test(cloud): add staging smoke test for recce-cloud upload by even-wei · Pull Request #1114 · DataRecce/recce

even-wei · 2026-02-11T06:48:05Z

PR checklist

Ensure you have added or ran the appropriate tests for your PR.
DCO signed

What type of PR is this?

Test / CI

What this PR does / why we need it:

Adds an E2E smoke test for recce-cloud upload against the staging server, covering all testable authentication flows:

Test	Flow	Auth
1. GitHub PR Upload	`GITHUB_TOKEN` → platform-specific endpoint	Platform (GitHub API verify)
2. GitHub Prod Upload	`GITHUB_TOKEN` + `--type prod`	Platform
3. RECCE_API_TOKEN PR Upload	`RECCE_API_TOKEN` → generic endpoint	DB lookup
4. RECCE_API_TOKEN Prod Upload	`RECCE_API_TOKEN` + `--type prod`	DB lookup

Key design decisions:

Static fixtures — no dbt build needed (server stores files as-is)
env -u RECCE_API_TOKEN for GitHub flow isolation (CLI Priority 1 = API token)
Graceful degradation — tests 3-4 skip if SMOKE_TEST_API_TOKEN not set
Cleanup via GITHUB_TOKEN — delete auto-detect uses platform token regardless

Also removes the obsolete Recce State file operations (download/purge/upload) from the existing dbt cloud smoke test.

Secrets required

Secret	Status
`RECCE_CLOUD_TOKEN`	Already exists
`SMOKE_TEST_GITHUB_REPO`	Needs to be added
`SMOKE_TEST_API_TOKEN`	Needs to be created (optional — tests 3-4 skip without it)

Which issue(s) this PR fixes:

N/A — new test coverage

Special notes for your reviewer:

The workflow triggers on changes to recce_cloud/** and integration_tests/recce_cloud/**. It will not run until SMOKE_TEST_GITHUB_REPO is added as a repository secret.

Does this PR introduce a user-facing change?:

NONE

E2E test covering GitHub and RECCE_API_TOKEN upload flows against the staging server. Uses static dbt fixtures (no dbt build needed) and a cleanup trap to delete PR sessions after each run. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: even-wei <evenwei@infuseai.io>

The recce state download/upload/purge tests are no longer needed — state file workflows are separate from the artifact pipeline tested here. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: even-wei <evenwei@infuseai.io>

Remove SMOKE_TEST_GITHUB_REPO secret in favor of hardcoded repo name. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: even-wei <evenwei@infuseai.io>

Tests 5-6 cover the --session-name (dev session) and --session-id upload flows. Test 6 reuses the session created by test 5. Both require SMOKE_TEST_API_TOKEN + SMOKE_TEST_ORG + SMOKE_TEST_PROJECT. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: even-wei <evenwei@infuseai.io>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: even-wei <evenwei@infuseai.io>

uv sync at the repo root doesn't install the recce_cloud workspace member's entry point. Install from recce_cloud/ like tests-recce-cloud workflow does. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: even-wei <evenwei@infuseai.io>

Match the pattern from tests-recce-cloud.yaml — let uv manage the venv and PATH instead of manually activating. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: even-wei <evenwei@infuseai.io>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: even-wei <evenwei@infuseai.io>

Copilot

Pull request overview

Adds a new GitHub Actions workflow + shell-based E2E smoke test to validate recce-cloud upload against the staging Recce Cloud server, and simplifies the existing dbt cloud smoke test by removing obsolete Recce state operations.

Changes:

Add integration_tests/recce_cloud/smoke_test_upload.sh to exercise upload flows (GitHub token, API token, session-name/session-id).
Add minimal static dbt artifact fixtures (manifest.json, catalog.json) to avoid running dbt build for this test.
Add a new CI workflow .github/workflows/upload-smoke-test.yaml and remove obsolete recce cloud download/purge/upload steps from integration_tests/dbt/smoke_test_cloud.sh.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`integration_tests/recce_cloud/smoke_test_upload.sh`	New staging smoke-test script covering multiple auth/session upload flows.
`integration_tests/recce_cloud/fixtures/minimal-target/manifest.json`	Minimal dbt manifest fixture for upload tests.
`integration_tests/recce_cloud/fixtures/minimal-target/catalog.json`	Minimal dbt catalog fixture for upload tests.
`integration_tests/dbt/smoke_test_cloud.sh`	Removes obsolete Recce state operations from existing cloud smoke test.
`.github/workflows/upload-smoke-test.yaml`	New workflow to run the upload smoke test in CI with authorization gating.

Copilot · 2026-03-09T07:47:02Z

integration_tests/recce_cloud/smoke_test_upload.sh

+SMOKE_TEST_GITHUB_REPO="DataRecce/recce-smoke-test"
+TEST_BRANCH="smoke-test-upload-$(date +%s)"
+DEV_SESSION_NAME="smoke-test-dev-$(date +%s)"


SMOKE_TEST_GITHUB_REPO is hard-coded here, but the PR description says the workflow requires a SMOKE_TEST_GITHUB_REPO secret/config. If this should be configurable, read it from an env var (with this value as a default) and pass it from the workflow; otherwise, update the PR description to match the implementation.

Copilot · 2026-03-09T07:47:02Z

.github/workflows/upload-smoke-test.yaml

+        run: uv run ../integration_tests/recce_cloud/smoke_test_upload.sh
+        env:
+          GITHUB_TOKEN: ${{ secrets.RECCE_CLOUD_TOKEN }}
+          SMOKE_TEST_API_TOKEN: ${{ secrets.SMOKE_TEST_API_TOKEN }}
+          SMOKE_TEST_ORG: ${{ secrets.SMOKE_TEST_ORG }}
+          SMOKE_TEST_PROJECT: ${{ secrets.SMOKE_TEST_PROJECT }}


The PR description mentions a required SMOKE_TEST_GITHUB_REPO secret, but this workflow doesn't pass it to the smoke test script. If the repo should be configurable, add SMOKE_TEST_GITHUB_REPO: ${{ secrets.SMOKE_TEST_GITHUB_REPO }} (or a repo variable) to env: and ensure the script reads it.

Copilot · 2026-03-09T07:47:03Z

integration_tests/recce_cloud/smoke_test_upload.sh

+echo "Test branch:  $TEST_BRANCH"
+echo "Fixtures:     $FIXTURES_DIR"
+echo "API host:     $RECCE_CLOUD_API_HOST"
+echo "API token:    ${SMOKE_TEST_API_TOKEN:+set}${SMOKE_TEST_API_TOKEN:-not set}"


The line that prints API token will output the full value of SMOKE_TEST_API_TOKEN into the CI logs, exposing a live Recce API token to anyone with log access. An attacker who can read these logs can reuse the token to authenticate against the staging Recce Cloud API and potentially escalate if tokens are reused or misconfigured. Update this output to only indicate whether the token is set (or print a masked value) instead of echoing the raw secret.

Suggested change

echo "API token: ${SMOKE_TEST_API_TOKEN:+set}${SMOKE_TEST_API_TOKEN:-not set}"

echo "API token: $( if [[ -n ${SMOKE_TEST_API_TOKEN:-} ]]; then echo 'set'; else echo 'not set'; fi )"

even-wei and others added 10 commits February 11, 2026 14:41

test(cloud): hardcode DataRecce/recce-smoke-test as test target

897c0ad

Remove SMOKE_TEST_GITHUB_REPO secret in favor of hardcoded repo name. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: even-wei <evenwei@infuseai.io>

Merge branch 'main' into feature/upload-smoke-test

2da709a

test(cloud): use staging API host as default

27245a8

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: even-wei <evenwei@infuseai.io>

fix(ci): use uv run to invoke smoke test script

997c2ee

Match the pattern from tests-recce-cloud.yaml — let uv manage the venv and PATH instead of manually activating. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: even-wei <evenwei@infuseai.io>

test(cloud): use real PR #1 from recce-smoke-test repo

368dd28

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: even-wei <evenwei@infuseai.io>

Merge branch 'main' into feature/upload-smoke-test

a37992e

gcko requested a review from Copilot March 9, 2026 07:42

gcko assigned even-wei and unassigned even-wei Mar 9, 2026

Copilot started reviewing on behalf of gcko March 9, 2026 07:42 View session

Copilot AI reviewed Mar 9, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

test(cloud): add staging smoke test for recce-cloud upload#1114

test(cloud): add staging smoke test for recce-cloud upload#1114
even-wei wants to merge 10 commits intomainfrom
feature/upload-smoke-test

even-wei commented Feb 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	echo "API token: ${SMOKE_TEST_API_TOKEN:+set}${SMOKE_TEST_API_TOKEN:-not set}"
	echo "API token: $( if [[ -n ${SMOKE_TEST_API_TOKEN:-} ]]; then echo 'set'; else echo 'not set'; fi )"

Conversation

even-wei commented Feb 11, 2026

Secrets required

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants