feat: automatic nix testing of codeblocks

.github/e2e/docker-compose.yml

@@ -0,0 +1,119 @@
+services:
+  postgresql:
+    image: ghcr.io/l3montree-dev/devguard/postgresql:v1.4.2
+    shm_size: 1g
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: change-me-definitely-when-not-testing
+      POSTGRES_DB: devguard
+    healthcheck:
+      test: ["CMD", "pg_isready", "-U", "postgres"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    volumes:
+      - postgres:/var/lib/postgresql/data
+      - ./initdb.sql:/docker-entrypoint-initdb.d/init.sql
+    tmpfs: /run/postgresql:rw,uid=999,gid=999
+
+  kratos-migrate:
+    image: oryd/kratos:v25.4.0-distroless@sha256:368667ee3713797f86ddec669c36751f6484c7d675c78fd27c795b2e79271c31
+    depends_on:
+      postgresql:
+        condition: service_healthy
+    environment:
+      - DSN=postgres://kratos:change-me-definitely-when-not-testing@postgresql:5432/kratos?sslmode=disable
+    volumes:
+      - type: bind
+        source: ./kratos
+        target: /etc/config/kratos
+    command: -c /etc/config/kratos/kratos.yml migrate sql -e --yes
+
+  kratos:
+    image: oryd/kratos:v25.4.0-distroless@sha256:368667ee3713797f86ddec669c36751f6484c7d675c78fd27c795b2e79271c31
+    depends_on:
+      postgresql:
+        condition: service_healthy
+      kratos-migrate:
+        condition: service_completed_successfully
+    ports:
+      - "4433:4433"
+      - "4434:4434"
+    environment:
+      - DSN=postgres://kratos:change-me-definitely-when-not-testing@postgresql:5432/kratos?sslmode=disable
+      - LOG_LEVEL=debug
+    volumes:
+      - type: bind
+        source: ./kratos
+        target: /etc/config/kratos
+    command: serve -c /etc/config/kratos/kratos.yml --dev --watch-courier
+
+  devguard-migrate:
+    image: ghcr.io/l3montree-dev/devguard:main
+    tmpfs:
+      - /tmp:size=1G
+    depends_on:
+      postgresql:
+        condition: service_healthy
+    environment:
+      - POSTGRES_USER=postgres
+      - POSTGRES_PASSWORD=change-me-definitely-when-not-testing
+      - POSTGRES_DB=devguard
+      - POSTGRES_HOST=postgresql
+      - POSTGRES_PORT=5432
+      - FRONTEND_URL=http://localhost:3000
+    command: ["devguard-cli", "migrate"]
+
+  devguard-vulndb-import:
+    image: ghcr.io/l3montree-dev/devguard:main
+    tmpfs:
+      - /tmp:size=4G
+    depends_on:
+      postgresql:
+        condition: service_healthy
+      devguard-migrate:
+        condition: service_completed_successfully
+    environment:
+      - POSTGRES_USER=postgres
+      - POSTGRES_PASSWORD=change-me-definitely-when-not-testing
+      - POSTGRES_DB=devguard
+      - POSTGRES_HOST=postgresql
+      - POSTGRES_PORT=5432
+      - FRONTEND_URL=http://localhost:3000
+    command: ["devguard-cli", "vulndb", "import"]
+
+  devguard-api:
+    image: ghcr.io/l3montree-dev/devguard:main
+    volumes:
+      - type: bind
+        source: ./test-secret.pem
+        target: /test-secret.pem
+    tmpfs:
+      - /tmp:size=1G
+    depends_on:
+      postgresql:
+        condition: service_healthy
+      kratos:
+        condition: service_started
+      devguard-migrate:
+        condition: service_completed_successfully
+      devguard-vulndb-import:
+        condition: service_completed_successfully
+    ports:
+      - "8080:8080"
+    environment:
+      - POSTGRES_USER=postgres
+      - POSTGRES_PASSWORD=change-me-definitely-when-not-testing
+      - POSTGRES_DB=devguard
+      - POSTGRES_HOST=postgresql
+      - POSTGRES_PORT=5432
+      - ORY_KRATOS_PUBLIC=http://kratos:4433
+      - ORY_KRATOS_ADMIN=http://kratos:4434
+      - INSTANCE_DOMAIN=http://localhost:8080
+      - FRONTEND_URL=http://localhost:3000
+      - ENVIRONMENT=dev
+      - CSAF_PASSPHRASE=ci-test-passphrase
+      - APP_SIDE_ENCRYPTION_KEY_PATH=/test-secret.pem
+
+volumes:
+  postgres:

.github/e2e/initdb.sql

@@ -0,0 +1,9 @@
+CREATE EXTENSION IF NOT EXISTS semver;
+
+CREATE DATABASE kratos;
+CREATE USER kratos PASSWORD 'change-me-definitely-when-not-testing';
+GRANT ALL PRIVILEGES ON DATABASE kratos to kratos;
+
+\c kratos
+
+GRANT USAGE, CREATE ON SCHEMA public TO kratos;

.github/e2e/kratos/gh-mapping.jsonnet

@@ -0,0 +1,29 @@
+local claims = {
+  email_verified: false,
+} + std.extVar('claims');
+
+local stringOrNull(v) =
+  if v != null && std.type(v) == 'string' && v != '' then v else null;
+
+local firstNonNull(values) =
+  if std.length(values) == 0 then null
+  else if values[0] != null then values[0]
+  else firstNonNull(values[1:]);
+
+{
+  identity: {
+    traits: {
+      [if 'email' in claims && claims.email_verified then 'email' else null]: claims.email,
+      name: firstNonNull([
+        if 'name' in claims then stringOrNull(claims.name) else null,
+        if 'preferred_username' in claims then stringOrNull(claims.preferred_username) else null,
+        if 'login' in claims then stringOrNull(claims.login) else null,
+        if 'username' in claims then stringOrNull(claims.username) else null,
+        if 'nickname' in claims then stringOrNull(claims.nickname) else null,
+        if 'sub' in claims then stringOrNull(claims.sub) else null,
+        'unknown',
+      ]),
+      confirmedTerms: true,
+    },
+  },
+}

.github/e2e/kratos/identity.schema.json

@@ -0,0 +1,55 @@
+{
+    "$id": "https://schemas.ory.sh/presets/kratos/quickstart/email-password/identity.schema.json",
+    "$schema": "http://json-schema.org/draft-07/schema#",
+    "title": "Person",
+    "type": "object",
+    "properties": {
+        "traits": {
+            "required": [
+                "email",
+                "name",
+                "confirmedTerms"
+            ],
+            "additionalProperties": false,
+            "type": "object",
+            "properties": {
+                "email": {
+                    "type": "string",
+                    "format": "email",
+                    "title": "E-Mail",
+                    "minLength": 3,
+                    "ory.sh/kratos": {
+                        "credentials": {
+                            "password": {
+                                "identifier": true
+                            },
+                            "passkey": {
+                                "display_name": true
+                            },
+                            "webauthn": {
+                                "identifier": true
+                            }
+                        },
+                        "verification": {
+                            "via": "email"
+                        },
+                        "recovery": {
+                            "via": "email"
+                        }
+                    }
+                },
+                "name": {
+                    "type": "string",
+                    "title": "Username"
+                },
+                "confirmedTerms": {
+                    "type": "boolean",
+                    "title": "I agree to the terms of use ",
+                    "description": "You must agree to the terms of use to use this service.",
+                    "default": false,
+                    "const": true
+                }
+            }
+        }
+    }
+}

.github/e2e/kratos/kratos.yml

@@ -0,0 +1,114 @@
+version: v0.13.0
+
+dsn: memory
+
+session:
+  cookie:
+    name: ory_kratos_session
+
+serve:
+  public:
+    base_url: http://localhost:4433/
+    cors:
+      enabled: true
+  admin:
+    base_url: http://localhost:4434/
+
+selfservice:
+  default_browser_return_url: http://localhost:3000/
+  allowed_return_urls:
+  - http://localhost:3000
+  methods:
+    password:
+      enabled: true
+    totp:
+      config:
+        issuer: Kratos
+      enabled: true
+    lookup_secret:
+      enabled: true
+    link:
+      enabled: true
+    code:
+      enabled: true
+    passkey:
+      enabled: true
+      config:
+        rp:
+          id: localhost:3000
+          origins:
+          - http://localhost:3000
+          display_name: DevGuard
+  flows:
+    error:
+      ui_url: http://localhost:3000/error
+
+    settings:
+      ui_url: http://localhost:3000/user-settings
+      privileged_session_max_age: 15m
+      required_aal: highest_available
+
+    recovery:
+      enabled: true
+      ui_url: http://localhost:3000/recovery
+      use: code
+
+    verification:
+      enabled: true
+      ui_url: http://localhost:3000/verification
+      use: code
+      after:
+        default_browser_return_url: http://localhost:3000/
+
+    logout:
+      after:
+        default_browser_return_url: http://localhost:3000/login
+
+    login:
+      ui_url: http://localhost:3000/login
+      lifespan: 10m
+
+    registration:
+      lifespan: 10m
+      ui_url: http://localhost:3000/registration
+      after:
+        password:
+          hooks:
+          - hook: session
+        passkey:
+          hooks:
+          - hook: session
+        oidc:
+          hooks:
+          - hook: session
+
+log:
+  level: debug
+  format: text
+  leak_sensitive_values: true
+
+secrets:
+  cookie:
+  - PLEASE-CHANGE-ME-I-AM-VERY-INSECURE
+  cipher:
+  - 32-LONG-SECRET-NOT-SECURE-AT-ALL
+
+ciphers:
+  algorithm: xchacha20-poly1305
+
+hashers:
+  algorithm: bcrypt
+  bcrypt:
+    cost: 8
+
+identity:
+  default_schema_id: default
+  schemas:
+  - id: default
+    url: file:///etc/config/kratos/identity.schema.json
+
+courier:
+  smtp:
+    connection_uri: smtps://test:test@localhost:1025/?skip_ssl_verify=true
+    from_address: noreply@devguard.org
+    from_name: DevGuard