From 8e1a820bd3a4a4a8463b0c4a21cda6210ec8a3d0 Mon Sep 17 00:00:00 2001
From: Niek Otten <not@respellion.nl>
Date: Fri, 24 Jul 2026 14:12:14 +0200
Subject: [PATCH] ci: verify-stack check-results table in the run summary (refs
 #136)

---
 .gitea/workflows/ci.yaml | 47 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index fcb8938..a23aaa8 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -193,26 +193,73 @@ jobs:
       - uses: https://github.com/actions/checkout@v4
       # Bring the full stack up + wait for health — this also is the DoD "compose up
       # reaches green health" smoke (it replaces the old compose-smoke job).
+      # Each check carries an `id` so the summary step below can report its per-check outcome (#136).
+      # A failed check skips the rest (no step `if:`), so the table shows exactly where it stopped.
       - name: Bring up the full stack & wait for health
+        id: up
         run: make verify-up
       - name: Observability backplane (Grafana + Tempo + Prometheus datasources)
+        id: obs
         run: OBS_TIMEOUT=180 make verify-observability
       - name: ACL ↔ OpenZaak integration tests
+        id: acl
         run: make verify-acl
       - name: OpenZaak → NRC notification delivery
+        id: nrc
         run: make verify-nrc
       - name: OpenZaak → NRC → Event Subscriber → projection-api
+        id: projection
         run: make verify-projection
       - name: Domain → Flowable → ACL → OpenZaak
+        id: domain
         run: make verify-domain
       - name: BFF → Keycloak + domain + projection
+        id: bff
         run: make verify-bff
       - name: Distributed traces reach Tempo (one connected trace across services)
+        id: tracing
         run: TRACING_TIMEOUT=120 make verify-tracing
       - name: Golden-signal metrics scraped by Prometheus (/metrics on every service)
+        id: metrics
         run: METRICS_TIMEOUT=120 make verify-metrics
       - name: Self-service e2e (Playwright, login → submit → success)
+        id: e2e
         run: make verify-e2e
+      # Job summary (#136): a pass/fail table of every live-stack check, so a red verify-stack shows
+      # which check failed at a glance. `if: always()` (step-level — safe on runner 2.0.0, unlike the
+      # job-level status-function `if` of #134) so it renders even after a check fails.
+      - name: verify-stack check summary
+        if: always()
+        env:
+          UP: ${{ steps.up.outcome }}
+          OBS: ${{ steps.obs.outcome }}
+          ACL: ${{ steps.acl.outcome }}
+          NRC: ${{ steps.nrc.outcome }}
+          PROJECTION: ${{ steps.projection.outcome }}
+          DOMAIN: ${{ steps.domain.outcome }}
+          BFF: ${{ steps.bff.outcome }}
+          TRACING: ${{ steps.tracing.outcome }}
+          METRICS: ${{ steps.metrics.outcome }}
+          E2E: ${{ steps.e2e.outcome }}
+        run: |
+          [ -n "${GITHUB_STEP_SUMMARY:-}" ] || exit 0
+          icon() { case "$1" in success) echo "✅";; failure) echo "❌";; skipped) echo "⏭️";; cancelled) echo "🚫";; *) echo "❔ ${1:-—}";; esac; }
+          {
+            echo "## 🔌 verify-stack checks"
+            echo
+            echo "| Check | Result |"
+            echo "| ----- | :----: |"
+            echo "| Bring up + health | $(icon "$UP") |"
+            echo "| Observability backplane | $(icon "$OBS") |"
+            echo "| ACL ↔ OpenZaak | $(icon "$ACL") |"
+            echo "| OpenZaak → NRC | $(icon "$NRC") |"
+            echo "| NRC → Event Subscriber → projection | $(icon "$PROJECTION") |"
+            echo "| Domain → Flowable → ACL → OpenZaak | $(icon "$DOMAIN") |"
+            echo "| BFF → Keycloak + domain + projection | $(icon "$BFF") |"
+            echo "| Distributed traces (Tempo) | $(icon "$TRACING") |"
+            echo "| Golden-signal metrics (Prometheus) | $(icon "$METRICS") |"
+            echo "| Self-service e2e (Playwright) | $(icon "$E2E") |"
+          } >> "$GITHUB_STEP_SUMMARY"
       # Log dump must precede teardown (which removes the containers).
       - name: Dump container logs on failure
         if: failure()