1. Overview

Purpose

This project automates API testing using Postman collections, executed through GitHub Actions CI/CD pipelines with the following capabilities:

• • Execute Postman collections automatically
  • Support multiple environments (dev / test / stage)
  • Secure authentication using Azure AD OAuth2
  • Dynamic runtime parameters
  • Automated reporting using Allure Reports
  • Hosting execution reports on GitHub Pages

2. Technology Stack

3. Project Structure

Folder Explanation

4. Authentication Mechanism

4.1 Security Implementation

Both workflows now include Azure AD Authentication using:

• OAuth2 Client Credentials Flow
• Secure GitHub Secrets
• Runtime Bearer Token generation

4.2 Secrets Required

The following secrets must be configured in GitHub Repository:

4.3 Token Flow

• Workflow requests Azure AD token
• Token is injected into Postman run as: bearerToken

This token is then used by API requests inside Postman collections.

5. GitHub Workflows

The project contains two workflows for different execution scenarios.

5.1 Workflow 1 – runcollectionID.yml

Name: Run Workorder Collections with ID

Purpose: Runs a Postman collection directly from Postman Cloud using:

• Collection ID
• Selected environment
• Azure AD authentication
• Runtime variables

Trigger Type

• Manually triggered via workflow_dispatch

Input Parameters

Execution Steps

1. Checkout repository
2. Install Postman CLI
3. Login to Postman
4. Fetch Azure AD Access Token
5. Debug input values
6. Execute collection with token

Token Generation Step

The workflow securely calls Azure AD:

curl -X POST https://login.microsoftonline.com/<TENANT>/oauth2/v2.0/token

• Retrieves access token
• Stores it in GitHub environment variable
• Fails pipeline if token cannot be retrieved

Key Features

• Cloud-based collection execution
• Secure Azure AD authentication
• Dynamic input support
• Ideal for quick on-demand runs

When to Use

• For ad-hoc executions
• For debugging specific collections

5.2 Workflow 2 – runCollectionsFile.yml

Name: Run Workorder Collections with JSON File

Purpose: Executes Postman collections stored in repository and generates:

• Allure execution reports
• Hosted test results
• Historical test evidence

Trigger

• Manual trigger via GitHub Actions UI

Input Parameters

Execution Flow

Publish to GitHub Pages

Reports are deployed automatically using:

peaceiris/actions-gh-pages@v3

Benefits of this Workflow

• Fully automated API validation
• Visual execution reports
• Secure authentication
• Environment flexibility
• Zero local setup required

6. Environment Management

Available Environments

Located at:  API-Automation/environments/

Supported:

• dev.json
• test.json
• stage.json

These files contain:

• Base URLs
• API configuration
• Default variables

Authentication token is NOT stored here – it is injected dynamically for security.

7. How to Add New Collections

To onboard a new Postman collection:

1. Export from Postman
2. Place in: API-Automation/collections/
3. Ensure JSON contains:  ".info._postman_id"
4. Run using: Run Workorder Collections with JSON File workflow

No pipeline changes required.

8. How to Execute Tests from GitHub

Steps:

1. Go to GitHub Repository
2. Open "Actions" tab
3. Choose workflow:

- Run Workorder Collections with ID

  OR 

- Run Workorder Collections with JSON File

1. Click "Run Workflow"
2. Provide required inputs
3. View execution logs and report
4. Reporting System

Tool Used

• Allure Reports

What It Provides

• Pass/Fail dashboard
• API request logs
• Execution history
• Shareable HTML reports

9. Hosting

Reports are automatically published to:

https://eg-a-s.github.io/EGZP-Automation-Testing/

10. Security Best Practices

• No tokens stored in code
• All credentials in GitHub Secrets
• Azure AD token generated per run
• Short-lived bearer tokens
• No sensitive data in environment files