🐞 Voting channel is not stored for cast votes

.github/actions/setup-rust-tests/action.yml

@@ -0,0 +1,51 @@
+# SPDX-FileCopyrightText: 2025 Sequent Tech Inc <legal@sequentech.io>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+
+name: Set up Rust tests
+description: Install the Rust toolchain, restore Cargo caches, and install native test dependencies
+
+inputs:
+  cargo-build-name:
+    description: Stable name used to isolate the Cargo build cache
+    required: true
+  cargo-build-path:
+    description: Path to the package Cargo target directory
+    required: true
+  cargo-lock-path:
+    description: Cargo lockfile used to invalidate the package build cache
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Install Rust
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        toolchain: 1.96.0
+        components: rustfmt
+        targets: x86_64-unknown-linux-musl
+
+    - name: Cache Cargo registry
+      uses: actions/cache@v4
+      with:
+        path: |
+          ~/.cargo/registry
+          ~/.cargo/git
+        key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-cargo-registry-
+
+    - name: Cache Cargo build
+      uses: actions/cache@v4
+      with:
+        path: ${{ inputs.cargo-build-path }}
+        key: ${{ runner.os }}-cargo-test-${{ inputs.cargo-build-name }}-${{ hashFiles(inputs.cargo-lock-path) }}
+        restore-keys: |
+          ${{ runner.os }}-cargo-test-${{ inputs.cargo-build-name }}-
+
+    - name: Install system dependencies
+      shell: bash
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y build-essential pkg-config libssl-dev protobuf-compiler libprotobuf-dev

.github/workflows/tests.yml

@@ -18,51 +18,28 @@ jobs:
       matrix:
         include:
           #- service: braid # these take too long!
+          - service: electoral-log
           - service: harvest
           - service: strand
           - service: immu-board
           - service: immudb-rs
           - service: sequent-core
             extra: --features keycloak,default_features
+          - service: step-cli
           - service: velvet
-          - service: windmill
-            build_jobs: 2
           - service: wrap-map-err
 
       fail-fast: false
     steps:
       - name: Check out code
         uses: actions/checkout@v4
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+      - name: Set up Rust tests
+        uses: ./.github/actions/setup-rust-tests
         with:
-          toolchain: 1.96.0
-          components: rustfmt
-          targets: x86_64-unknown-linux-musl
-
-      - name: Cache Cargo registry
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-          key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-registry-
-
-      - name: Cache Cargo build
-        uses: actions/cache@v4
-        with:
-          path: packages/${{ matrix.service }}/target
-          key: ${{ runner.os }}-cargo-test-${{ matrix.service }}-${{ hashFiles('packages/${{ matrix.service }}/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-test-${{ matrix.service }}-
-
-      - name: Install system dependencies
-        run: |
-            sudo apt-get update
-            sudo apt-get install -y build-essential pkg-config libssl-dev protobuf-compiler libprotobuf-dev
+          cargo-build-name: ${{ matrix.service }}
+          cargo-build-path: packages/${{ matrix.service }}/target
+          cargo-lock-path: packages/${{ matrix.service }}/Cargo.lock
 
       - name: Install Chrome
         run: |
@@ -76,13 +53,13 @@ jobs:
           PROTOC: "/usr/bin/protoc"
           KEYCLOAK_DB__USER: "test"
           KEYCLOAK_DB__PASSWORD: "test"
-          KEYCLOAK_DB__HOST: "test"
+          KEYCLOAK_DB__HOST: "127.0.0.1"
           KEYCLOAK_DB__PORT: "3322"
           KEYCLOAK_DB__DBNAME: "test"
           KEYCLOAK_DB__MANAGER__RECYCLING_METHOD: "Verified"
           HASURA_DB__USER: "test"
           HASURA_DB__PASSWORD: "test"
-          HASURA_DB__HOST: "test"
+          HASURA_DB__HOST: "127.0.0.1"
           HASURA_DB__PORT: "3322"
           HASURA_DB__DBNAME: "test"
           HASURA_DB__MANAGER__RECYCLING_METHOD: "Verified"
@@ -92,6 +69,67 @@ jobs:
           CARGO_BUILD_JOBS: ${{ matrix.build_jobs || 4 }}
         run: cd packages/${{ matrix.service }} && cargo test ${{ matrix.extra }}
 
+  # Windmill has PostgreSQL-backed tests, so it uses a dedicated job with an
+  # unconditional service container instead of matrix-dependent service YAML.
+  run-windmill-tests:
+    name: Run Windmill tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 35
+    env:
+      RUST_BACKTRACE: "full"
+      PROTOC: "/usr/bin/protoc"
+      KEYCLOAK_DB__USER: "test"
+      KEYCLOAK_DB__PASSWORD: "test"
+      KEYCLOAK_DB__HOST: "127.0.0.1"
+      KEYCLOAK_DB__PORT: "3322"
+      KEYCLOAK_DB__DBNAME: "test"
+      KEYCLOAK_DB__MANAGER__RECYCLING_METHOD: "Verified"
+      HASURA_DB__USER: "test"
+      HASURA_DB__PASSWORD: "test"
+      HASURA_DB__HOST: "127.0.0.1"
+      HASURA_DB__PORT: "3322"
+      HASURA_DB__DBNAME: "test"
+      HASURA_DB__MANAGER__RECYCLING_METHOD: "Verified"
+      LOW_SQL_LIMIT: "1000"
+      DEFAULT_SQL_LIMIT: "20"
+      DEFAULT_SQL_BATCH_SIZE: "1000"
+      CARGO_BUILD_JOBS: "2"
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: test
+          POSTGRES_PASSWORD: test
+          POSTGRES_DB: test
+        ports:
+          - 3322:5432
+        options: >-
+          --health-cmd "pg_isready -U test -d test"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up Rust tests
+        uses: ./.github/actions/setup-rust-tests
+        with:
+          cargo-build-name: windmill
+          cargo-build-path: packages/windmill/target
+          cargo-lock-path: packages/windmill/Cargo.lock
+
+      - name: Run Windmill tests
+        run: cargo test
+        working-directory: packages/windmill
+
+      - name: Run PostgreSQL-backed voter-channel regression
+        run: >-
+          cargo test
+          services::cast_votes::tests::voters_by_channel_defaults_legacy_votes_and_uses_latest_valid_revote
+          -- --ignored --exact
+        working-directory: packages/windmill
+
   # ===========================================================================
   # JOB: run-frontend-tests
   # ===========================================================================
@@ -103,7 +141,10 @@ jobs:
     timeout-minutes: 20
     strategy:
       matrix:
-        package: [ui-core, ui-essentials]
+        include:
+          - package: ui-core
+          - package: ui-essentials
+          - package: admin-portal
       fail-fast: false
     steps:
       - name: Check out code
@@ -121,7 +162,7 @@ jobs:
         working-directory: packages
 
       - name: Run ${{ matrix.package }} tests
-        run: yarn --cwd ./${{ matrix.package }} test
+        run: yarn --cwd ./${{ matrix.package }} test --runInBand
         working-directory: packages
 
   # ===========================================================================
@@ -132,7 +173,7 @@ jobs:
   # ===========================================================================
   notify-on-failure:
     name: Notify on failure
-    needs: [run-tests, run-frontend-tests]
+    needs: [run-tests, run-windmill-tests, run-frontend-tests]
     if: failure()
     runs-on: ubuntu-24.04
     steps:

docs/docusaurus/docs/07-developers/08-windmill/02-tests.md

@@ -60,6 +60,22 @@ cd /workspaces/step/packages/windmill && \
 
 ---
 
+## PostgreSQL-backed voter-channel test
+
+`voters_by_channel_defaults_legacy_votes_and_uses_latest_valid_revote` is
+ignored by the default `cargo test` command because it requires PostgreSQL and
+the `HASURA_DB__*` connection variables. GitHub Actions runs it in the dedicated
+Windmill PostgreSQL job. In a configured dev container, run it with:
+
+```bash
+cd /workspaces/step/packages/windmill && \
+  cargo test \
+    services::cast_votes::tests::voters_by_channel_defaults_legacy_votes_and_uses_latest_valid_revote \
+    -- --ignored --exact
+```
+
+---
+
 ## Memory Tests
 
 ### What they measure

hasura/metadata/actions.graphql

@@ -1134,11 +1134,18 @@ type GetPrivateKeyOutput {
 
 type CastVotesPerDay {
     day: date!
+    channel: String!
     day_count: Int!
 }
 
+type VotersByChannel {
+    channel: String!
+    count: Int!
+}
+
 type ElectionEventStatsOutput {
     total_distinct_voters: Int!
+    voters_by_channel: [VotersByChannel!]!
     total_areas: Int!
     total_eligible_voters: Int!
     total_elections: Int!
@@ -1147,6 +1154,7 @@ type ElectionEventStatsOutput {
 
 type ElectionStatsOutput {
     total_distinct_voters: Int!
+    voters_by_channel: [VotersByChannel!]!
     total_areas: Int!
     votes_per_day: [CastVotesPerDay]!
 }

hasura/metadata/actions.yaml

@@ -1722,6 +1722,7 @@ custom_types:
         - name: CreateKeysCeremonyOutput
         - name: GetPrivateKeyOutput
         - name: CastVotesPerDay
+        - name: VotersByChannel
         - name: ElectionEventStatsOutput
         - name: ElectionStatsOutput
         - name: CheckPrivateKeyOutput

packages/Dockerfile.keycloak

@@ -18,6 +18,7 @@ ARG OID4VP_SHA256=f6cd968bc77fec4f8e1417d3caeefe4920941e01b119f152f1c9186bbd2b2e
 
 # Start with a Maven base image to compile the Keycloak provider extensions.
 FROM maven:3-amazoncorretto-17 AS spis-build
+RUN dnf install -y findutils && dnf clean all
 COPY ./keycloak-extensions/ /build/context/packages/keycloak-extensions/
 WORKDIR /build/context
 RUN --mount=from=beyond,source=.,target=/build/beyond-context,readonly \