e2e-cluster-free.yaml

name: E2E Cluster-free

# Runs the cluster-free local E2E harness (RHIDP-13501 / RHIDP-15075): boots the
# backend and the legacy app dev server in-process and drives Playwright against
# them, with dynamic plugins installed from the public OCI registry (ghcr) via
# the install-dynamic-plugins CLI (skopeo). No OpenShift/Kubernetes cluster or
# image. See docs/e2e-tests/local-e2e-harness.md.

on:
  pull_request:
    paths:
      - "e2e-tests/**"
      - "app-config*.yaml"
      # the harness relies on the app dev-server proxy defined here
      - "packages/app/package.json"
      - ".github/workflows/e2e-cluster-free.yaml"
      - ".github/actions/setup-cluster-free-harness/**"
  push:
    branches:
      - 'main'
      - 'release-[0-9]+.[0-9]+'
    paths:
      - "e2e-tests/**"
      - "app-config*.yaml"
      # the harness relies on the app dev-server proxy defined here
      - "packages/app/package.json"
      - ".github/workflows/e2e-cluster-free.yaml"
      - ".github/actions/setup-cluster-free-harness/**"
  # The catalog index is built outside this repo and changes on its own, so the
  # plugin sanity job needs a trigger that is not tied to a commit here. GitHub
  # only runs `schedule` from the default branch, so this covers the `next`
  # index; use the dispatch input below to check a release branch's index.
  schedule:
    - cron: "0 5 * * *"
  workflow_dispatch:
    inputs:
      catalog_index_image:
        description: "Catalog index image for the plugin sanity job (default: quay.io/rhdh/plugin-catalog-index:<branch version>). Use this for RC verification."
        required: false
        type: string

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

# Both jobs run inside a container, where steps default to `sh -e {0}` rather
# than the runner host's bash, so `[[ ]]` and `=~` are syntax errors. Requesting
# bash also brings `-o pipefail`, which the tee'd test step relies on.
defaults:
  run:
    shell: bash

jobs:
  e2e:
    name: e2e
    runs-on: ubuntu-latest
    # The new schedule/dispatch triggers exist for plugin-sanity; paths filters
    # do not gate those events, so keep this job on its original triggers.
    if: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}
    timeout-minutes: 45
    # Playwright image: browsers + OS deps preinstalled, so no browser-install step
    # (which hung on plain ubuntu runners). Keep the tag in sync with the
    # @playwright/test version in e2e-tests/package.json (currently 1.62.1) — a
    # mismatch fails with "Executable doesn't exist at /ms-playwright/...".
    container:
      image: mcr.microsoft.com/playwright:v1.62.1-noble@sha256:dcc5531e97840b9b5e794f2814476b21571c5124a3fca2267d73041f56e7580e
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up the cluster-free harness
        uses: ./.github/actions/setup-cluster-free-harness

      - name: Populate dynamic-plugins-root (OCI)
        # install-dynamic-plugins pulls the harness plugin set from the public OCI
        # registry (ghcr) via skopeo.
        run: ./e2e-tests/local-harness/populate.sh

      - name: Run cluster-free E2E (legacy app)
        working-directory: ./e2e-tests
        run: yarn e2e:legacy-local

      - name: Upload Playwright report
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: playwright-report-legacy-local
          path: e2e-tests/playwright-report-legacy-local
          retention-days: 7

  plugin-sanity:
    name: plugin-sanity
    runs-on: ubuntu-latest
    timeout-minutes: 20
    # The catalog index is built outside this repo, so a PR here cannot change
    # what this job validates. Keep it on schedule (and dispatch for RC checks);
    # the e2e job above keeps pull_request/push.
    if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
    # Request-only (no browser), but the image also carries the OS deps the
    # backend boot needs, and reusing it keeps both jobs on one base.
    container:
      image: mcr.microsoft.com/playwright:v1.62.1-noble@sha256:dcc5531e97840b9b5e794f2814476b21571c5124a3fca2267d73041f56e7580e
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up the cluster-free harness
        uses: ./.github/actions/setup-cluster-free-harness

      - name: Resolve the catalog index image
        id: index
        env:
          # `next` tracks main; release branches carry their own version tag.
          BRANCH: ${{ github.event.pull_request.base.ref || github.ref_name }}
          OVERRIDE: ${{ inputs.catalog_index_image }}
        run: |
          if [[ -n "${OVERRIDE}" ]]; then
            # Shape-check the dispatch input: it reaches GITHUB_OUTPUT, and a
            # multi-line value there can forge additional step outputs.
            if [[ ! "${OVERRIDE}" =~ ^[A-Za-z0-9._/-]+(:[A-Za-z0-9._-]+)?(@sha256:[a-f0-9]{64})?$ ]]; then
              echo "invalid catalog_index_image: ${OVERRIDE}" >&2
              exit 1
            fi
            image="${OVERRIDE}"
          elif [[ "${BRANCH}" == release-* ]]; then
            image="quay.io/rhdh/plugin-catalog-index:${BRANCH#release-}"
          else
            image="quay.io/rhdh/plugin-catalog-index:next"
          fi
          echo "image=${image}" >> "$GITHUB_OUTPUT"
          # The tag is a moving target; record the digest it resolved to so a
          # later run can be traced back to the exact index it validated.
          digest=$(skopeo inspect --no-creds --override-os linux --override-arch amd64 \
            --format '{{.Digest}}' "docker://${image}" 2> /dev/null || echo "unresolved")
          echo "Catalog index: ${image} (${digest})"
          echo "Catalog index: \`${image}\` @ \`${digest}\`" >> "$GITHUB_STEP_SUMMARY"

      - name: Populate dynamic-plugins-root from the catalog index
        env:
          CATALOG_INDEX_IMAGE: ${{ steps.index.outputs.image }}
        run: ./e2e-tests/local-harness/populate-catalog-index.sh

      - name: Run the plugin sanity check
        id: sanity
        working-directory: ./e2e-tests
        env:
          CATALOG_INDEX_IMAGE: ${{ steps.index.outputs.image }}
        run: |
          set -o pipefail
          yarn e2e:plugin-sanity 2>&1 | tee plugin-sanity.log

      - name: Report plugin startup failures
        # A plugin that throws during init aborts the whole backend; the cause is
        # in the backend log Playwright pipes into the run above, so pull the
        # culprits onto the run summary instead of leaving them mid-log.
        if: ${{ failure() && steps.sanity.conclusion == 'failure' }}
        run: |
          ./e2e-tests/local-harness/filter-plugin-startup-failures.sh \
            < e2e-tests/plugin-sanity.log > /tmp/plugin-startup-failures.txt || true
          if [[ -s /tmp/plugin-startup-failures.txt ]]; then
            {
              echo "### Plugin startup failures"
              echo '```'
              cat /tmp/plugin-startup-failures.txt
              echo '```'
            } >> "$GITHUB_STEP_SUMMARY"
            cat /tmp/plugin-startup-failures.txt
          else
            echo "No dynamic-plugin startup failures found in the backend log."
          fi

      - name: Upload Playwright report
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: playwright-report-plugin-sanity
          path: |
            e2e-tests/playwright-report-plugin-sanity
            e2e-tests/plugin-sanity.log
          retention-days: 7