chore: audit CI scenario matrix and index prefix coverage

.github/config/permitted-flows.yaml

@@ -3,6 +3,7 @@ defaults:
     - install
     - upgrade-patch
     - upgrade-minor
+    - modular-upgrade-minor
 rules:
   - match: "<=8.7"
     deny:
@@ -11,4 +12,3 @@ rules:
     deny:
       - upgrade-patch
 
-

charts/camunda-platform-8.10/test/ci-test-config.yaml

@@ -622,7 +622,7 @@ integration:
             gke: qa-workloads
           profiles: [postgresql-qa, keycloak-qa, opensearch]
         - name: qa-opensearch-upg
-          enabled: false
+          enabled: true
           flow: modular-upgrade-minor
           shortname: qaosupg
           prefix-key: qa-opensearch-upg
@@ -665,7 +665,7 @@ integration:
             gke: qa-workloads
           profiles: [postgresql-qa, keycloak-qa, elasticsearch-qa]
         - name: qa-elasticsearch-mt-upg
-          enabled: false
+          enabled: true
           flow: modular-upgrade-minor
           shortname: qaelmtupg
           auth: keycloak
@@ -749,7 +749,7 @@ integration:
             eks: preemptible
           profiles: [postgresql, keycloak, elasticsearch]
         - name: qa-document-store-upg
-          enabled: false
+          enabled: true
           flow: modular-upgrade-minor
           shortname: qadocupg
           auth: keycloak
@@ -763,7 +763,7 @@ integration:
             gke: qa-workloads
           profiles: [postgresql-qa, keycloak-qa, elasticsearch-qa]
         - name: qa-document-store-upg
-          enabled: false
+          enabled: true
           flow: modular-upgrade-minor
           shortname: qadocupg
           auth: keycloak

charts/camunda-platform-8.7/test/ci-test-config.yaml

@@ -212,6 +212,24 @@ integration:
               session idle timeout to 2 hours. Prevents session-expiry flakiness
               in long-running E2E test flows (diagram building, process deployment)
               when the cluster is under heavy load.
+        # Mirrors the shortname used by the 8.8 upgrade-minor nightly install leg.
+        - name: qa-elasticsearch
+          enabled: false
+          flow: install
+          shortname: qaelupg
+          auth: keycloak
+          identity: keycloak
+          persistence: elasticsearch
+          qa: true
+          image-tags: true
+          platforms: [gke]
+          infra-type:
+            gke: qa-workloads
+          post-deploy:
+            script: post-deploy-keycloak-token-lifespan.sh
+            description: |
+              Increases Keycloak access token lifespan to 30 minutes and SSO
+              session idle timeout to 2 hours for E2E test stability.
         - name: qa-elasticsearch-rba
           enabled: false
           flow: install
@@ -230,6 +248,26 @@ integration:
             description: |
               Increases Keycloak access token lifespan to 30 minutes and SSO
               session idle timeout to 2 hours for E2E test stability.
+        # Mirrors 8.8+ shortname for the qa-elasticsearch-rba scenario; cross-component
+        # nightly playwright_sm_nightly_rba_8_7.yml passes shortname=qaelrba.
+        - name: qa-elasticsearch-rba
+          enabled: false
+          flow: install
+          shortname: qaelrba
+          auth: keycloak
+          identity: keycloak
+          persistence: elasticsearch
+          features: [rba]
+          qa: true
+          image-tags: true
+          platforms: [gke]
+          infra-type:
+            gke: qa-workloads
+          post-deploy:
+            script: post-deploy-keycloak-token-lifespan.sh
+            description: |
+              Increases Keycloak access token lifespan to 30 minutes and SSO
+              session idle timeout to 2 hours for E2E test stability.
         - name: qa-elasticsearch-mt
           enabled: false
           flow: install
@@ -248,6 +286,38 @@ integration:
             description: |
               Increases Keycloak access token lifespan to 30 minutes and SSO
               session idle timeout to 2 hours for E2E test stability.
+        # Mirrors 8.8+ shortname for the qa-elasticsearch-mt scenario; cross-component
+        # nightly playwright_sm_nightly_mt_8_7.yml passes shortname=qaelmt.
+        - name: qa-elasticsearch-mt
+          enabled: false
+          flow: install
+          shortname: qaelmt
+          auth: keycloak
+          identity: keycloak
+          persistence: elasticsearch
+          features: [multitenancy]
+          qa: true
+          image-tags: true
+          platforms: [gke]
+          infra-type:
+            gke: qa-workloads
+          post-deploy:
+            script: post-deploy-keycloak-token-lifespan.sh
+            description: |
+              Increases Keycloak access token lifespan to 30 minutes and SSO
+              session idle timeout to 2 hours for E2E test stability.
+        # Keeps 8.7 document-store deployable via deploy-camunda matrix run.
+        - name: qa-document-store
+          enabled: false
+          flow: install
+          shortname: qadoc
+          auth: keycloak
+          identity: keycloak
+          persistence: elasticsearch
+          features: [documentstore]
+          qa: true
+          image-tags: true
+          platforms: [gke, eks]
         - name: qa-license
           enabled: false
           flow: install

charts/camunda-platform-8.8/test/ci-test-config.yaml

@@ -298,9 +298,9 @@ integration:
         #  sm_manual_upgrade_minor_8_8). All disabled so they don't appear in the regular
         # CI matrix; matrix run resolves them via --shortname-filter + --include-disabled.
         #
-        # Note on duplicate shortnames: compat workflow reuses qaosupg/qaelmtupg across
-        # tasklist-v1 install scenarios and *-upg upgrade-minor scenarios. Both deploy
-        # via the same flow=install path here. One entry per shortname covers both.
+        # Note on duplicate shortnames: cross-component workflows pass both scenario
+        # and shortname, so disabled nightly rows intentionally mirror those exact
+        # pairs even when another disabled row uses the same shortname+flow.
         # ===========================================================================
         # Used by camunda/connectors FEATURE_BRANCH_HELM_TEST workflow (stable/8.8).
         - name: keycloak-original
@@ -363,6 +363,18 @@ integration:
           platforms: [gke]
           infra-type:
             gke: qa-workloads
+        - name: qa-elasticsearch
+          enabled: false
+          flow: install
+          shortname: qaelupg
+          auth: keycloak
+          identity: keycloak
+          persistence: elasticsearch
+          qa: true
+          image-tags: true
+          platforms: [gke]
+          infra-type:
+            gke: qa-workloads
         - name: qa-opensearch
           enabled: false
           flow: install
@@ -382,6 +394,26 @@ integration:
               repo-name: opensearch
               repo-url: https://opensearch-project.github.io/helm-charts/
               values-file: test/integration/companion-values/opensearch.yaml
+        - name: qa-opensearch
+          enabled: false
+          flow: install
+          shortname: qaosupg
+          prefix-key: qa-opensearch-upg
+          auth: keycloak
+          identity: keycloak
+          persistence: opensearch-embedded
+          qa: true
+          image-tags: true
+          platforms: [gke]
+          infra-type:
+            gke: qa-workloads
+          dependencies:
+            - chart: opensearch/opensearch
+              version: "2.31.0"
+              release-name: opensearch
+              repo-name: opensearch
+              repo-url: https://opensearch-project.github.io/helm-charts/
+              values-file: test/integration/companion-values/opensearch.yaml
         - name: qa-elasticsearch-rba
           enabled: false
           flow: install
@@ -408,6 +440,19 @@ integration:
           platforms: [gke]
           infra-type:
             gke: qa-workloads
+        - name: qa-elasticsearch-mt
+          enabled: false
+          flow: install
+          shortname: qaelmtupg
+          auth: keycloak
+          identity: keycloak
+          persistence: elasticsearch
+          features: [multitenancy]
+          qa: true
+          image-tags: true
+          platforms: [gke]
+          infra-type:
+            gke: qa-workloads
         - name: qa-license
           enabled: false
           flow: install
@@ -447,6 +492,19 @@ integration:
           infra-type:
             gke: qa-workloads
             eks: preemptible
+        - name: qa-document-store
+          enabled: false
+          flow: install
+          shortname: qadocupg
+          auth: keycloak
+          identity: keycloak
+          persistence: elasticsearch
+          features: [documentstore]
+          qa: true
+          image-tags: true
+          platforms: [eks]
+          infra-type:
+            eks: preemptible
         - name: qa-document-store-upg
           enabled: false
           flow: install
@@ -463,7 +521,7 @@ integration:
         - name: qa-elasticsearch-tasklist-v1
           enabled: false
           flow: install
-          shortname: qaeltlv1
+          shortname: qaelupg
           auth: keycloak
           identity: keycloak
           persistence: elasticsearch
@@ -574,7 +632,8 @@ integration:
         - name: qa-opensearch-upg
           enabled: false
           flow: install
-          shortname: qaosupg2
+          shortname: qaosupg
+          prefix-key: qa-opensearch-upg
           auth: keycloak
           identity: keycloak
           persistence: opensearch-embedded
@@ -593,7 +652,7 @@ integration:
         - name: qa-elasticsearch-rba-upg
           enabled: false
           flow: install
-          shortname: qaelrbaup2
+          shortname: qaelrbaupg
           auth: keycloak
           identity: keycloak
           persistence: elasticsearch
@@ -606,7 +665,7 @@ integration:
         - name: qa-elasticsearch-mt-upg
           enabled: false
           flow: install
-          shortname: qaelmtup2
+          shortname: qaelmtupg
           auth: keycloak
           identity: keycloak
           persistence: elasticsearch
@@ -619,7 +678,7 @@ integration:
         - name: qa-license-upg
           enabled: false
           flow: install
-          shortname: licup2
+          shortname: licupg
           auth: keycloak
           identity: keycloak
           persistence: elasticsearch