kandev/.github/workflows/e2e-tests.yml

name: E2E Tests

on:
  push:
    branches: [main]
    paths:
      - "apps/backend/**"
      - "apps/desktop/**"
      - "apps/web/**"
      - "apps/packages/**"
      - "apps/pnpm-lock.yaml"
      - "apps/pnpm-workspace.yaml"
      - ".github/workflows/e2e-tests.yml"
      - "!**/*.md"
  pull_request:
    branches: [main]
    paths:
      - "apps/backend/**"
      - "apps/desktop/**"
      - "apps/web/**"
      - "apps/packages/**"
      - "apps/pnpm-lock.yaml"
      - "apps/pnpm-workspace.yaml"
      - ".github/workflows/e2e-tests.yml"
      - "!**/*.md"
  # Manual trigger for verifying CI on draft PRs and ad-hoc reruns. The
  # default sharded run uses the same ref the user picks in the dispatch UI.
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  # Required so the containerized build / e2e shards / e2e-report jobs can
  # pull the kandev-ci image from GHCR via GITHUB_TOKEN.
  packages: read

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    # Pre-baked image bundles Go, Node 24, pnpm 9.15.9 — see
    # .github/docker/ci-base/Dockerfile. Uses the `build` tag (with Go)
    # because this job compiles the backend.
    container: ghcr.io/kdlbs/kandev-ci:build-latest
    timeout-minutes: 10
    # Container jobs default to `sh`; pin to bash for the few shell steps below.
    defaults:
      run:
        shell: bash

    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Mark workspace safe for git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      # Inside the container the home dir is /root, so the pnpm store lives at
      # /root/.local/share/pnpm/store. actions/cache resolves `~` against $HOME
      # so the same path string works for both the host and container variants.
      - name: Cache pnpm store
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ~/.local/share/pnpm/store
          key: pnpm-${{ runner.os }}-${{ hashFiles('apps/pnpm-lock.yaml') }}
          restore-keys: pnpm-${{ runner.os }}-

      - name: Install dependencies
        working-directory: apps
        run: pnpm install --frozen-lockfile

      - name: Build backend and web
        run: make build-backend build-web

      # Linux/amd64 helper binaries (agentctl + mock-agent) bind-mounted into
      # containers by the Docker E2E project. Cheap to build (~1s each) so we
      # always do it; the regular E2E job ignores them.
      - name: Build Docker E2E helper binaries
        run: make build-backend-linux-helpers

      - name: Upload backend build
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
        with:
          name: e2e-backend-build
          path: apps/backend/bin/
          retention-days: 1

      # Tar the Vite dist directory so shards can reuse the same static web build.
      - name: Package web build
        run: tar -cf apps/web/web-dist.tar -C apps/web dist

      - name: Upload web build
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
        with:
          name: e2e-web-build
          path: apps/web/web-dist.tar
          retention-days: 1

  e2e:
    name: E2E Shard ${{ matrix.shard }}/14
    needs: build
    runs-on: ubuntu-latest
    # Pre-baked image bundles Node 24, pnpm 9.15.9, and the Playwright browser
    # binaries (Chromium etc.) — see .github/docker/ci-base/Dockerfile. This is
    # the biggest speedup since `npx playwright install chromium --with-deps`
    # alone took ~1.5–2 min per shard.
    #
    # `--ipc=host` is required for Chromium: the default container `/dev/shm`
    # is only ~64MiB, which causes tabs to slow to a crawl and renderers to
    # crash mid-test.
    # Uses the `runtime` tag — no Go toolchain needed; the shards consume the
    # pre-built backend artifact from the `build` job. ~600 MB smaller pull
    # than the build image, saves ~20s per shard at startup.
    container:
      image: ghcr.io/kdlbs/kandev-ci:runtime-latest
      options: --ipc=host
    # 25 min (was 22) — leaves room for the worst-case "every shard hits a few
    # flake-retries" combination without blowing past the cap. Average shard
    # runs ~10 min, so this only kicks in when something is going wrong.
    timeout-minutes: 25
    # Container jobs default to `sh`; pin to bash.
    defaults:
      run:
        shell: bash
    # Keep localhost resolution deterministic for Node fetches used by the
    # Playwright fixtures and backend readiness polling.
    env:
      NODE_OPTIONS: --dns-result-order=ipv4first
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14]

    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Mark workspace safe for git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Cache pnpm store
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ~/.local/share/pnpm/store
          key: pnpm-${{ runner.os }}-${{ hashFiles('apps/pnpm-lock.yaml') }}
          restore-keys: pnpm-${{ runner.os }}-

      - name: Install dependencies
        working-directory: apps
        run: pnpm install --frozen-lockfile

      - name: Download backend build
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
        with:
          name: e2e-backend-build
          path: apps/backend/bin/

      - name: Make backend binaries executable
        run: chmod +x apps/backend/bin/*

      - name: Download web build
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
        with:
          name: e2e-web-build
          path: apps/web/

      - name: Extract web build
        working-directory: apps/web
        run: tar -xf web-dist.tar && rm web-dist.tar

      # Pinned to chromium + mobile-chrome so the dedicated `e2e-containers`
      # job below owns the real-Docker project (which covers both the Docker
      # executor and the SSH executor's sshd target). Without --project the
      # container-bound specs would run here too, fail seeding (Docker not
      # enabled for these shards), and spam every shard.
      - name: Run E2E tests (shard ${{ matrix.shard }}/14)
        working-directory: apps/web
        run: npx playwright test --config e2e/playwright.config.ts --project=chromium --project=mobile-chrome --shard=${{ matrix.shard }}/14

      - name: Upload blob report
        if: always()
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
        with:
          name: blob-report-${{ matrix.shard }}
          path: apps/web/e2e/blob-report/
          retention-days: 3

      - name: Upload test results
        if: failure()
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
        with:
          name: test-results-${{ matrix.shard }}
          path: apps/web/e2e/test-results/
          retention-days: 7

  # Real-Docker E2E: exercises the local_docker executor end-to-end.
  # ubuntu-latest ships with Docker preinstalled, so no service container is
  # required. Container-bound tests are slow (~2 min each), so we shard across
  # 6 runners — Playwright's --shard splits the project's tests into N groups.
  # Cleans up any leftover kandev-managed containers at the end so a leaky
  # process doesn't poison the next run on the same self-hosted runner.
  #
  # This job runs the `containers` Playwright project, which covers both the
  # Docker executor and the SSH executor (since the SSH executor's e2e tests
  # also rely on Docker to host a real sshd container as the remote target).
  # Sharded 6 ways — each shard is its own runner. See apps/web/e2e/README.md.
  e2e-containers:
    name: E2E Containers Shard ${{ matrix.shard }}/6
    needs: build
    # This job intentionally runs on the host ubuntu runner (NOT the kandev-ci
    # container image): the containers project needs direct access to the
    # host Docker daemon, and a docker-in-docker setup would break the tests'
    # host-style bind mounts (paths under os.tmpdir() inside a runner container
    # wouldn't exist on the host where the docker daemon resolves them).
    # We still avoid the slow `playwright install --with-deps` step by copying
    # browsers out of the kandev-ci image — see the extract step below.
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4, 5, 6]

    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Verify Docker is available
        run: docker info

      - name: Set up pnpm
        uses: pnpm/action-setup@a8198c4bff370c8506180b035930dea56dbd5288 # v5
        with:
          version: "9.15.9"

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: "24"

      - name: Cache pnpm store
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ~/.local/share/pnpm/store
          key: pnpm-${{ runner.os }}-${{ hashFiles('apps/pnpm-lock.yaml') }}
          restore-keys: pnpm-${{ runner.os }}-

      - name: Install dependencies
        working-directory: apps
        run: pnpm install --frozen-lockfile

      # Required for the docker pull below to succeed even if the kandev-ci
      # package is private on GHCR. The `e2e` / `e2e-report` jobs above don't
      # need this because GitHub's `container:` integration handles auth
      # implicitly using GITHUB_TOKEN.
      - name: Log in to GHCR
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Skip the Playwright CDN download (~7 min and an outage-prone path) by
      # copying the prebaked chromium out of the kandev-ci image, which is
      # `FROM mcr.microsoft.com/playwright:...` and already ships the matching
      # browser at /ms-playwright. Pulling the `runtime` tag (matches the
      # `e2e` / `e2e-report` jobs above) — the `build` tag has the same
      # browser layer but is ~300 MB larger because of the Go toolchain.
      - name: Extract Playwright browsers from kandev-ci image
        run: |
          set -euo pipefail
          docker pull ghcr.io/kdlbs/kandev-ci:runtime-latest
          mkdir -p /tmp/ms-playwright
          docker run --rm \
            -v /tmp/ms-playwright:/dest \
            ghcr.io/kdlbs/kandev-ci:runtime-latest \
            cp -a /ms-playwright/. /dest/
          echo "PLAYWRIGHT_BROWSERS_PATH=/tmp/ms-playwright" >> "$GITHUB_ENV"

      # Browser binaries come from the image above. GitHub's Ubuntu runners
      # usually already have the shared libs Chromium needs, so smoke-test the
      # copied browser first and only hit apt as a bounded fallback.
      - name: Verify Playwright browser runtime
        working-directory: apps/web
        run: |
          set -euo pipefail

          smoke_test() {
            node <<'NODE'
          const { chromium } = require("@playwright/test");

          (async () => {
            const browser = await chromium.launch({ headless: true });
            const page = await browser.newPage();
            await page.goto("data:text/html,ok");
            await browser.close();
          })().catch((error) => {
            console.error(error);
            process.exit(1);
          });
          NODE
          }

          if smoke_test; then
            echo "Playwright Chromium launches with existing runner packages."
            exit 0
          fi

          echo "::warning::Playwright Chromium failed to launch; installing missing host packages."
          timeout 180s npx playwright install-deps chromium
          smoke_test

      - name: Download backend build
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
        with:
          name: e2e-backend-build
          path: apps/backend/bin/

      - name: Make backend binaries executable
        run: chmod +x apps/backend/bin/*

      - name: Download web build
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
        with:
          name: e2e-web-build
          path: apps/web/

      - name: Extract web build
        working-directory: apps/web
        run: tar -xf web-dist.tar && rm web-dist.tar

      - name: Run container-backed E2E tests shard ${{ matrix.shard }}/6 (Docker executor + SSH executor)
        working-directory: apps/web
        env:
          KANDEV_E2E_CONTAINERS: "1"
        run: npx playwright test --config e2e/playwright.config.ts --project=containers --shard=${{ matrix.shard }}/6

      - name: Cleanup leftover kandev containers
        if: always()
        run: docker ps -aq --filter label=kandev.managed=true | xargs -r docker rm -f

      # Named with the same `blob-report-*` prefix the merge job globs for
      # so the containers results land in the unified HTML report alongside
      # the sharded chromium/mobile-chrome runs.
      - name: Upload containers blob report
        if: always()
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
        with:
          name: blob-report-containers-${{ matrix.shard }}
          path: apps/web/e2e/blob-report/
          retention-days: 3

      - name: Upload containers E2E results
        if: failure()
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
        with:
          name: containers-e2e-test-results-${{ matrix.shard }}
          path: apps/web/e2e/test-results/
          retention-days: 7

  desktop-e2e:
    name: Desktop E2E Smoke
    runs-on: ubuntu-latest
    # Includes Ubuntu WebKit/Tauri system package installation; GitHub apt mirrors
    # can spend more than 20 minutes there before tests start.
    timeout-minutes: 45
    defaults:
      run:
        shell: bash

    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Set up pnpm
        uses: pnpm/action-setup@a8198c4bff370c8506180b035930dea56dbd5288 # v5
        with:
          version: "9.15.9"

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: "24"
          cache: pnpm
          cache-dependency-path: apps/pnpm-lock.yaml

      - name: Set up Rust
        run: rustup toolchain install stable --profile minimal

      - name: Cache Rust build
        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
        with:
          workspaces: apps/desktop/src-tauri -> target
          key: desktop-e2e

      - name: Install desktop system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            pkg-config \
            libglib2.0-dev \
            libwebkit2gtk-4.1-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            patchelf \
            xvfb

      - name: Install dependencies
        working-directory: apps
        run: pnpm install --frozen-lockfile

      - name: Run desktop smoke
        working-directory: apps
        run: pnpm --filter @kandev/desktop e2e

  e2e-report:
    name: Merge E2E Reports
    needs: [e2e, e2e-containers, desktop-e2e]
    if: always()
    runs-on: ubuntu-latest
    # Pre-baked image bundles Node 24, pnpm 9.15.9, and the Playwright CLI.
    # `runtime` tag — no Go needed for merging blob reports.
    container: ghcr.io/kdlbs/kandev-ci:runtime-latest
    timeout-minutes: 5
    # Container jobs default to `sh`; pin to bash.
    defaults:
      run:
        shell: bash

    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Mark workspace safe for git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Cache pnpm store
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ~/.local/share/pnpm/store
          key: pnpm-${{ runner.os }}-${{ hashFiles('apps/pnpm-lock.yaml') }}
          restore-keys: pnpm-${{ runner.os }}-

      - name: Install dependencies
        working-directory: apps
        run: pnpm install --frozen-lockfile

      - name: Download blob reports
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
        with:
          path: apps/web/e2e/blob-reports
          pattern: blob-report-*
          merge-multiple: true

      - name: Merge reports
        working-directory: apps/web
        # `-c e2e/playwright.config.ts` is required because the blobs come from
        # two different absolute checkout paths: the containerized `e2e` shards
        # check out under `/__w/...` while `e2e-containers` runs on the host
        # runner and checks out under `/home/runner/work/...`. Playwright
        # embeds the absolute testDir in each blob and refuses to merge
        # reports recorded with different test directories — passing the
        # config makes it normalize against the config's `testDir` instead.
        run: npx playwright merge-reports --config e2e/playwright.config.ts --reporter=html ./e2e/blob-reports

      - name: Upload merged report
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
        with:
          name: playwright-report
          path: apps/web/playwright-report/
          retention-days: 14

      - name: Verify required E2E jobs passed
        if: always()
        env:
          E2E_RESULT: ${{ needs.e2e.result }}
          E2E_CONTAINERS_RESULT: ${{ needs['e2e-containers'].result }}
          DESKTOP_E2E_RESULT: ${{ needs['desktop-e2e'].result }}
        run: |
          set -euo pipefail
          if [ "$E2E_RESULT" != "success" ]; then
            echo "e2e finished with result: $E2E_RESULT" >&2
            exit 1
          fi
          if [ "$E2E_CONTAINERS_RESULT" != "success" ]; then
            echo "e2e-containers finished with result: $E2E_CONTAINERS_RESULT" >&2
            exit 1
          fi
          if [ "$DESKTOP_E2E_RESULT" != "success" ]; then
            echo "desktop-e2e finished with result: $DESKTOP_E2E_RESULT" >&2
            exit 1
          fi