Let the integration tests run on pull requests from forks - #62

The problem

The Integration Tests Run workflow fails before it runs a single test on every pull request opened from a fork, including the four I currently have open (#58, #59, #60, #61). It has never passed on a fork PR; every successful run in the history came from a branch inside the repository.

The failing step:

Starting single-node instance, no replica set
    - port []
    - version [7.0.16]
    - database []
    - credentials [:]

docker: invalid publish opts format (should be name=value but got ':').
Error starting MongoDB Docker container

The job declares environment: testing and reads its configuration from that environment:

mongodb-db: ${{ vars.CI_MONGO_INITDB_DATABASE }}
mongodb-port: ${{ vars.CI_MONGO_PORT }}

GitHub does not expose an environment's secrets or variables to a pull_request run whose head is a fork. Both expressions therefore resolve to an empty string, supercharge/mongodb-github-action builds -p :, and docker refuses it. secrets.CI_JWT_SECRET and secrets.CI_JWT_SALT are empty on the same runs, so even past the Mongo step the generated api/.env would be missing the values utils/jwt.ts requires.

The result is that no external contribution can show a green suite, and a maintainer cannot tell a fork PR that breaks the tests from one that does not.

The change

Fallbacks on the four expressions, so the job is self-sufficient when the environment is unavailable. Where the environment is available — every internal PR, unchanged — its values still win.

mongodb-db:   ${{ vars.CI_MONGO_INITDB_DATABASE || 'space_testing_db' }}
mongodb-port: ${{ vars.CI_MONGO_PORT || '27017' }}
envkey_JWT_SECRET: ${{ secrets.CI_JWT_SECRET || 'ci_test_secret' }}
envkey_JWT_SALT:   ${{ secrets.CI_JWT_SALT || 'ci_test_salt' }}

The two Mongo values are not a guess. envkey_MONGO_URI is hard-coded one step above:

mongodb://localhost:27017/space_testing_db?authSource=space_testing_db

so the container has to listen on 27017 and hold space_testing_db or the suite cannot connect at all — the variables cannot currently hold anything else without breaking the run, and the defaults simply write that down. A comment above jobs: records this, so the next reader knows the values are load-bearing rather than incidental.

JWT_SECRET is a signing key and JWT_SALT a pbkdf2 salt (jwt.ts:45) for tokens minted and verified inside the same run, so any non-empty pair works; both are only checked for presence. No real secret is introduced and none is needed, since nothing outside the run ever sees these tokens.

Verification

This PR verifies itself: a pull_request run uses the workflow from the PR's own head, so the check on this page is the fixed workflow executing on a fork PR. If it is green, the bug is fixed.

Locally I reproduced the CI environment exactly — Mongo 7.0.16 on 27017, Redis 7 on 6379, and an api/.env byte-for-byte identical to what the fixed Make envfile step produces with every fallback taken (i.e. the worst case, no environment at all) — and ran the real CI command, pnpm run test:

✓ src/test/user.test.ts                      (73 tests)
✓ src/test/events.test.ts                     (5 tests)
✓ src/test/service.test.ts                   (44 tests)
✓ src/test/unit-tests/routeMatcher.test.ts   (12 tests)
✓ src/test/unit-tests/version-formatter.test.ts (19 tests)
✓ src/test/middlewares/authMiddleware.test.ts (68 tests)
✓ src/test/analytics.test.ts                  (2 tests)
✓ src/test/service.disable.test.ts            (3 tests)
✓ src/test/feature-evaluation.test.ts        (26 tests)
✓ src/test/contract.test.ts                  (77 tests)
✓ src/test/organization.test.ts             (127 tests)
✓ src/test/permissions.test.ts              (245 tests)

701 tests, all passing, on main with no source changes — which also confirms the fallback credentials are sufficient for the whole suite, not just for reaching it.

Scope

One file, four expressions and a comment. No change to the test suite, to the source, or to any run that currently succeeds: when vars/secrets are populated the expressions evaluate exactly as before.

A maintainer may prefer to drop environment: testing and the two vars entirely, given that their only possible values are the ones now written as defaults. I have left the environment in place because that is a call about your CI configuration rather than a fix for the failure, and this PR is meant to be the smallest change that makes fork PRs runnable.