Bilko CI — integration-test job (Testcontainers) MC #102843 — 2026-06-03

Summary

MC #102843 adds an integration-test job to Bilko's .github/workflows/ci.yml. Previously the backend-test job ran only ./gradlew test, and tasks.test does excludeTags("integration") (apps/api/build.gradle.kts:159) — so the integrationTest task (Testcontainers/Postgres, includeTags("integration")) never ran in CI. PRs that broke integration tests passed green (surfaced manually by Proveo during MC #102798).

Change (PR #245, base main, not merged)

• New integration-test job: ubuntu-latest, Java 21, ./gradlew integrationTest --no-daemon in apps/api. Testcontainers spins its own Postgres (no services: block needed).
• Non-blocking for now (continue-on-error: true, NOT in build needs:).

Why non-blocking (important)

Running the suite revealed it is currently broken on main: ~78/1147 integration tests fail (FlywayMigrateException in SettingsServiceRlsTest, ExposedSQLException in VatReportStatutoryGroupingTest, and others). These had never run in CI. Making the job a required gate immediately would red-lock every PR. So the job is visible on every PR (failures now surface) but does not block merges yet.

Path to required gate

Tracked in MC #102874 (H): fix the 78 failing integration suites. Once green, promotion is a one-line CI change — remove continue-on-error: true and add integration-test to build needs: [lint, unit, backend-test, integration-test].

Verification

• CI run 26900887524: integration-test job executed; log shows Task :integrationTest, 1147 tests / 78 failed, Testcontainers Postgres started.
• yaml-lint PASS, actionlint PASS, gitleaks 0, diff = ci.yml only.
• Independent pre-verifier (Company Mesh / Proveo): PASS — mesh-thr-8f34975b-a1ef-4d99-8bd8-cd9f894a022a.
• til-done: DONE — /tmp/til-done/102843-20260603T172857Z.json.

Incident (logged, low severity)

During implementation a build branch was accidentally pushed to origin/main (commit ecf5a97) and immediately reverted (036e2c6). It triggered bilko-stage-auto-deploy twice; both SUCCESS, change was ci.yml-only (no app artifact change), stage is non-customer-facing. origin/main verified clean afterwards. Lesson recorded: build agents must git push -u origin HEAD:<branch> and verify upstream ≠ origin/main (push to Bilko main auto-deploys stage).