SnapOtter/docker/docker-compose.test.yml

###############################################################################
# Test infrastructure - run with:
#   docker compose -f docker/docker-compose.test.yml up --build --abort-on-container-exit
###############################################################################
name: snapotter-test
services:
  # ── Unit + Integration tests ─────────────────────────────────────────────
  test-unit:
    build:
      context: ..
      dockerfile: docker/Dockerfile.test
    container_name: SnapOtter-test-unit
    # Functional gate: run the suite without --coverage. The lean test image
    # skips binary-gated tools (AI models need on-demand bundles, etc.), so it
    # cannot meet the host-calibrated coverage thresholds; coverage stays
    # enforced on host CI where every tool is present.
    #
    # Repo-audit specs are excluded: they audit the git checkout and dev host,
    # not the running product. Dockerfile.test.dockerignore prunes *.md and
    # .git, and /tmp is a noexec tmpfs, so in this image they can only report
    # the build context's own stripping (missing DOCKERHUB.md / CONTRIBUTING.md
    # / third-party notices, no `git ls-files`, a non-executable fake binary).
    # Host CI runs all of them on every PR.
    command:
      [
        "pnpm",
        "vitest",
        "run",
        "--reporter=verbose",
        "--exclude",
        "**/tests/unit/infra/public-tool-counts.test.ts",
        "--exclude",
        "**/tests/unit/infra/lint-coverage.test.ts",
        "--exclude",
        "**/tests/unit/infra/docs-dev-ports.test.ts",
        "--exclude",
        "**/tests/unit/scripts/check-production-licenses.test.ts",
        "--exclude",
        "**/tests/unit/helpers/run-generated-tool.test.ts",
      ]
    environment:
      - NODE_ENV=test
      - AUTH_ENABLED=true
      - DEFAULT_USERNAME=admin
      - DEFAULT_PASSWORD=admin
      - DATABASE_URL=postgres://snapotter:snapotter@postgres:5432/snapotter_test
      # Tells tests/global-setup.ts to use these servers instead of spawning
      # testcontainers (no docker daemon inside the test container).
      - TEST_DATABASE_URL=postgres://snapotter:snapotter@postgres:5432/snapotter_test
      - TEST_REDIS_URL=redis://redis:6379
      - REDIS_URL=redis://redis:6379
      - WORKSPACE_PATH=/tmp/test-workspace
      - MAX_MEGAPIXELS=100
      - RATE_LIMIT_PER_MIN=1000
      # The macOS Docker VM runs Sharp/FFmpeg ~2-3x slower than the host and
      # oversubscribes CPU across parallel vitest forks, so heavy ops (e.g. a
      # 12MP stress-image enhance) blow past the 30s test sync window and fall
      # back to a 202 that sync-asserting tests reject. Give the sync window
      # generous headroom (honored by tests/setup/per-fork-env.ts) and keep the
      # framework test/hook timeouts above it so a slow-but-correct job returns
      # 200 instead of tripping a vitest timeout. Host/CI keep the 30s defaults.
      - SYNC_WAIT_MS=120000
      - VITEST_TEST_TIMEOUT=180000
      - VITEST_HOOK_TIMEOUT=120000
      # One vitest fork bounds peak memory on a 7GB CI runner; the 90-minute
      # job budget absorbs the slower serial run.
      - VITEST_MAX_FORKS=1
    # No tmpfs: the tools write multi-megapixel encodes and video transcodes to
    # WORKSPACE_PATH and /tmp, and a RAM-backed mount made that scratch count
    # against the 7GB runner alongside the app, Postgres, and Redis, which
    # correlated with the runner being killed mid-run (exit 137). Sizing the
    # tmpfs instead just moved the failure to ENOSPC. Let scratch land on the
    # container's disk-backed layer, which has ample room once the job frees the
    # preinstalled toolchains.
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy

  # ── E2E tests (Playwright against full app) ─────────────────────────────
  test-e2e:
    build:
      context: ..
      dockerfile: docker/Dockerfile.test
    container_name: SnapOtter-test-e2e
    # Visual project is excluded: linux baselines are managed by the
    # update-visual-baselines workflow, not generated inside the container.
    command:
      [
        "sh",
        "-c",
        "npx playwright install --with-deps chromium && pnpm playwright test --project=chromium && pnpm playwright test --project=chromium-serial --workers=1",
      ]
    environment:
      - NODE_ENV=test
      - AUTH_ENABLED=true
      - DEFAULT_USERNAME=admin
      - DEFAULT_PASSWORD=admin
      - DATABASE_URL=postgres://snapotter:snapotter@postgres:5432/snapotter_test
      - REDIS_URL=redis://redis:6379
      - WORKSPACE_PATH=/tmp/test-workspace
      - MAX_MEGAPIXELS=100
      - RATE_LIMIT_PER_MIN=1000
      - CI=true
    tmpfs:
      - /tmp/test-workspace
      - /tmp
    depends_on:
      test-unit:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy

  postgres:
    image: postgres:17-alpine@sha256:742f40ea20b9ff2ff31db5458d127452988a2164df9e17441e191f3b72252193
    container_name: SnapOtter-test-postgres
    environment:
      POSTGRES_USER: snapotter
      POSTGRES_PASSWORD: snapotter
      POSTGRES_DB: snapotter_test
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U snapotter"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 15s
    tmpfs:
      - /var/lib/postgresql/data

  redis:
    image: redis:8-alpine@sha256:9d317178eceac8454a2284a9e6df2466b93c745529947f0cd42a0fa9609d7005
    container_name: SnapOtter-test-redis
    command: ["redis-server", "--maxmemory-policy", "noeviction", "--appendonly", "no"]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 10s
    tmpfs:
      - /data