'ENABLE_DUO_WORKFLOW_SERVICE' => true,
+            'DISABLE_AI_GATEWAY' => true,
+            'PORT' => GRPC_PORT,
+
+            # Agentic mock: select the deterministic in-process mock model. With both flags set,
+            # DWS makes no real LLM/AIGW call; the goal's <response>/<tool_calls> directives drive it.
+            'AIGW_MOCK_MODEL_RESPONSES' => true,
+            'AIGW_USE_AGENTIC_MOCK' => true,
+
+            # Disable DWS auth: with auth ENABLED, DWS prefetches JWKS from GitLab + CustomersDot
+            # at startup and hard-fails if unreachable (bad in a sealed CI network). Disabling
+            # skips that prefetch and bypasses ExecuteWorkflow token validation.
+            'DUO_WORKFLOW_AUTH__ENABLED' => false,
+
+            # ...but Rails still calls the GenerateToken RPC first, which needs the signing key
+            # present or the encode fails. So supply the DWS-prefixed self-signed keypair.
+            'DUO_WORKFLOW_SELF_SIGNED_JWT__SIGNING_KEY' => AiGateway::TEST_SIGNING_KEY,
+            'DUO_WORKFLOW_SELF_SIGNED_JWT__VALIDATION_KEY' => AiGateway::TEST_VALIDATION_KEY,
+
+            # Falls back to AIGW_GITLAB_URL if unset; set both for consistency.
+            'DUO_WORKFLOW_AUTH__OIDC_GITLAB_URL' => "http://#{gitlab_hostname}",
+            'AIGW_GITLAB_URL' => "http://#{gitlab_hostname}"
+          }
+        end
+
+        # DWS logs to stdout/stderr and writes no in-container log file (unlike the AI Gateway),
+        # so capture `docker logs` into the host artifacts directory before the container is
+        # force-removed on teardown. Without this the DWS logs are lost on removal.
+        def teardown
+          capture_logs
+        ensure
+          super
+        end
+
+        private
+
+        def host_log_path
+          File.join(Runtime::Env.host_artifacts_dir, name, 'logs', LOG_FILE_NAME)
+        end
+
+        def capture_logs
+          FileUtils.mkdir_p(File.dirname(host_log_path))
+          File.write(host_log_path, Docker::Command.execute("logs #{name}", mask_secrets: @secrets))
+        rescue Support::ShellCommand::StatusError, SystemCallError => e
+          Runtime::Logger.warn("Unable to capture logs from #{name}: #{e.message}")
+        end
+      end
+    end
+  end
+end

data/lib/gitlab/qa/scenario/test/integration/ai_gateway_base.rb

@@ -14,6 +14,10 @@ module Gitlab
               @ai_gateway_name = 'ai-gateway'
               @ai_gateway_hostname = "#{@ai_gateway_name}.#{@network}"
               @ai_gateway_port = 5000
+              @dws_name = 'duo-workflow-service'
+              @dws_hostname = "#{@dws_name}.#{@network}"
+              @dws_port = Component::DuoWorkflowService::GRPC_PORT
+              @boot_duo_workflow_service = false
               @use_cloud_license = true
               @has_add_on = true
               @assign_seats = true
@@ -27,15 +31,31 @@ module Gitlab
                   set_up_ai_gateway(ai_gateway, gitlab_hostname: gitlab.hostname)
 
                   ai_gateway.instance do
-                    gitlab.instance do
-                      set_up_gitlab_duo(gitlab) if @use_cloud_license
-                      run_specs(gitlab, *rspec_args)
+                    with_duo_workflow_service(gitlab_hostname: gitlab.hostname) do
+                      gitlab.instance do
+                        set_up_gitlab_duo(gitlab) if @use_cloud_license
+                        run_specs(gitlab, *rspec_args)
+                      end
                     end
                   end
                 end
               end
             end
 
+            # Boots the agentic-mock Duo Workflow Service alongside the AI Gateway and runs the
+            # given block inside it. When @boot_duo_workflow_service is false (the default for
+            # AiGateway and the No*/NoLicense variants) it is a no-op passthrough, so only the
+            # DuoAgentPlatform scenario has the extra gRPC container.
+            def with_duo_workflow_service(gitlab_hostname:, &block)
+              return yield unless @boot_duo_workflow_service
+
+              Component::DuoWorkflowService.perform do |dws|
+                set_up_duo_workflow_service(dws, gitlab_hostname: gitlab_hostname)
+
+                dws.instance(&block)
+              end
+            end
+
             def set_up_gitlab(gitlab, release)
               gitlab.release = QA::Release.new(release)
               gitlab.name = 'gitlab'
@@ -44,6 +64,15 @@ module Gitlab
               gitlab.omnibus_gitlab_rails_env['AI_GATEWAY_URL'] = "http://#{@ai_gateway_hostname}:#{@ai_gateway_port}"
               gitlab.omnibus_gitlab_rails_env['LLM_DEBUG'] = 'true'
 
+              if @boot_duo_workflow_service
+                # Point the foundational-flow path at the in-network agentic-mock DWS, plaintext.
+                # These are read by config/initializers/1_settings.rb (duo_workflow.service_url /
+                # .secure); the value is a bare gRPC host:port (no scheme), and 'false' is parsed
+                # via Gitlab::Utils.to_boolean.
+                gitlab.omnibus_gitlab_rails_env['GITLAB_DUO_WORKFLOW_SERVICE_URL'] = "#{@dws_hostname}:#{@dws_port}"
+                gitlab.omnibus_gitlab_rails_env['GITLAB_DUO_WORKFLOW_SECURE'] = 'false'
+              end
+
               gitlab.set_ee_activation_code if @use_cloud_license
             end
 
@@ -55,6 +84,14 @@ module Gitlab
               ai_gateway.configure_environment(gitlab_hostname: gitlab_hostname)
             end
 
+            def set_up_duo_workflow_service(dws, gitlab_hostname:)
+              dws.name = @dws_name
+              dws.network = @network
+              dws.ports = [@dws_port]
+
+              dws.configure_environment(gitlab_hostname: gitlab_hostname)
+            end
+
             def set_up_gitlab_duo(gitlab)
               Runtime::Logger.info('Setting up Gitlab Duo on GitLab instance')
 

data/lib/gitlab/qa/scenario/test/integration/duo_agent_platform.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module QA
+    module Scenario
+      module Test
+        module Integration
+          # Duo Agent Platform foundational-flow smoke scenario. Reuses the AiGateway scenario's
+          # setup (EE omnibus GitLab + mock AI Gateway) and additionally boots the agentic-mock
+          # Duo Workflow Service, running under its own tag so the foundational flow gets a
+          # dedicated omnibus job, separate from the ai-gateway job (Duo Chat / Code Suggestions).
+          class DuoAgentPlatform < AiGateway
+            def initialize
+              super
+              @tag = 'duo_agent_platform'
+              # Only the DAP foundational flow needs the Duo Workflow Service; the ai-gateway
+              # job (Duo Chat / Code Suggestions) does not, so boot DWS here rather than on the
+              # base AiGateway scenario.
+              @boot_duo_workflow_service = true
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/gitlab/qa/version.rb

@@ -2,6 +2,6 @@
 
 module Gitlab
   module QA
-    VERSION = '15.7.2'
+    VERSION = '15.8.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-qa
 version: !ruby/object:Gem::Version
-  version: 15.7.2
+  version: 15.8.0
 platform: ruby
 authors:
 - GitLab Quality
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-04-16 00:00:00.000000000 Z
+date: 2026-07-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: climate_control
@@ -403,6 +403,7 @@ files:
 - lib/gitlab/qa/component/alpine.rb
 - lib/gitlab/qa/component/base.rb
 - lib/gitlab/qa/component/chaos.rb
+- lib/gitlab/qa/component/duo_workflow_service.rb
 - lib/gitlab/qa/component/elasticsearch.rb
 - lib/gitlab/qa/component/gitaly.rb
 - lib/gitlab/qa/component/gitaly_cluster.rb
@@ -470,6 +471,7 @@ files:
 - lib/gitlab/qa/scenario/test/integration/chaos.rb
 - lib/gitlab/qa/scenario/test/integration/client_ssl.rb
 - lib/gitlab/qa/scenario/test/integration/continuous_vulnerability_scanning.rb
+- lib/gitlab/qa/scenario/test/integration/duo_agent_platform.rb
 - lib/gitlab/qa/scenario/test/integration/elasticsearch.rb
 - lib/gitlab/qa/scenario/test/integration/geo.rb
 - lib/gitlab/qa/scenario/test/integration/gitaly_cluster.rb
@@ -484,7 +486,6 @@ files:
 - lib/gitlab/qa/scenario/test/integration/ldap_no_server.rb
 - lib/gitlab/qa/scenario/test/integration/ldap_no_tls.rb
 - lib/gitlab/qa/scenario/test/integration/ldap_tls.rb
-- lib/gitlab/qa/scenario/test/integration/mattermost.rb
 - lib/gitlab/qa/scenario/test/integration/metrics.rb
 - lib/gitlab/qa/scenario/test/integration/mtls.rb
 - lib/gitlab/qa/scenario/test/integration/opensearch.rb

data/lib/gitlab/qa/scenario/test/integration/mattermost.rb

@@ -1,41 +0,0 @@
-# frozen_string_literal: true
-
-module Gitlab
-  module QA
-    module Scenario
-      module Test
-        module Integration
-          class Mattermost < Scenario::Template
-            def perform(release, *rspec_args)
-              Component::Gitlab.perform do |gitlab|
-                gitlab.release = release
-                gitlab.network = Runtime::Env.docker_network
-
-                mattermost_hostname = "mattermost.#{gitlab.network}"
-                mattermost_external_url = "http://#{mattermost_hostname}"
-
-                gitlab.add_network_alias(mattermost_hostname)
-                gitlab.omnibus_configuration << <<~OMNIBUS
-                  mattermost_external_url '#{mattermost_external_url}';
-                OMNIBUS
-
-                gitlab.instance do
-                  Component::Specs.perform do |specs|
-                    specs.suite = 'Test::Integration::Mattermost'
-                    specs.release = gitlab.release
-                    specs.network = gitlab.network
-                    specs.args = [
-                      gitlab.address,
-                      "--mattermost-address", mattermost_external_url,
-                      *rspec_args
-                    ]
-                  end
-                end
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end