Add GitHub Actions CI, nightly suite, and mocked-AWS CD pipeline

[devin-ai-integration]

Summary

Adds a standard GitHub Actions setup for this Selenium/TestNG harness. Since the repo is a test framework rather than a service, "deployment" here means building a container of the harness and shipping it to ECR/ECS plus publishing reports — all against mocked AWS identifiers.

• .github/workflows/ci.yml — push/PR to main: mvn -B verify -DskipTests, POM+plugin resolution, xmllint on the suite XMLs, then a headless-Chrome smoke run. Caches ~/.m2 via setup-java, uploads the jar, ExtentReports/**, target/surefire-reports/**, test-output/**.
• .github/workflows/nightly.yml — cron 30 2 * * * + workflow_dispatch (suite selectable), full suite, report artifacts, job summary.
• .github/workflows/cd.yml + Dockerfile + deploy/ecs-task-definition.json — build image → ECR push → ECS register-task-definition/run-task → S3 report sync, staging then production behind a GitHub Environment approval gate, OIDC-only auth.
• .github/dependabot.yml (maven / github-actions / docker), docs/CICD.md.

Toolchain matched to the repo: pom.xml targets 1.8 bytecode but Selenium 4.25 needs a JDK 11+ toolchain, so CI runs Temurin 21 (what this was validated on) while still compiling to 1.8. Surefire's default suite is overridden per-workflow with -Dsurefire.suiteXmlFiles=.

Suite scoping (deliberate, not papering over failures): the committed suites/testng.xml includes FaceBookLoginTest, whose body ends in Assert.assertTrue(false, "Login failed : Test failed") — it can never pass, and it targets facebook.com. So PR/push CI runs a new src/test/resources/suites/smoke.xml (GoogleSearchTest only) with no continue-on-error, keeping a red check meaningful. The nightly workflow runs the full suite and marks only that one step continue-on-error: true, with an inline comment naming the known-failing test; artifacts and the job summary carry the real result. Both suites still hit public third-party sites, which hosted runners can reach — documented in docs/CICD.md.

Driver resolution: browser-actions/setup-chrome installs Chrome + a matching chromedriver and the path is fed to Maven, so WebDriverManager never downloads a driver:

-Dwebdriver.chrome.driver=${{ steps.setup-chrome.outputs.chromedriver-path }}
-Dwdm.chromeDriverPath=<same>

The image achieves the same offline property, which took three iterations to actually get right (each verified by building and running the container): the runtime must be a JDK (Surefire re-runs testCompile), the runtime Maven must be the same version that primed ~/.m2 (different Maven versions bind different default lifecycle plugin versions, breaking -o), the priming layer must really execute the suite (surefire-testng is resolved only when tests run, so -Dmaven.test.skip.exec=true leaves it missing), a Chrome-for-Testing chromedriver is baked into the Selenium cache, and the env var is named HARNESS_MAVEN_ARGS because Maven 3.9 auto-consumes MAVEN_ARGS.

Everything AWS is mocked. Account 123456789012, arn:aws:iam::123456789012:role/demo-*, ECR demo/selenium-testng-harness, clusters demo-staging-cluster/demo-prod-cluster, namespaces demo-staging/demo-prod, bucket demo-mock-test-reports, us-east-1 — all supplied as vars.* with these fake defaults. The kill switch is vars.AWS_MOCK_MODE (defaults to true):

- uses: aws-actions/configure-aws-credentials@v4.0.2   # skipped: if: env.AWS_MOCK_MODE != 'true'
- run: |
    if [ "${AWS_MOCK_MODE}" = "true" ]; then
      echo "::notice::MOCK MODE — would run: docker push ${IMAGE_URI}"; exit 0
    fi
    docker push "${IMAGE_URI}"

So under defaults the image is genuinely built (and uploaded as an artifact) while every push/ECS/S3 call only logs what it would do. No long-lived keys anywhere; id-token: write is granted only on deploy jobs, workflows are otherwise contents: read, with concurrency groups and pinned action versions.

Validation

• actionlint 1.7.7 — clean on all three workflows; all YAML/JSON parses.
• mvn -B -ntp verify -DskipTests, mvn validate dependency:resolve-plugins, and mvn -B test -Dsurefire.suiteXmlFiles=src/test/resources/suites/smoke.xml — pass locally.
• docker build --no-cache + docker run of the harness image — smoke suite executes offline and exits 0; a --network none run proves Maven and Chrome/chromedriver need no egress (only the test's own driver.get fails). Full log in the verification comment.

Caveat — pre-existing flake: GoogleSearchTest failed 4 of 11 runs inside a container (Google interstitial → Title doesn't contain abc), 0 of 6 on the host. CI/nightly/ECS runs will therefore go red intermittently; documented in docs/CICD.md. The durable fix is a WebDriverWait in the test, deliberately not changed here.

Not verifiable in the sandbox: the workflows actually executing on GitHub Actions (only static actionlint validation was possible before merge) and the CD pipeline against real AWS, which is mock-only by design.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/59d8a4701eba4ac087e9fc5100dd7c0c
Requested by: @mbatchelor81

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Runtime verification of the harness image (Devin testing run, 78be9ef)

Shell-only verification on a Linux sandbox with Docker 27.4.1. The first two Dockerfile revisions in this PR failed at runtime; the third works.

Offline container run executes the smoke suite and exits 0

docker build --no-cache -t harness:test . → exit 0. The priming layer really runs the suite at build time (Tests run: 1, Failures: 0), so surefire-testng lands in ~/.m2.

docker run --rm --shm-size=1g harness:test:

Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 2.189 sec - in TestSuite
[INFO] BUILD SUCCESS

No Cannot access central … in offline mode, no Missing: surefire-testng, no downloads.

Image is egress-free apart from the test target

docker run --rm --network none --shm-size=1g harness:test: Maven resolved fully offline and Chrome + chromedriver started with no network (browserVersion: 151.0.7922.173, chromedriverVersion: 151.0.7922.138). The only error is the site itself:

org.openqa.selenium.WebDriverException: unknown error: net::ERR_INTERNET_DISCONNECTED
GoogleSearchTest.googleSearchTest:22

Known flake (documented in docs/CICD.md)

GoogleSearchTest failed 4 of 11 container runs, always Title doesn't contain abc : Test Failed expected [true] but found [false] (GoogleSearchTest.java:25); 0 failures in 6 host runs. Google serves an interstitial to fresh containerized profiles. ECS runs of this image will therefore go red intermittently; the durable fix is a WebDriverWait on the title, which is out of scope here.

Bugs found and fixed during this run: JRE runtime base (no javac for Surefire's testCompile), Maven version skew between the cache-priming stage (3.9.9) and apt's runtime Maven (3.6.3) breaking -o, a missing chromedriver despite the comment claiming otherwise, an unprimed surefire-testng provider, and MAVEN_ARGS being auto-consumed by Maven 3.9 (renamed to HARNESS_MAVEN_ARGS).

Host checks green: mvn -B -ntp verify -DskipTests, smoke suite 3/3, actionlint 1.7.7 clean.
Not verified: the workflows actually executing on GitHub Actions (cannot trigger CI from the sandbox) and the CD pipeline against real AWS (mock-only by design).