e2e.yaml

---
name: E2E Tests

# Trigger design (intentional — do not "fix" by running e2e on PR events):
#
# The e2e matrix is slow, so it must not run on every push to a PR. It runs
# once per PR, via manual workflow_dispatch by a maintainer, when the PR is
# ready to merge.
#
# To gate merging on that manual run, every PR event sets the "e2e" commit
# status to pending (set-pending job), and the dispatched run reports the
# result back (report-status job) so the merge check can pass.
#
# pull_request_target is only used because posting a commit status requires
# a write-capable GITHUB_TOKEN, also for fork PRs. Since that token is
# privileged, the set-pending job must never check out or execute PR code.

on:
  workflow_dispatch:
  pull_request_target:

permissions: {}

jobs:

  set-pending:
    if: github.event_name == 'pull_request_target'
    runs-on: ubuntu-latest
    name: Set pending e2e status
    permissions:
      statuses: write  # for gh api to set the commit status
    steps:
      - name: Set pending e2e status
        run: |
          gh api "repos/${REPO}/statuses/${HEAD_SHA}" \
            -f state="pending" \
            -f context="e2e" \
            -f description="E2E tests must be triggered manually via workflow_dispatch"
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}

  e2e:
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
      contents: read  # for actions/checkout to fetch code
    timeout-minutes: ${{ matrix.timeout || 5 }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Fedora 43
            test: TestFedora
            release: "43"
          - name: CentOS Stream 10
            test: TestCentOSStream
            release: "10"
          - name: AlmaLinux 10
            test: TestAlmaLinux
            release: "10"
          - name: Rocky Linux 10
            test: TestRockyLinux
            release: "10"
          - name: Debian trixie
            test: TestDebian
            release: trixie
          - name: Ubuntu noble
            test: TestUbuntu
            release: noble
          - name: Arch Linux latest
            test: TestArch
            release: latest
          - name: Gentoo latest
            test: TestGentoo
            release: latest
            timeout: 10

    name: ${{ matrix.name }}

    steps:

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: 'stable'
          check-latest: true

      - name: Run e2e test
        env:
          E2E_RELEASE: ${{ matrix.release }}
          CONTAINER_RUNTIME: docker
        run: go test -tags e2e -v -race -timeout ${{ matrix.timeout || 5 }}m -run ${{ matrix.test }} ./test/e2e/

  report-status:
    if: always() && github.event_name == 'workflow_dispatch'
    needs: [e2e]
    runs-on: ubuntu-latest
    name: Report e2e status
    permissions:
      statuses: write  # for gh api to set the commit status
    steps:
      - name: Report e2e status
        run: |
          case "${{ needs.e2e.result }}" in
            success)
              state="success"
              description="All E2E tests passed"
              ;;
            cancelled)
              state="error"
              description="E2E tests were cancelled"
              ;;
            skipped)
              state="error"
              description="E2E tests were skipped"
              ;;
            *)
              state="failure"
              description="E2E tests failed"
              ;;
          esac
          gh api "repos/${{ github.repository }}/statuses/${{ github.sha }}" \
            -f state="$state" \
            -f context="e2e" \
            -f description="$description"
        env:
          GH_TOKEN: ${{ github.token }}