e2e.yml

name: e2e

# Phase 45 Plan 05：v3.6 端到端测试体系 CI 守护。
#
# 双 job 结构：
#   1. lint — 永远跑（不依赖 docker）：bash -n + lint-no-bare-sleep + go vet + go build
#   2. e2e  — 仅在 lint 通过后跑：go test -tags=e2e ./tests/e2e/... -count=1
#
# 触发策略：PR paths 过滤 + push to main；命中 tests/e2e/ 或可能影响 e2e 的源码
# 路径时强制跑且 block PR merge（CONTEXT.md §Area 3 已锁定）。
#
# 失败时自动 actions/upload-artifact@v4 归档 ./out/e2e-artifacts/，
# 并通过 actions/github-script@v7 在 PR 评论里贴下载入口（中文）。
#
# 注：CONTEXT.md §Area 3 已把 ROADMAP §E2E-03 草稿中 "self-hosted Linux runner"
# 调整为 hosted ubuntu-24.04（理由：与 uat-bypass.yml 同款、免运维、当前用例规模可承载）；
# 调整记录在 Phase 45 SUMMARY，未来若用例规模触及 hosted runner 性能瓶颈再评估迁移。
#
# 已知限制：actions/github-script@v7 在 fork PR 上 GITHUB_TOKEN 权限被强制降级为
# read，PR 评论会 403；artifact 上传仍正常。仅同仓 PR 享受自动评论。

# v4.0 (Phase 56): 扩面 paths filter，新增 internal/controlplane/http/ store/ deploy/docker/ Makefile go.mod go.sum
on:
  pull_request:
    paths:
      - "tests/e2e/**"
      - "internal/network/**"
      - "internal/controlplane/http/**"
      - "internal/store/**"
      - "internal/runtime/**"
      - "internal/agent/**"
      - "internal/agentapi/**"
      - "cmd/host-agent/**"
      - "cmd/control-plane/**"
      - "deploy/docker/**"
      - "Makefile"
      - "go.mod"
      - "go.sum"
      - "scripts/lint-no-bare-sleep.sh"
      - ".github/workflows/e2e.yml"
  push:
    branches: [main]

permissions:
  contents: read
  pull-requests: write   # 失败时 actions/github-script 发 PR 评论需要

concurrency:
  group: e2e-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: lint (bash + go vet + lint-no-bare-sleep)
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: bash -n lint-no-bare-sleep
        run: bash -n scripts/lint-no-bare-sleep.sh

      - name: Run lint-no-bare-sleep
        run: bash scripts/lint-no-bare-sleep.sh

      - name: go vet (e2e)
        run: go vet -tags=e2e ./tests/e2e/...

      - name: go build (e2e)
        run: go build -tags=e2e ./tests/e2e/...

  e2e:
    name: e2e (ubuntu-24.04)
    runs-on: ubuntu-24.04
    needs: lint
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Install apt prerequisites (nft / dnsutils / jq / curl)
        run: |
          sudo apt-get update -y
          sudo apt-get install -y nftables dnsutils jq curl

      - name: go build (main binaries)
        run: go build ./...

      - name: Run e2e suite
        env:
          CLOUD_CLI_PROXY_E2E_ARTIFACT_DIR: ./out/e2e-artifacts
        run: go test -tags=e2e ./tests/e2e/... -count=1 -v -timeout=15m

      # Phase 52 OBS-03：失败时跑一次脚本级全局快照（CI runner 视角，与
      # 单用例级 ArtifactDumper 输出并存）。DATABASE_URL 未透传时 postgres
      # 采集会优雅跳过；其它 4 子目录（logs/network/docker/system）在
      # hosted ubuntu-24.04 runner 上有真实输出。
      - name: Collect e2e artifacts on failure (script)
        if: failure()
        run: |
          bash tests/e2e/harness/collect-artifacts.sh \
            ./out/e2e-artifacts \
            ci-${{ github.job }}-${{ github.run_attempt }}

      - name: Upload artifacts on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: e2e-artifacts-${{ github.run_id }}-${{ github.run_attempt }}
          path: ./out/e2e-artifacts/
          if-no-files-found: warn
          retention-days: 30

      - name: Comment artifact link on PR (failure)
        if: failure() && github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const runUrl = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
            const body = [
              '### ❌ e2e 失败 — 排障证据已归档',
              '',
              `**Run:** ${runUrl}`,
              '',
              `**Artifact 名称：** \`e2e-artifacts-${process.env.GITHUB_RUN_ID}-${process.env.GITHUB_RUN_ATTEMPT}\``,
              '',
              '点开上面的 Run 链接，滚到 "Artifacts" 段下载 zip；解压后在五子目录中查看：',
              '- `logs/` 容器日志（docker logs --tail 500 --timestamps）',
              '- `network/` nft list ruleset / ip route / ss -tln',
              '- `docker/` docker ps -a / inspect-<name>.json',
              '- `postgres/` pg_dump --schema-only + key 表 SELECT（不含敏感列）',
              '- `system/` uname / free / df / dmesg tail + wait-timeout.txt 备忘',
              '',
              '每个子目录内都有自己的 `README.md`（中文，含具体排障指引）。',
              '同一 artifact 内会有两类目录：',
              '- `<test-name>/<timestamp>/` 单用例级（ArtifactDumper 写）',
              '- `ci-<job>-<attempt>/` CI runner 全局快照（脚本 if: failure() 跑一遍）',
            ].join('\n');
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body,
            });