Add LocalStack integration test pipeline

.github/workflows/ci.yml

@@ -78,3 +78,57 @@ jobs:
           format: table
           exit-code: "1"
           severity: CRITICAL,HIGH
+
+  integration-test:
+    name: Test API with LocalStack
+    needs:
+      - test
+      - infrastructure
+    runs-on: ubuntu-latest
+    env:
+      AWS_ACCESS_KEY_ID: test
+      AWS_SECRET_ACCESS_KEY: test
+      AWS_DEFAULT_REGION: us-east-1
+      AWS_REGION: us-east-1
+      RUN_INTEGRATION_TESTS: "1"
+      TF_IN_AUTOMATION: "true"
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.14"
+          cache: pip
+          cache-dependency-path: |
+            requirements.txt
+            requirements-dev.txt
+
+      - name: Install Python dependencies
+        run: python -m pip install --requirement requirements-dev.txt
+
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@v4
+        with:
+          terraform_version: "1.15.8"
+
+      - name: Start LocalStack
+        uses: LocalStack/setup-localstack@v0.2.3
+        with:
+          image-tag: "latest"
+          install-awslocal: "true"
+          use-pro: "true"
+        env:
+          LOCALSTACK_AUTH_TOKEN: ${{ secrets.LOCALSTACK_AUTH_TOKEN }}
+
+      - name: Create local AWS infrastructure
+        run: |
+          terraform -chdir=infrastructure init -backend=false -input=false
+          terraform -chdir=infrastructure apply -auto-approve -input=false
+
+      - name: Run LocalStack integration test
+        run: python -m pytest tests/integration/test_localstack.py -v

tests/integration/test_localstack.py

@@ -0,0 +1,59 @@
+import os
+from uuid import uuid4
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.main import app
+from app.storage import BUCKET_NAME, get_s3_client
+
+
+client = TestClient(app)
+
+
+@pytest.mark.skipif(
+    os.getenv("RUN_INTEGRATION_TESTS") != "1",
+    reason="Integration tests require LocalStack and Terraform infrastructure",
+)
+def test_artifact_storage_with_localstack() -> None:
+    artifact_name = f"integration-{uuid4().hex}.txt"
+    artifact_content = "Integration test successfully reached encrypted S3."
+
+    s3_client = get_s3_client()
+
+    try:
+        upload_response = client.post(
+            "/artifacts",
+            json={
+                "name": artifact_name,
+                "content": artifact_content,
+            },
+        )
+
+        assert upload_response.status_code == 201
+        assert upload_response.json() == {
+            "name": artifact_name,
+            "status": "stored",
+        }
+
+        list_response = client.get("/artifacts")
+
+        assert list_response.status_code == 200
+        assert artifact_name in list_response.json()["artifacts"]
+
+        stored_object = s3_client.get_object(
+            Bucket=BUCKET_NAME,
+            Key=artifact_name,
+        )
+
+        stored_content = stored_object["Body"].read().decode("utf-8")
+
+        assert stored_content == artifact_content
+        assert stored_object["ServerSideEncryption"] == "aws:kms"
+        assert stored_object["SSEKMSKeyId"]
+
+    finally:
+        s3_client.delete_object(
+            Bucket=BUCKET_NAME,
+            Key=artifact_name,
+        )