branch-e2e.yml

name: Branch E2E Checks

on:
  merge_group:
    types: [checks_requested]
  push:
    branches:
      - "pull-request/[0-9]+"
  workflow_dispatch: {}

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  pr_metadata:
    name: Resolve PR metadata
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      should_run: ${{ steps.gate.outputs.should_run }}
      run_core_e2e: ${{ steps.labels.outputs.run_core_e2e }}
      run_gpu_e2e: ${{ steps.labels.outputs.run_gpu_e2e }}
      run_kubernetes_ha_e2e: ${{ steps.labels.outputs.run_kubernetes_ha_e2e }}
      run_kubernetes_credential_drivers_e2e: ${{ steps.labels.outputs.run_kubernetes_credential_drivers_e2e }}
      run_any_e2e: ${{ steps.labels.outputs.run_any_e2e }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - id: gate
        uses: ./.github/actions/pr-gate
      - id: labels
        if: steps.gate.outputs.should_run == 'true'
        env:
          EVENT_NAME: ${{ github.event_name }}
          LABELS_JSON: ${{ steps.gate.outputs.labels_json }}
        shell: bash
        run: |
          set -euo pipefail
          case "$EVENT_NAME" in
            push)
              run_core_e2e="$(jq -r 'index("test:e2e") != null' <<< "$LABELS_JSON")"
              run_gpu_e2e="$(jq -r 'index("test:e2e-gpu") != null' <<< "$LABELS_JSON")"
              run_kubernetes_ha_e2e="$(jq -r 'index("test:e2e-kubernetes") != null' <<< "$LABELS_JSON")"
              run_kubernetes_credential_drivers_e2e="$(jq -r 'index("test:e2e-kubernetes") != null' <<< "$LABELS_JSON")"
              ;;
            merge_group)
              # Merge groups have no PR labels. When GPU E2E is required as documented
              # in CI.md, skipping it leaves the gate pending until the queue times out
              # and ejects the PR. HA stays off until stable.
              run_core_e2e=true
              run_gpu_e2e=true
              run_kubernetes_ha_e2e=false
              run_kubernetes_credential_drivers_e2e=false
              ;;
            *)
              run_core_e2e=true
              run_gpu_e2e=true
              run_kubernetes_ha_e2e=true
              run_kubernetes_credential_drivers_e2e=true
              ;;
          esac
          if [ "$run_core_e2e" = "true" ] || [ "$run_gpu_e2e" = "true" ] || [ "$run_kubernetes_ha_e2e" = "true" ] || [ "$run_kubernetes_credential_drivers_e2e" = "true" ]; then
            run_any_e2e=true
          else
            run_any_e2e=false
          fi
          {
            echo "run_core_e2e=$run_core_e2e"
            echo "run_gpu_e2e=$run_gpu_e2e"
            echo "run_kubernetes_ha_e2e=$run_kubernetes_ha_e2e"
            echo "run_kubernetes_credential_drivers_e2e=$run_kubernetes_credential_drivers_e2e"
            echo "run_any_e2e=$run_any_e2e"
          } >> "$GITHUB_OUTPUT"

  build-gateway:
    needs: [pr_metadata]
    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_any_e2e == 'true'
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/docker-build.yml
    with:
      component: gateway
      image-tag: ${{ github.sha }}

  build-supervisor:
    needs: [pr_metadata]
    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_any_e2e == 'true'
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/docker-build.yml
    with:
      component: supervisor
      image-tag: ${{ github.sha }}

  build-cli:
    needs: [pr_metadata]
    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_any_e2e == 'true'
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/docker-build.yml
    with:
      component: cli
      platform: linux/amd64,linux/arm64

  build-driver-vm-linux:
    needs: [pr_metadata]
    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
    permissions:
      contents: read
      packages: read
    uses: ./.github/workflows/driver-vm-linux.yml
    with:
      image-tag: ${{ github.sha }}
      checkout-ref: ${{ github.sha }}
      runtime-platforms: linux-x86_64
      driver-targets: >-
        [{"arch":"amd64","runner":"linux-amd64-cpu8","target":"x86_64-unknown-linux-gnu","zig_target":"x86_64-unknown-linux-gnu.2.28","platform":"linux-x86_64","guest_arch":"x86_64"}]

  e2e:
    needs: [pr_metadata, build-gateway, build-supervisor, build-cli, build-driver-vm-linux]
    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
    permissions:
      actions: read
      contents: read
      packages: read
    uses: ./.github/workflows/e2e-test.yml
    with:
      image-tag: ${{ github.sha }}
      runner: linux-arm64-cpu8
      cli-artifact-prefix: rust-binary-cli
      gateway-artifact-prefix: rust-binary-gateway
      vm-driver-artifact-name: driver-vm-linux-amd64

  gpu-e2e:
    needs: [pr_metadata, build-gateway, build-supervisor, build-cli]
    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_gpu_e2e == 'true'
    permissions:
      actions: read
      contents: read
      packages: read
    uses: ./.github/workflows/e2e-gpu-test.yaml
    with:
      image-tag: ${{ github.sha }}
      cli-artifact-prefix: rust-binary-cli
      gateway-artifact-prefix: rust-binary-gateway

  kubernetes-e2e:
    needs: [pr_metadata, build-gateway, build-supervisor, build-cli]
    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - agent_sandbox_api: v1beta1
            agent_sandbox_version: v0.5.0
            topology: combined
            extra_helm_values: ""
          - agent_sandbox_api: v1alpha1
            agent_sandbox_version: v0.4.6
            topology: combined
            extra_helm_values: ""
          - agent_sandbox_api: v1beta1
            agent_sandbox_version: v0.5.0
            topology: sidecar
            extra_helm_values: deploy/helm/openshell/ci/values-sidecar.yaml
    permissions:
      actions: read
      contents: read
      packages: read
    uses: ./.github/workflows/e2e-kubernetes-test.yml
    with:
      image-tag: ${{ github.sha }}
      job-name: Kubernetes E2E (Rust smoke, ${{ matrix.topology }}, Agent Sandbox ${{ matrix.agent_sandbox_api }})
      agent-sandbox-version: ${{ matrix.agent_sandbox_version }}
      extra-helm-values: ${{ matrix.extra_helm_values }}
      cli-artifact-prefix: rust-binary-cli

  kubernetes-workspace-managed-e2e:
    needs: [pr_metadata, build-gateway, build-supervisor, build-cli]
    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
    permissions:
      actions: read
      contents: read
      packages: read
    uses: ./.github/workflows/e2e-kubernetes-test.yml
    with:
      image-tag: ${{ github.sha }}
      job-name: Kubernetes E2E (workspace managed mode)
      e2e-task: e2e:kubernetes:workspace-managed
      cli-artifact-prefix: rust-binary-cli

  kubernetes-external-driver-e2e:
    needs: [pr_metadata, build-gateway, build-supervisor, build-cli]
    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
    permissions:
      actions: read
      contents: read
      packages: read
    uses: ./.github/workflows/e2e-kubernetes-test.yml
    with:
      image-tag: ${{ github.sha }}
      job-name: Kubernetes E2E (external compute driver)
      e2e-task: e2e:kubernetes:external-driver
      cli-artifact-prefix: rust-binary-cli

  kubernetes-workspace-operator-e2e:
    needs: [pr_metadata, build-gateway, build-supervisor, build-cli]
    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
    permissions:
      actions: read
      contents: read
      packages: read
    uses: ./.github/workflows/e2e-kubernetes-test.yml
    with:
      image-tag: ${{ github.sha }}
      job-name: Kubernetes E2E (workspace operator mode)
      e2e-task: e2e:kubernetes:workspace-operator
      cli-artifact-prefix: rust-binary-cli

  kubernetes-ha-e2e:
    needs: [pr_metadata, build-gateway, build-supervisor, build-cli]
    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_ha_e2e == 'true'
    permissions:
      actions: read
      contents: read
      packages: read
    uses: ./.github/workflows/e2e-kubernetes-test.yml
    with:
      image-tag: ${{ github.sha }}
      job-name: Kubernetes HA E2E (Rust smoke)
      extra-helm-values: deploy/helm/openshell/ci/values-high-availability.yaml
      external-postgres-secret: openshell-ha-pg
      cli-artifact-prefix: rust-binary-cli

  kubernetes-credential-drivers-e2e:
    needs: [pr_metadata, build-gateway, build-supervisor]
    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_credential_drivers_e2e == 'true'
    permissions:
      actions: read
      contents: read
      packages: read
    uses: ./.github/workflows/e2e-kubernetes-test.yml
    with:
      image-tag: ${{ github.sha }}
      job-name: Kubernetes Credential Drivers E2E
      e2e-task: e2e:kubernetes:credential-drivers

  core-e2e-result:
    name: Core E2E result
    needs: [pr_metadata, build-gateway, build-supervisor, build-cli, build-driver-vm-linux, e2e, kubernetes-e2e, kubernetes-external-driver-e2e, kubernetes-workspace-managed-e2e, kubernetes-workspace-operator-e2e]
    if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Verify core E2E jobs
        env:
          BUILD_GATEWAY_RESULT: ${{ needs.build-gateway.result }}
          BUILD_SUPERVISOR_RESULT: ${{ needs.build-supervisor.result }}
          BUILD_CLI_RESULT: ${{ needs.build-cli.result }}
          BUILD_DRIVER_VM_RESULT: ${{ needs.build-driver-vm-linux.result }}
          E2E_RESULT: ${{ needs.e2e.result }}
          KUBERNETES_E2E_RESULT: ${{ needs.kubernetes-e2e.result }}
          KUBERNETES_EXTERNAL_DRIVER_E2E_RESULT: ${{ needs.kubernetes-external-driver-e2e.result }}
          KUBERNETES_WORKSPACE_MANAGED_E2E_RESULT: ${{ needs.kubernetes-workspace-managed-e2e.result }}
          KUBERNETES_WORKSPACE_OPERATOR_E2E_RESULT: ${{ needs.kubernetes-workspace-operator-e2e.result }}
        run: |
          set -euo pipefail
          failed=0
          for item in \
            "build-gateway:$BUILD_GATEWAY_RESULT" \
            "build-supervisor:$BUILD_SUPERVISOR_RESULT" \
            "build-cli:$BUILD_CLI_RESULT" \
            "build-driver-vm-linux:$BUILD_DRIVER_VM_RESULT" \
            "e2e:$E2E_RESULT" \
            "kubernetes-e2e:$KUBERNETES_E2E_RESULT" \
            "kubernetes-external-driver-e2e:$KUBERNETES_EXTERNAL_DRIVER_E2E_RESULT" \
            "kubernetes-workspace-managed-e2e:$KUBERNETES_WORKSPACE_MANAGED_E2E_RESULT" \
            "kubernetes-workspace-operator-e2e:$KUBERNETES_WORKSPACE_OPERATOR_E2E_RESULT"; do
            name="${item%%:*}"
            result="${item#*:}"
            if [ "$result" != "success" ]; then
              echo "::error::$name concluded $result"
              failed=1
            fi
          done
          exit "$failed"

  gpu-e2e-result:
    name: GPU E2E result
    needs: [pr_metadata, build-gateway, build-supervisor, build-cli, gpu-e2e]
    if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_gpu_e2e == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Verify GPU E2E jobs
        env:
          BUILD_GATEWAY_RESULT: ${{ needs.build-gateway.result }}
          BUILD_SUPERVISOR_RESULT: ${{ needs.build-supervisor.result }}
          BUILD_CLI_RESULT: ${{ needs.build-cli.result }}
          GPU_E2E_RESULT: ${{ needs.gpu-e2e.result }}
        run: |
          set -euo pipefail
          failed=0
          for item in \
            "build-gateway:$BUILD_GATEWAY_RESULT" \
            "build-supervisor:$BUILD_SUPERVISOR_RESULT" \
            "build-cli:$BUILD_CLI_RESULT" \
            "gpu-e2e:$GPU_E2E_RESULT"; do
            name="${item%%:*}"
            result="${item#*:}"
            if [ "$result" != "success" ]; then
              echo "::error::$name concluded $result"
              failed=1
            fi
          done
          exit "$failed"

  kubernetes-ha-e2e-result:
    name: Kubernetes HA E2E result
    needs: [pr_metadata, build-gateway, build-supervisor, build-cli, kubernetes-ha-e2e]
    if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_ha_e2e == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Verify Kubernetes HA E2E jobs
        env:
          BUILD_GATEWAY_RESULT: ${{ needs.build-gateway.result }}
          BUILD_SUPERVISOR_RESULT: ${{ needs.build-supervisor.result }}
          BUILD_CLI_RESULT: ${{ needs.build-cli.result }}
          KUBERNETES_HA_E2E_RESULT: ${{ needs.kubernetes-ha-e2e.result }}
        run: |
          set -euo pipefail
          failed=0
          for item in \
            "build-gateway:$BUILD_GATEWAY_RESULT" \
            "build-supervisor:$BUILD_SUPERVISOR_RESULT" \
            "build-cli:$BUILD_CLI_RESULT" \
            "kubernetes-ha-e2e:$KUBERNETES_HA_E2E_RESULT"; do
            name="${item%%:*}"
            result="${item#*:}"
            if [ "$result" != "success" ]; then
              echo "::error::$name concluded $result"
              failed=1
            fi
          done
          exit "$failed"

  kubernetes-credential-drivers-e2e-result:
    name: Kubernetes Credential Drivers E2E result
    needs: [pr_metadata, build-gateway, build-supervisor, kubernetes-credential-drivers-e2e]
    if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_credential_drivers_e2e == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Verify Kubernetes credential drivers E2E jobs
        env:
          BUILD_GATEWAY_RESULT: ${{ needs.build-gateway.result }}
          BUILD_SUPERVISOR_RESULT: ${{ needs.build-supervisor.result }}
          KUBERNETES_CREDENTIAL_DRIVERS_E2E_RESULT: ${{ needs.kubernetes-credential-drivers-e2e.result }}
        run: |
          set -euo pipefail
          failed=0
          for item in \
            "build-gateway:$BUILD_GATEWAY_RESULT" \
            "build-supervisor:$BUILD_SUPERVISOR_RESULT" \
            "kubernetes-credential-drivers-e2e:$KUBERNETES_CREDENTIAL_DRIVERS_E2E_RESULT"; do
            name="${item%%:*}"
            result="${item#*:}"
            if [ "$result" != "success" ]; then
              echo "::error::$name concluded $result"
              failed=1
            fi
          done
          exit "$failed"