Cover a self-registered workflow integration end to end

[manuranga]

Purpose

Nothing automated caught #978, a workflow integration registered by its own runtime losing every workflow feature in the console. This adds an E2E scenario for that general path.

Builds on #980, which made the E2E suites run again.

Approach

WorkflowScenariosTest (core suite), driven through the UI:

1. Generate an org-level runtime secret (Runtimes → Add Runtime → Generate Secret).
2. Start a BI workflow app with it. Neither the project nor the integration exists, so the first heartbeat creates both, as with the built-in ICP.
3. The project lists the integration as Workflow, and the integration offers Workflows, Human Tasks and its orderApproval definition.
4. Start a run from Start New Workflow. It is listed Running.
5. Complete its human task in Human Tasks. The run is listed Completed with result APPROVED.

Fixture:

• src/test/resources/bi/workflow: one workflow with one human task. It uses released ballerina/workflow 0.10.1 and wso2/icp.runtime.bridge 1.0.2, and gates the task on Super Admin so the seeded admin can act on it.
• A Temporal dev server (temporalio/temporal:1.8.3), started through Testcontainers only when the scenario runs.
• E2EEnvironment.startWorkflowRuntime. BI runtimes now share one launcher.

Testing

• Fails without Promote unspecified integrations to workflow type on workflow heartbeats #979 (storage changes reverted to b5919767^1): the integration is never listed as Workflow.
• Passes with Promote unspecified integrations to workflow type on workflow heartbeats #979.
• ./gradlew build: e2eCore 14, e2eObservability 1, e2eSso 1, all passing. Combined coverage 48.10%.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0b7cf0d9-cec8-4f5a-b77e-cda20e81a7f6

---

📥 Commits

Reviewing files that changed from the base of the PR and between b591976 and ce342b3.

---

📒 Files selected for processing (8)

• e2e-tests/README.md
• e2e-tests/build.gradle
• e2e-tests/src/test/java/org/wso2/icp/e2e/E2EConfig.java
• e2e-tests/src/test/java/org/wso2/icp/e2e/E2EEnvironment.java
• e2e-tests/src/test/java/org/wso2/icp/e2e/tests/WorkflowScenariosTest.java
• e2e-tests/src/test/resources/bi/workflow/Ballerina.toml
• e2e-tests/src/test/resources/bi/workflow/Config.toml.template
• e2e-tests/src/test/resources/bi/workflow/main.bal

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

📝 Summary

Summary

• Add an end-to-end scenario for a workflow integration that registers with its own runtime. The scenario verifies integration discovery, the orderApproval workflow, human-task completion, and the completed run’s APPROVED result.
• Add a Ballerina workflow fixture and configure a Temporal dev server to start when the scenario runs.
• Update the E2E build and configuration to build and launch both BI test applications through shared runtime launch logic.
• Document the workflow scenario and its dependencies in the E2E README.

Walkthrough

The E2E suite now builds a workflow BI application and can launch it with a Temporal dev server. A new workflow scenario verifies runtime registration, starts an approval workflow, completes its human task, and checks its final status and result.

Sequence Diagram(s)

sequenceDiagram
  participant WorkflowScenariosTest
  participant ICPConsole
  participant E2EEnvironment
  participant TemporalDevServer
  participant WorkflowBIRuntime
  WorkflowScenariosTest->>ICPConsole: create organization secret
  WorkflowScenariosTest->>E2EEnvironment: start workflow runtime
  E2EEnvironment->>TemporalDevServer: start dev server
  E2EEnvironment->>WorkflowBIRuntime: launch with Temporal endpoint
  WorkflowBIRuntime->>TemporalDevServer: connect using endpoint
  WorkflowScenariosTest->>ICPConsole: verify registration and run workflow
  WorkflowScenariosTest->>ICPConsole: complete approval task and read result

Loading

---

Priority: ⬇️ Low

Merge Risk

Merge Risk: ⚪ Minimal · up to ce342

The workflow end-to-end scenario appears mergeable after normal build and test checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to ce342

The demonstrated scope is disposable test infrastructure and synthetic workflow data, not production deployment. The new published workflow-service port and organization-level test credential warrant containment review, but no production attack path is established. Host-network isolation remains unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The demonstrated authority is within the generated ICP test instance, its default organization and dev environment, and disposable workflow state. Temporal is not supplied the ICP registration secret. Reaching a production tenant or obtaining Docker authority through this new container is not established by the inspected configuration.

Trust Boundaries and Controls

• observed — The fixture declares Super Admin authorization for its human task and enables workflow management through the ICP bridge. That role declaration does not establish authorization on direct Temporal API access. Temporal authentication defaults and Docker host-network isolation remain unverified, so the published port is an exposure candidate rather than a demonstrated authorization bypass.

Resilience and Maintainability Implications

• inferred — Normal scenario cleanup bounds the lifetime of the new workflow service. Abrupt termination, cleanup failure, or future concurrent callers need stronger ownership guarantees before the same lifecycle can be treated as a security-isolation control.

Hardening Proposals

• proposed — For shared runners or remotely accessible Docker hosts, explicitly restrict Temporal's published endpoint to the required test clients and remove secret-bearing runtime configuration after use. Treat these as containment improvements, not verified vulnerabilities.

---

---

---

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 23.08% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 26 functions across 3 files. (5 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check		The description explains the purpose, approach, fixture, dependency context, and test results, but it omits most sections required by the template, including Goals, User stories, Release note, Documen…	Add every missing template section. Provide the required release, documentation, training, certification, marketing, security, test environment, migration, sample, related-PR, and learning details. Mark non-applicable sections as N/A with a…

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly summarizes the main change: end-to-end coverage for a self-registered workflow integration.

---

Full details: Docstring Coverage

Explanation

Docstring coverage is 23.08% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 26 functions across 3 files. (5 skipped: 5 unsupported.)

---

Full details: Description check

Explanation

The description explains the purpose, approach, fixture, dependency context, and test results, but it omits most sections required by the template, including Goals, User stories, Release note, Documentation, Training, Certification, Marketing, Automation tests, Security checks, Samples, Related PRs, Migrations, Test environment, and Learning.

Resolution

Add every missing template section. Provide the required release, documentation, training, certification, marketing, security, test environment, migration, sample, related-PR, and learning details. Mark non-applicable sections as N/A with a brief explanation.

---

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

The merge-base changed after approval.

The merge-base changed after approval.

The merge-base changed after approval.

The merge-base changed after approval.

The merge-base changed after approval.