e2e-tests.yml

name: E2E Tests

on:
  push:
    branches: [main]
    paths:
      - "apps/backend/**"
      - "apps/web/**"
      - "apps/packages/**"
      - "apps/pnpm-lock.yaml"
      - ".github/workflows/e2e-tests.yml"
      - "!**/*.md"
  pull_request:
    branches: [main]
    paths:
      - "apps/backend/**"
      - "apps/web/**"
      - "apps/packages/**"
      - "apps/pnpm-lock.yaml"
      - ".github/workflows/e2e-tests.yml"
      - "!**/*.md"
  # Manual trigger for verifying CI on draft PRs and ad-hoc reruns. The
  # default sharded run uses the same ref the user picks in the dispatch UI.
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: apps/backend/go.mod
          cache-dependency-path: apps/backend/go.sum

      - name: Set up pnpm
        uses: pnpm/action-setup@v5
        with:
          version: "9.15.9"

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "24"

      - name: Install dependencies
        working-directory: apps
        run: pnpm install --frozen-lockfile

      - name: Build backend and web
        run: make build-backend build-web

      # Linux/amd64 helper binaries (agentctl + mock-agent) bind-mounted into
      # containers by the Docker E2E project. Cheap to build (~1s each) so we
      # always do it; the regular E2E job ignores them.
      - name: Build Docker E2E helper binaries
        run: make build-backend-linux-helpers

      - name: Upload backend build
        uses: actions/upload-artifact@v5
        with:
          name: e2e-backend-build
          path: apps/backend/bin/
          retention-days: 1

      # Tar the .next directory to preserve pnpm symlinks in the standalone build.
      # upload-artifact dereferences symlinks which breaks the Node.js module resolution.
      - name: Package web build
        run: tar -cf apps/web/next-build.tar -C apps/web .next

      - name: Upload web build
        uses: actions/upload-artifact@v5
        with:
          name: e2e-web-build
          path: apps/web/next-build.tar
          retention-days: 1

  e2e:
    name: E2E Shard ${{ matrix.shard }}/10
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 22
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up pnpm
        uses: pnpm/action-setup@v5
        with:
          version: "9.15.9"

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "24"

      - name: Install dependencies
        working-directory: apps
        run: pnpm install --frozen-lockfile

      - name: Install Playwright browsers
        working-directory: apps/web
        run: npx playwright install chromium --with-deps

      - name: Download backend build
        uses: actions/download-artifact@v5
        with:
          name: e2e-backend-build
          path: apps/backend/bin/

      - name: Make backend binaries executable
        run: chmod +x apps/backend/bin/*

      - name: Download web build
        uses: actions/download-artifact@v5
        with:
          name: e2e-web-build
          path: apps/web/

      - name: Extract web build
        working-directory: apps/web
        run: tar -xf next-build.tar && rm next-build.tar

      # Pinned to chromium + mobile-chrome so the dedicated `e2e-containers`
      # job below owns the real-Docker project (which covers both the Docker
      # executor and the SSH executor's sshd target). Without --project the
      # container-bound specs would run here too, fail seeding (Docker not
      # enabled for these shards), and spam every shard.
      - name: Run E2E tests (shard ${{ matrix.shard }}/10)
        working-directory: apps/web
        run: npx playwright test --config e2e/playwright.config.ts --project=chromium --project=mobile-chrome --shard=${{ matrix.shard }}/10

      - name: Upload blob report
        if: always()
        uses: actions/upload-artifact@v5
        with:
          name: blob-report-${{ matrix.shard }}
          path: apps/web/e2e/blob-report/
          retention-days: 3

      - name: Upload test results
        if: failure()
        uses: actions/upload-artifact@v5
        with:
          name: test-results-${{ matrix.shard }}
          path: apps/web/e2e/test-results/
          retention-days: 7

  # Real-Docker E2E: exercises the local_docker executor end-to-end.
  # ubuntu-latest ships with Docker preinstalled, so no service container is
  # required. Container-bound tests are slow (~2 min each), so we shard across
  # 6 runners — Playwright's --shard splits the project's tests into N groups.
  # Cleans up any leftover kandev-managed containers at the end so a leaky
  # process doesn't poison the next run on the same self-hosted runner.
  #
  # This job runs the `containers` Playwright project, which covers both the
  # Docker executor and the SSH executor (since the SSH executor's e2e tests
  # also rely on Docker to host a real sshd container as the remote target).
  # Sharded 6 ways — each shard is its own runner. See apps/web/e2e/README.md.
  e2e-containers:
    name: E2E Containers Shard ${{ matrix.shard }}/6
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4, 5, 6]

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Verify Docker is available
        run: docker info

      - name: Set up pnpm
        uses: pnpm/action-setup@v5
        with:
          version: "9.15.9"

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "24"

      - name: Install dependencies
        working-directory: apps
        run: pnpm install --frozen-lockfile

      - name: Install Playwright browsers
        working-directory: apps/web
        run: npx playwright install chromium --with-deps

      - name: Download backend build
        uses: actions/download-artifact@v5
        with:
          name: e2e-backend-build
          path: apps/backend/bin/

      - name: Make backend binaries executable
        run: chmod +x apps/backend/bin/*

      - name: Download web build
        uses: actions/download-artifact@v5
        with:
          name: e2e-web-build
          path: apps/web/

      - name: Extract web build
        working-directory: apps/web
        run: tar -xf next-build.tar && rm next-build.tar

      - name: Run container-backed E2E tests shard ${{ matrix.shard }}/6 (Docker executor + SSH executor)
        working-directory: apps/web
        env:
          KANDEV_E2E_CONTAINERS: "1"
        run: npx playwright test --config e2e/playwright.config.ts --project=containers --shard=${{ matrix.shard }}/6

      - name: Cleanup leftover kandev containers
        if: always()
        run: docker ps -aq --filter label=kandev.managed=true | xargs -r docker rm -f

      # Named with the same `blob-report-*` prefix the merge job globs for
      # so the containers results land in the unified HTML report alongside
      # the sharded chromium/mobile-chrome runs.
      - name: Upload containers blob report
        if: always()
        uses: actions/upload-artifact@v5
        with:
          name: blob-report-containers-${{ matrix.shard }}
          path: apps/web/e2e/blob-report/
          retention-days: 3

      - name: Upload containers E2E results
        if: failure()
        uses: actions/upload-artifact@v5
        with:
          name: containers-e2e-test-results-${{ matrix.shard }}
          path: apps/web/e2e/test-results/
          retention-days: 7

  e2e-report:
    name: Merge E2E Reports
    needs: [e2e, e2e-containers]
    if: always()
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up pnpm
        uses: pnpm/action-setup@v5
        with:
          version: "9.15.9"

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "24"

      - name: Install dependencies
        working-directory: apps
        run: pnpm install --frozen-lockfile

      - name: Download blob reports
        uses: actions/download-artifact@v5
        with:
          path: apps/web/e2e/blob-reports
          pattern: blob-report-*
          merge-multiple: true

      - name: Merge reports
        working-directory: apps/web
        run: npx playwright merge-reports --reporter=html ./e2e/blob-reports

      - name: Upload merged report
        uses: actions/upload-artifact@v5
        with:
          name: playwright-report
          path: apps/web/playwright-report/
          retention-days: 14