Gateway E2E verification: add full-stack smoke test + CI workflow

[devin-ai-integration]

Summary

Final integration step: verify the YARP API gateway routes end-to-end across all five carved-out services, add the repo's first CI gate, and fix a docker-compose cold-start race surfaced by CI. Routing/auth themselves were correct — no gateway (appsettings.json/Program.cs) changes were needed.

End-to-end results (through gateway http://localhost:5000)

Service	GET /healthz	unauth GET /	authed GET / (cross-service JWT)	invalid token
identity	200	401	200	—
customers	200	401	200	401
products	200	401	200	401
orders	200	401	200	401
notifications	200	401	200	—

• Identity login: POST /api/identity/connect/token (password grant, form-encoded) → 200 with access_token.
• The Identity-issued HS256 JWT is accepted (200) by Customer, Product and Order through the gateway, proving the canonical JWT contract holds cross-service.
• A tampered token (last char mangled) → 401 on every protected route.

Gateway changes needed

None. All routes (/api/identity, /api/customers, /api/orders, /api/products, /api/notifications) with their PathRemovePrefix transforms and clusters (ports 5001–5005) already resolve correctly. The Notification.API.csproj Shared reference is already correct (..\..\..\Shared); all six projects build clean in Release.

Compose fix (cold-start race — found by CI, fixed in src/docker-compose.yml)

The first CI E2E run failed: services call EnsureCreated() on boot and threw an unhandled Npgsql ... Connection refused when Postgres wasn't ready yet, then exited with no restart policy — so the gateway could never reach them. It passed locally only because the Postgres image was warm. Fix (no service code touched):

• Added healthchecks to postgres (pg_isready) and rabbitmq (rabbitmq-diagnostics ping).
• Each service now depends_on both with condition: service_healthy and gets restart: on-failure, eliminating the startup race deterministically.

What's added

• scripts/e2e-smoke.sh — self-contained, idempotent full-stack smoke test:
  • tears down any prior stack, then docker compose -f src/docker-compose.yml up --build -d
  • waits for gateway + all services to report health 200 (bounded timeout)
  • asserts: per-service health 200, per-service unauth 401, Identity login → token, cross-service authed 200 (customers/products/orders), invalid token 401
  • always tears the stack down on exit (trap cleanup EXIT) and exits non-zero on any failed assertion
• .github/workflows/ci.yml — runs on push (main/master) + every PR, with a concurrency group to cancel superseded runs. Two jobs:
  • build: sets up the .NET SDK from src/global.json (10.0.100) and dotnet build -c Release for ApiGateway.csproj + each *.API.csproj
  • e2e: (needs build) runs scripts/e2e-smoke.sh on the Docker-enabled runner — the real validation gate, exercising the gateway end-to-end, not just compiling.

How to run

# Local E2E (builds + brings up the full stack, asserts, tears down)
./scripts/e2e-smoke.sh

# CI runs the same script after building all services + the gateway in Release.

Validation

scripts/e2e-smoke.sh passes locally (output above). All six projects build clean in Release. ci.yml and docker-compose.yml validated as well-formed YAML / docker compose config.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/63e1c6d04192425f9bfbc15d0951fc9d
Requested by: @mbatchelor81

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring