Extract backend tests workflow and remove docker layer by ahmedxgouda · Pull Request #4635 · OWASP/Nest

ahmedxgouda · 2026-05-10T13:02:03Z

Proposed change

Resolves #4634

Extracted backend tests workflow and removed docker layer

Checklist

Required: I followed the contributing workflow
Required: I verified that my code works as intended and resolves the issue as described
Required: I ran make check-test locally: all warnings addressed, tests passed
I used AI for code, documentation, tests, or communication related to this PR

coderabbitai · 2026-05-10T13:02:17Z

Summary by CodeRabbit

Chores
- Refactored internal CI/CD pipeline infrastructure to improve maintainability and reduce code duplication in automated testing processes.

Walkthrough

Extracts backend test steps into a reusable run-backend-tests workflow that installs Poetry, caches dependencies and virtualenv, runs unit tests after sourcing .env.example, uploads coverage, and updates the main CI job to call this workflow.

Changes

Backend Tests Workflow Extraction

Layer / File(s)	Summary
Reusable Workflow Definition `.github/workflows/run-backend-tests.yaml`	New `workflow_call` workflow adding `run-unit-tests` (checkout, install Poetry, setup Python 3.13 with caching keyed to `backend/poetry.lock`, cache `backend/.venv`, `poetry install --no-interaction`, `poetry run pytest tests/unit` after sourcing `.env.example`, upload `backend/coverage.xml` as `coverage-xml`) and `upload-coverage-to-codecov` job (downloads artifact, uploads to Codecov with `use_oidc: true`, `fail_ci_if_error: false`). Both jobs set job-level permissions and 5-minute timeouts.
Workflow Integration `.github/workflows/run-ci-cd.yaml`	`run-backend-tests` job refactored from inline Docker-based steps to `uses: ./.github/workflows/run-backend-tests.yaml` and now sets `permissions` for `actions`, `contents`, and `id-token`.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

OWASP/Nest#4623: Refactors CI by extracting inline jobs into reusable workflows and updates run-ci-cd.yaml job wiring.

Suggested labels

backend, docker

Suggested reviewers

arkid15r
kasya

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title clearly and specifically summarizes the main changes: extracting the backend tests workflow and removing the Docker layer, which are the primary objectives.
Description check	✅ Passed	The PR description is directly related to the changeset, explaining the extraction of the backend tests workflow and removal of the Docker layer, referencing issue `#4634`.
Linked Issues check	✅ Passed	The PR successfully implements both requirements from issue `#4634`: extracting the backend tests workflow into a separate file (.github/workflows/run-backend-tests.yaml) and removing the Docker layer by running tests directly with Poetry.
Out of Scope Changes check	✅ Passed	All changes are directly aligned with the linked issue objectives; modifications only involve workflow extraction and Docker removal without introducing unrelated changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

Generate code and open pull requests
Plan features and break down work
Investigate incidents and troubleshoot customer tickets together
Automate recurring tasks and respond to alerts with triggers
Summarize progress and report instantly

Built for teams:

Shared memory across your entire org—no repeating context
Per-thread sandboxes to safely plan and execute work
Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

cubic-dev-ai

1 issue found across 2 files

Confidence score: 2/5

There is a high-confidence, high-severity CI risk in .github/workflows/run-ci-cd.yaml: run-backend-tests is called without job-level permissions while top-level permissions: {} is set.
This can block the reusable workflow from getting required contents: read and id-token: write scopes, making backend test execution and related pipeline steps likely to fail.
Given the concrete misconfiguration and likely pipeline regression, this is higher merge risk until permissions are explicitly set on the job call.
Pay close attention to .github/workflows/run-ci-cd.yaml - missing job-level permissions can prevent the called workflow from obtaining required scopes.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/run-ci-cd.yaml">

<violation number="1" location=".github/workflows/run-ci-cd.yaml:38">
P1: The reusable `run-backend-tests` call is missing job-level `permissions`, so with top-level `permissions: {}` the called workflow cannot obtain its required `contents: read` and `id-token: write` scopes.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

codecov · 2026-05-10T13:07:00Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.92%. Comparing base (d373f32) to head (f02178f).

Additional details and impacted files

@@                     Coverage Diff                     @@
##           feature/ci-cd-optimization    #4635   +/-   ##
===========================================================
  Coverage                       98.92%   98.92%           
===========================================================
  Files                             528      528           
  Lines                           16968    16968           
  Branches                         2416     2416           
===========================================================
  Hits                            16785    16785           
  Misses                             98       98           
  Partials                           85       85

Flag	Coverage Δ
frontend	`97.28% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d373f32...f02178f. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

cubic-dev-ai

0 issues found across 2 files (changes from recent commits).

cubic-dev-ai

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/run-backend-tests.yaml">

<violation number="1" location=".github/workflows/run-backend-tests.yaml:36">
P2: The cache path points to the wrong directory. Poetry creates the venv in `backend/.venv`, so caching `./.venv` won’t cache the environment used by tests.</violation>
</file>

_{Tip: Review your code locally with the cubic CLI to iterate faster.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/run-backend-tests.yaml:
- Line 44: The workflow contains an unused command "touch
.venv/dependencies_installed" which creates a file never referenced later;
remove that line from the run-backend-tests.yaml job to clean up dead code
(search for the exact string "touch .venv/dependencies_installed" and delete the
command).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0835ca37-82c9-449c-b787-a3b1261d2190

📥 Commits

Reviewing files that changed from the base of the PR and between 5fb5e82 and a81f78c.

📒 Files selected for processing (2)

.github/workflows/run-backend-tests.yaml
.github/workflows/run-ci-cd.yaml

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

The merge-base changed after approval.

sonarqubecloud · 2026-05-12T15:55:58Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/run-backend-tests.yaml:
- Line 23: Replace the unpinned pipx install poetry invocation with a pinned
install using a specific Poetry version (i.e., change the plain "pipx install
poetry" invocation to a fixed-version invocation such as pipx install
poetry==<version>), and make the same change for the identical pipx install line
present in the other CI workflow files so all workflows use the same
deterministic Poetry version.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1cdf832e-63f1-4ae3-9757-d5ff21fae2b8

📥 Commits

Reviewing files that changed from the base of the PR and between 9863bfe and f02178f.

📒 Files selected for processing (2)

.github/workflows/run-backend-tests.yaml
.github/workflows/run-ci-cd.yaml

ahmedxgouda · 2026-05-12T16:09:36Z

@arkid15r Updates are merged now.

Extract backend tests workflow and remove docker layer

0e69ab8

github-actions Bot added the ci label May 10, 2026

Add permissions

8521207

cubic-dev-ai Bot previously approved these changes May 10, 2026

View reviewed changes

cubic-dev-ai Bot reviewed May 10, 2026

View reviewed changes

Comment thread .github/workflows/run-ci-cd.yaml

Add FORCE_COLOR env

dbbdf18

ahmedxgouda dismissed cubic-dev-ai[bot]’s stale review via dbbdf18 May 10, 2026 13:07

coderabbitai Bot previously approved these changes May 10, 2026

View reviewed changes

cubic-dev-ai Bot previously approved these changes May 10, 2026

View reviewed changes

Fix ordering

a7d3511

ahmedxgouda dismissed stale reviews from cubic-dev-ai[bot] and coderabbitai[bot] via a7d3511 May 10, 2026 13:18

cubic-dev-ai Bot previously approved these changes May 10, 2026

View reviewed changes

ahmedxgouda marked this pull request as ready for review May 10, 2026 13:20

ahmedxgouda requested review from arkid15r and kasya as code owners May 10, 2026 13:20

arkid15r requested changes May 10, 2026

View reviewed changes

Comment thread .github/workflows/run-backend-tests.yaml

Comment thread .github/workflows/run-backend-tests.yaml Outdated

Comment thread .github/workflows/run-backend-tests.yaml

Optimize dependecies installation

761f6dc

ahmedxgouda dismissed cubic-dev-ai[bot]’s stale review via 761f6dc May 11, 2026 16:45

cubic-dev-ai Bot reviewed May 11, 2026

View reviewed changes

Comment thread .github/workflows/run-backend-tests.yaml Outdated

Update cache path and comments identation

a81f78c

coderabbitai Bot requested changes May 11, 2026

View reviewed changes

Comment thread .github/workflows/run-backend-tests.yaml Outdated

cubic-dev-ai Bot previously approved these changes May 11, 2026

View reviewed changes

Remove dead code

1caef9a

ahmedxgouda dismissed cubic-dev-ai[bot]’s stale review via 1caef9a May 11, 2026 17:18

cubic-dev-ai Bot previously approved these changes May 11, 2026

View reviewed changes

ahmedxgouda requested review from Wandji69 and arkid15r May 11, 2026 17:22

coderabbitai Bot previously approved these changes May 11, 2026

View reviewed changes

Update code

9863bfe

arkid15r dismissed stale reviews from coderabbitai[bot] and cubic-dev-ai[bot] via 9863bfe May 11, 2026 19:37

coderabbitai Bot previously approved these changes May 11, 2026

View reviewed changes

cubic-dev-ai Bot previously approved these changes May 11, 2026

View reviewed changes

Update permissions

131671a

arkid15r dismissed stale reviews from cubic-dev-ai[bot] and coderabbitai[bot] via 131671a May 11, 2026 20:28

cubic-dev-ai Bot previously approved these changes May 11, 2026

View reviewed changes

arkid15r force-pushed the feature/ci-cd-optimization branch 2 times, most recently from a038c90 to 5fb5e82 Compare May 12, 2026 01:09

Merge branch 'feature/ci-cd-optimization' into ci/backend-tests

f02178f

coderabbitai Bot requested changes May 12, 2026

View reviewed changes

Comment thread .github/workflows/run-backend-tests.yaml

coderabbitai Bot approved these changes May 12, 2026

View reviewed changes

arkid15r merged commit f9ac93a into OWASP:feature/ci-cd-optimization May 12, 2026
39 checks passed

This was referenced May 12, 2026

Remove docker layer from fuzz tests workflow #4663

Merged

Extract codecov upload into a separate workflow #4668

Merged

ahmedxgouda added the gsoc2026:ahmedxgouda ahmedxgouda's GSoC 2026 related work label May 14, 2026

ahmedxgouda deleted the ci/backend-tests branch May 18, 2026 14:38

coderabbitai Bot mentioned this pull request Jun 1, 2026

Extract run-lighthouse-ci into a separate reusable workflow #4807

Merged

4 tasks

Uh oh!

Conversation

ahmedxgouda commented May 10, 2026

Proposed change

Checklist

Uh oh!

coderabbitai Bot commented May 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov Bot commented May 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented May 12, 2026

Quality Gate passed

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ahmedxgouda commented May 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented May 10, 2026 •

edited

Loading

codecov Bot commented May 10, 2026 •

edited

Loading