feat: refactor and add Triglav as end-to-end test orchestrator (#117)

* feat: add Triglav as end-to-end test orchestrator

* fix: update Python command to use python3 in Dockerfile and entrypoint script

* feat: add non-git entrypoint test and improve file change detection

* feat: add image mode copy test for Terraform variable management

---------

Co-authored-by: ChristophShyper <45788587+ChristophShyper@users.noreply.github.com>

Author: github-actions[bot]

.github/workflows/auto-pull-request-create.yml

@@ -9,9 +9,10 @@ on:
       - dependabot/**
 
 permissions:
-  contents: read
+  contents: write
   packages: write
   pull-requests: write
+  issues: write
 
 jobs:
   call:

.github/workflows/auto-release-create.yml

@@ -21,7 +21,8 @@ on:
 permissions:
   contents: write
   packages: write
-  pull-requests: read
+  pull-requests: write
+  issues: write
 
 jobs:
   call:

.github/workflows/manual-e2e-validate.yml

@@ -0,0 +1,30 @@
+name: (Manual) E2E Validate
+
+on:
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: Validation mode
+        required: false
+        default: image
+        type: choice
+        options:
+          - image
+          - ref
+      image_tag:
+        description: Image tag used when mode=image (for example v1.2.3-test or v1.2.3-rc)
+        required: false
+        default: ""
+        type: string
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  e2e:
+    uses: devops-infra/triglav/.github/workflows/e2e-action-terraform-copy-vars.yml@master
+    with:
+      mode: ${{ inputs.mode }}
+      image_tag: ${{ inputs.image_tag }}
+    secrets: inherit

.github/workflows/manual-release-branch-prepare.yml

@@ -27,6 +27,7 @@ permissions:
   contents: write
   packages: write
   pull-requests: write
+  issues: write
 
 jobs:
   call:

Dockerfile

@@ -20,6 +20,6 @@ RUN chmod +x /entrypoint.sh ;\
   rm -rf /var/lib/apt/lists/*
 
 # Finish up
-CMD ["python", "--version"]
+CMD ["python3", "--version"]
 WORKDIR /github/workspace
 ENTRYPOINT ["/entrypoint.sh"]

README.md

@@ -76,7 +76,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
 
     - name: Fail on different variables' definitions
       uses: devops-infra/action-terraform-copy-vars@v1.0.2
@@ -95,7 +95,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
 
     - name: Update Terraform variables
       uses: devops-infra/action-terraform-copy-vars@v1.0.2
@@ -125,7 +125,7 @@ jobs:
   terraform-copy-vars:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - uses: devops-infra/action-terraform-copy-vars@v1.0.2
         id: pin-patch
@@ -152,6 +152,29 @@ If you have any questions or need help, please:
 - 📝 Create an [issue](https://github.com/devops-infra/action-terraform-copy-vars/issues)
 - 🌟 Star this repository if you find it useful!
 
+## 🧪 End-to-End Validation
+Use the manual workflow `.github/workflows/manual-e2e-validate.yml` to validate this action against the centralized E2E repository.
+
+- `mode=image` validates a published image tag (recommended for `-test` and `-rc` release checks).
+- `mode=ref` validates ref-oriented E2E paths against stable pinned action refs.
+
+CI/CD automation also runs these E2E checks automatically:
+
+- Pull requests: E2E validation runs through reusable org workflows.
+- Release branch prepare: E2E validation runs against release candidate artifacts (`-rc`).
+- Release create: E2E validation runs against production release artifacts.
+
+Example trigger inputs:
+
+```text
+mode=ref
+```
+
+```text
+mode=image
+image_tag=v1.2.3-test
+```
+
 ## Forking
 To publish images from a fork, set these variables so Task uses your registry identities:
 `DOCKER_USERNAME`, `DOCKER_ORG_NAME`, `GITHUB_USERNAME`, `GITHUB_ORG_NAME`.

Taskfile.cicd.yml

@@ -10,6 +10,22 @@ tasks:
     cmds:
       - pre-commit run --all-files
 
+  test:
+    desc: Run repository tests
+    cmds:
+      - task: test:entrypoint:non-git
+      - task: test:image-mode:copy
+
+  test:entrypoint:non-git:
+    desc: Validate entrypoint execution outside git repository
+    cmds:
+      - task: scripts:test:entrypoint:non-git
+
+  test:image-mode:copy:
+    desc: Validate image mode appends missing variables
+    cmds:
+      - task: scripts:test:image-mode:copy
+
   pre-commit:install:
     desc: Install pre-commit hooks
     cmds:

Taskfile.scripts.yml

@@ -74,6 +74,38 @@ tasks:
           exit $rc
         fi
 
+  test:entrypoint:non-git:
+    desc: Validate entrypoint execution outside git repository
+    cmds:
+      - |
+        echo "▶️ Running non-git entrypoint test..."
+        set +e
+        ./tests/scripts/entrypoint-non-git-test.sh
+        rc=$?
+        set -e
+        if [ "$rc" -eq 0 ]; then
+          echo "✅ non-git entrypoint test passed"
+        else
+          echo "❌ non-git entrypoint test failed"
+          exit $rc
+        fi
+
+  test:image-mode:copy:
+    desc: Validate image mode appends missing variables
+    cmds:
+      - |
+        echo "▶️ Running image-mode copy test..."
+        set +e
+        ./tests/scripts/image-mode-copy-test.sh
+        rc=$?
+        set -e
+        if [ "$rc" -eq 0 ]; then
+          echo "✅ image-mode copy test passed"
+        else
+          echo "❌ image-mode copy test failed"
+          exit $rc
+        fi
+
   dependency:update:
     desc: 'No-op: no dedicated dependency updater configured for this profile'
     cmds:

entrypoint.sh

@@ -6,11 +6,17 @@ set -e
 RET_CODE=0
 
 # Run main action
-python /terraform-copy-vars.py
+python3 /terraform-copy-vars.py
 RET_CODE=$?
 
 # List of changed files
-FILES_CHANGED=$(git diff --staged --name-status)
+FILES_CHANGED=""
+if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  FILES_CHANGED=$(git diff --cached --name-status 2>/dev/null || true)
+  if [[ -z ${FILES_CHANGED} ]]; then
+    FILES_CHANGED=$(git diff --name-status 2>/dev/null || true)
+  fi
+fi
 
 # Info about changed files
 if [[ -n ${FILES_CHANGED} ]]; then