feat(nuxt-cloudflare): E2E off the pull request, mode: e2e, audit warns on PRs

[loganrenz]

What

Fast CI + ship program, lane E2E-CALLABLE. Logan (2026-09-29): E2E skips on PRs, runs after each merge (newest wins) plus nightly, one org switch; pnpm audit warns on PRs and blocks on main + nightly.

1. vars.CI_E2E_IN_CI == 'false' skips E2E plan, E2E and E2E quarantine on every event; Required reads the skip as success (a lane that runs anyway still fails it). Unset or any other value changes nothing, so this merge alone changes no behaviour. Build also stops packing the prebuilt app for E2E, and the folded-gate condition follows the switch.
2. mode: e2e (default ci), for a caller workflow named E2E: Build -> E2E plan -> E2E (+ quarantine) and Required as the verdict; every other lane, the Caller lint and the audit are skipped, the var is ignored, and the plan never path-skips (a newer push cancels the run, so no diff can prove a skip). Required is red for an unknown mode, run-e2e not true, journey-smoke-url set, or any E2E lane failing/cancelled/skipped without the plan's say-so. README section "E2E off the pull request" carries the caller YAML (push main, nightly cron, workflow_dispatch, concurrency: {group: e2e-<repo>, cancel-in-progress: true}) and the listener YAML.
3. Audit: pull_request / pull_request_target turn the failure into ::warning:: (advisory list kept, step passes); push, schedule, workflow_dispatch still fail.
4. red-main: red-main-self.yml and the listener template also act on schedule runs on the default branch (and list workflows: ["CI", "E2E"]).

Verify (Opus)

One blocker, fixed in d05c9c9: with CI_E2E_IN_CI=false a PR minted a Required proof although E2E never ran (the proof key omits the variable, so a rollback or repo override would let the push reuse it and go green without E2E). The mint condition reads the raw run-e2e again; test_e2e_mode.py has a test (mutation-checked). Also: README notes case-insensitivity, proof-key comment corrected.

Judgement call to review

The brief says the var skips E2E "on any event". I did not let it override e2e-full-paths (acre-oracle style protected-path escalation) or expected-candidate-sha (release validation): both are explicit promises to run browsers, and the gates behind them fail closed if the lane is silently skipped. Unset/other behaviour is unchanged. If Logan wants the var to win over them too, it is one term in the E2E_ON expression.

Checks run (nice, targeted; no ci-local)

Check	Result	Time
actionlint -no-color -oneline .github/workflows/*.yml	pass	<2s
python3 scripts/lint_callables.py	11 files, 0 findings	0.2s
every scripts/test_*.py (30 modules, incl. new test_e2e_mode.py, extended test_dependency_audit.py 44 cases, test_red_main_listener.py)	all rc=0 (one fix: test_package_auth_cleanup.py expectation, rerun green)	2m01s sweep
ruff check scripts/test_e2e_mode.py	pass (pre-existing unused imports in two older test files untouched)	<1s
mutation checks of test_e2e_mode.py (var honoured in e2e mode, path-skip in e2e mode, mode in proof key, gate accepting run-e2e false, dropped escalation exception)	all 5 caught	-

test_e2e_mode.py is wired into ci.yml after the fast-path contract tests.

Canary (cloudflarestat-us, PR #32 pinned to this branch's SHA, unmerged, closed after)

cloudflarestat-us, PR https://github.com/narduk-enterprises/cloudflarestat-us/pull/32 (unmerged, closed after), ci.yml and a canary-only e2e.yml pinned to head d05c9c9. Repo-level variable CI_E2E_IN_CI=false (no org variable).

• PR run, E2E off: https://github.com/narduk-enterprises/cloudflarestat-us/actions/runs/36643960200 -- Build success, E2E plan, E2E and E2E quarantine skipped, Required success.
• mode: e2e run (push, workflow E2E, variable still false and ignored): https://github.com/narduk-enterprises/cloudflarestat-us/actions/runs/36643955699 -- Build, E2E plan, E2E shards 1-3 success, every other lane skipped, Required success.
• Newest wins: the earlier E2E run on the previous canary commit (https://github.com/narduk-enterprises/cloudflarestat-us/actions/runs/36643359129) was cancelled mid-shards by the next push (concurrency group e2e-<repo>).
• Found by the canary: the app's own format:check covers .github/workflows, so the stamped e2e.yml must be Prettier-formatted (single-quoted cron); README caller YAML updated.

Rollout

Exact per-app e2e.yml and listener change are in the README section above. After merge, v2 is advanced by hand per the README. No org variable is set by this PR; the orchestrator flips CI_E2E_IN_CI when the per-app E2E callers are in.

🤖 Generated with Claude Code