e2e-test.yaml

name: E2E Test

on:
  workflow_dispatch:
    inputs:
      base_domain:
        description: 'Base domain for testing (e.g., example.com)'
        required: false
        default: ''
  pull_request:
    branches:
      - "master"

permissions: read-all

jobs:
  # The e2e-test job below is a required status check on master. Skipping the
  # whole workflow via paths-ignore leaves the required check missing forever
  # and blocks docs-only pull requests, so the workflow always runs and this
  # job decides whether the e2e job itself runs. A skipped required job counts
  # as satisfied.
  changes:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    outputs:
      non_docs: ${{ steps.filter.outputs.non_docs }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Detect non-docs changes
        id: filter
        run: |
          if git diff --name-only "origin/${{ github.base_ref }}...HEAD" | grep -v '^docs/' | grep -q .; then
            echo "non_docs=true" >> "$GITHUB_OUTPUT"
          else
            echo "non_docs=false" >> "$GITHUB_OUTPUT"
          fi

  e2e-test:
    needs: changes
    if: ${{ !cancelled() && (github.event_name == 'workflow_dispatch' || (needs.changes.result == 'success' && needs.changes.outputs.non_docs == 'true')) }}
    runs-on: ubuntu-latest
    timeout-minutes: 60
    # All e2e runs share one Cloudflare tunnel and zone. Two controllers running
    # at once treat each other's records as orphans and delete them in a loop,
    # so runs must be strictly serialized.
    concurrency:
      group: e2e-shared-cloudflare-tunnel
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-go@v7
        with:
          go-version-file: './go.mod'

      - name: Install cloudflared
        run: |
          curl -fsSL -o /tmp/cloudflared https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64
          sudo install /tmp/cloudflared /usr/local/bin/cloudflared
          cloudflared --version

      - name: Install Helm
        uses: azure/setup-helm@v5
        with:
          version: 'latest'

      - name: Start minikube
        uses: medyagh/setup-minikube@v0
        with:
          driver: docker
          container-runtime: docker
          cpus: 2
          memory: 4096

      - name: Verify minikube
        run: |
          minikube status
          kubectl get nodes

      - name: Create .env.e2e file
        run: |
          cat > .env.e2e <<EOF
          CLOUDFLARE_API_TOKEN=${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID=${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          CLOUDFLARE_TUNNEL_NAME=${{ secrets.CLOUDFLARE_TUNNEL_NAME }}
          E2E_BASE_DOMAIN=${{ secrets.E2E_BASE_DOMAIN || github.event.inputs.base_domain }}
          E2E_CONTROLLER_IMAGE=cloudflare-tunnel-ingress-controller:e2e
          EOF

      - name: Build e2e controller image
        run: |
          make e2e-image

      - name: Run e2e tests
        run: |
          bash ./test/e2e/e2e.sh

      - name: Upload coverage reports to Codecov
        if: always()
        uses: codecov/codecov-action@v7
        with:
          files: ./test/e2e/artifacts/e2e-cover.out
          flags: e2e
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Upload test artifacts
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: e2e-artifacts-${{ github.run_number }}-${{ github.run_attempt }}
          path: test/e2e/artifacts/
          if-no-files-found: ignore
          retention-days: 30

      - name: Cleanup minikube profiles
        if: always()
        run: |
          minikube profile list -o json | jq -r '.valid[].Name' | grep '^cf-ic-e2e-' | xargs -r -I {} minikube delete -p {} || true