ci(e2e): run cluster-free harness on GitHub Actions

Add .github/workflows/e2e-cluster-free.yaml: a no-cluster job that installs
deps + skopeo, populates dynamic-plugins-root from the public catalog index
via the install-dynamic-plugins CLI (same mechanism as the nightly sanity
check), boots the backend + legacy app dev servers in-process, and runs
yarn e2e:legacy-local. Triggers on e2e-tests/** and app-config*.yaml.

Follows the project workflow-security rules: pull_request (no secrets, public
image), pinned action SHAs, minimal permissions, concurrency control.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gustavolira

.github/workflows/e2e-cluster-free.yaml

@@ -0,0 +1,86 @@
+name: E2E Cluster-free Harness
+
+# Runs the cluster-free local E2E harness (RHIDP-13501 / RHIDP-15075): boots the
+# backend and the legacy app dev server in-process and drives Playwright against
+# them, with dynamic plugins pulled from the public catalog index via the
+# install-dynamic-plugins CLI (skopeo). No OpenShift/Kubernetes cluster or image.
+# See docs/e2e-tests/local-e2e-harness.md.
+
+on:
+  pull_request:
+    paths:
+      - "e2e-tests/**"
+      - "app-config*.yaml"
+      - ".github/workflows/e2e-cluster-free.yaml"
+  push:
+    branches:
+      - "main"
+      - "release-*"
+    paths:
+      - "e2e-tests/**"
+      - "app-config*.yaml"
+      - ".github/workflows/e2e-cluster-free.yaml"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  # Public index; release branches can override to the matching :1.y tag.
+  CATALOG_INDEX_IMAGE: quay.io/rhdh/plugin-catalog-index:latest
+
+jobs:
+  legacy-local:
+    name: Cluster-free E2E (legacy app)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Install skopeo
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends skopeo
+
+      - name: Install dependencies (root)
+        run: yarn install
+
+      - name: Install dependencies (e2e-tests)
+        working-directory: ./e2e-tests
+        run: yarn install --mode=skip-build
+
+      - name: Install Playwright browser
+        working-directory: ./e2e-tests
+        run: yarn playwright install --with-deps chromium
+
+      - name: Populate dynamic-plugins-root from the catalog index
+        # Mirrors the install-dynamic-plugins flow used by the nightly sanity check:
+        # an empty plugin list + CATALOG_INDEX_IMAGE pulls the default plugin set
+        # (incl. the dynamic home-page plugin) from the public index via skopeo.
+        run: |
+          mkdir -p dynamic-plugins-root
+          printf 'plugins: []\n' > dynamic-plugins.yaml
+          cp dynamic-plugins.yaml dynamic-plugins-root/dynamic-plugins.yaml
+          npx -y @red-hat-developer-hub/cli-module-install-dynamic-plugins@0.2.0 install dynamic-plugins-root
+
+      - name: Run cluster-free E2E (legacy app)
+        working-directory: ./e2e-tests
+        run: yarn e2e:legacy-local
+
+      - name: Upload Playwright report
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: playwright-report-legacy-local
+          path: e2e-tests/playwright-report-legacy-local
+          retention-days: 7

docs/e2e-tests/local-e2e-harness.md

@@ -60,6 +60,15 @@ With plugins populated, the legacy app renders the full production RHDH UI off-c
 `guest-signin-happy-path` **home-page test passes unmodified** — confirming a dynamic
 frontend plugin renders with no cluster.
 
+## CI
+
+`.github/workflows/e2e-cluster-free.yaml` runs this harness on GitHub Actions in a
+cluster-free phase: it installs deps + skopeo, populates `dynamic-plugins-root` from the
+public catalog index via the `install-dynamic-plugins` CLI (the same mechanism the
+nightly sanity check uses), then runs `yarn e2e:legacy-local`. No cluster or container
+image is built. It triggers on `e2e-tests/**` and `app-config*.yaml` changes; the scope
+can widen to `packages/app/**` / `packages/backend/**` once it is proven stable.
+
 ## Why the legacy app, not app-next
 
 The harness targets the legacy app because **dynamic frontend plugins do not load on