e2e.yml

# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
name: E2E Tests
on:
  push:
    branches: [main]
  pull_request:
    branches: ['**']
permissions: {}
jobs:
  e2e:
    name: E2E tests
    permissions:
      actions: read
      contents: read
    needs: pinned-source-closure
    if: ${{ always() }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Require verified pinned-source closure
        env:
          CLOSURE_RESULT: ${{ needs.pinned-source-closure.result }}
        run: |
          if [ "$CLOSURE_RESULT" != success ]; then
            echo "Pinned-source closure did not pass: $CLOSURE_RESULT" >&2
            exit 1
          fi
      - uses: actions/checkout@v7.0.1
      - name: Audit workflow lock auditor dependencies
        run: |
          set -euo pipefail
          # Official RustSec binary, immutable content hash from its release asset.
          archive="$RUNNER_TEMP/cargo-audit.tgz"
          curl --proto '=https' --proto-redir '=https' -fsSL --retry 3 https://github.com/rustsec/rustsec/releases/download/cargo-audit/v0.22.2/cargo-audit-x86_64-unknown-linux-gnu-v0.22.2.tgz -o "$archive"
          printf '%s  %s\n' ab28a1bdb54db4d5d8ad5981cf1f959410370b3d28250dbd35f6a44248620e39 "$archive" | sha256sum -c -
          tar -xzf "$archive" -C "$RUNNER_TEMP"
          "$RUNNER_TEMP/cargo-audit-x86_64-unknown-linux-gnu-v0.22.2/cargo-audit" audit --file tools/workflow-lock-audit/Cargo.lock --deny warnings
      - name: Test workflow lock-map and regeneration audit
        run: |
          cargo test --locked --manifest-path tools/workflow-lock-audit/Cargo.toml
          bash scripts/audit-workflow-lock-map.sh
      - name: Test audit workflow diagnostics
        run: |
          python3 -c 'import yaml' || python3 -m pip install --user --only-binary=:all: --require-hashes -r .github/requirements/e2e.txt
          bash scripts/tests/pr-audit-workflows-test.sh
      - name: Verify automation quarantine
        run: bash tests/automation-quarantine-test.sh
      - name: Verify fix-outcome verdicts
        run: bash tests/outcome-verdict-test.sh
      - name: PA rule IDs agree with panic-attack's table
        run: bash tests/panic-attack-rule-ids-test.sh
      - name: Run E2E tests
        run: bash tests/e2e.sh
      - name: Verify canonical descriptile policy repair
        run: bash tests/retired-descriptile-policy-test.sh
      - name: Verify star-list enrollment discovery
        run: bash tests/enroll-discovery-test.sh
      - name: Verify the fleet report-back driver (envelope contract)
        run: bash tests/fleet-report-back-test.sh
      - name: Fleet enrolment fixer (report-back rollout)
        run: bash tests/fix-fleet-enrolment-test.sh
  pinned-source-closure:
    name: Pinned source closure
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7.0.1
      - name: Set source cache
        run: printf 'PINNED_SOURCE_CACHE=%s/fleet-pinned-sources\n' "$RUNNER_TEMP" >> "$GITHUB_ENV"
      - name: Test pinned-source failure modes
        run: bash scripts/tests/pinned-reusable-sources-test.sh
      - name: Authenticate pinned reusable sources
        run: bash scripts/audit-pinned-reusable-sources.sh --fetch-sources
      - name: Verify live scanner caller and negative controls
        run: bash scripts/tests/scanner-caller-contract-test.sh
      - name: Authenticate historical scanner source for archived preflight
        run: |
          set -euo pipefail
          tree="$RUNNER_TEMP/historical-scanner-source"
          mkdir -p "$tree/scripts/lib"
          cp -R .github "$tree/"
          cp scripts/lib/{pinned-reusable-sources.json,lock-closure-receipts.tsv} "$tree/scripts/lib/"
          bash docs/migrations/secret-scanner-cicd-suite/fixtures/restore-historical-source.sh \
            "$tree" docs/migrations/secret-scanner-cicd-suite/fixtures/historical-source.json
          bash scripts/audit-pinned-reusable-sources.sh --repo-root "$tree" --fetch-sources
      - name: Preserve lock closure contracts
        run: bash scripts/tests/lock-closure-test.sh
      - name: Audit vendor lock and pinned-source closure
        run: ./scripts/audit-lock-closure.sh
      - name: Test source closure through migration preflight
        run: |
          rc=0
          bash scripts/tests/pinned-source-entrypoints-test.sh > "$RUNNER_TEMP/preflight-tests.log" 2>&1 || rc=$?
          cat "$RUNNER_TEMP/preflight-tests.log"
          if [ "$rc" -ne 0 ]; then
            detail=$(tail -c 5000 "$RUNNER_TEMP/preflight-tests.log")
            detail=${detail//'%'/'%25'}; detail=${detail//$'\r'/'%0D'}; detail=${detail//$'\n'/'%0A'}
            echo "::error::Historical preflight tests failed (exit $rc): $detail"
          fi
          exit "$rc"
      - name: Prepared secret-scanner migration stays gated
        run: |
          # 0 = all preconditions hold; 2 = evidence is unavailable. The
          # historical canary receipt is now present, but online/source evidence
          # may still be unavailable. Findings (1 or 3) must fail the build.
          rc=0
          ./docs/migrations/secret-scanner-cicd-suite/preflight.sh --quiet || rc=$?
          case "$rc" in
            0|2) echo "preflight exit $rc (no findings)";;
            *) echo "preflight exit $rc: findings in the prepared migration" >&2; exit 1;;
          esac
      - name: Regenerate vendor lock in a disposable worktree
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          git worktree add --detach "$RUNNER_TEMP/lock-regeneration" HEAD
          gh extension install github/gh-actions-lock --pin v0.4.1
          cd "$RUNNER_TEMP/lock-regeneration"
          gh actions-lock --no-interactive
          git diff --stat -- .github/workflows
      - name: Compare regenerated and reviewed vendor closures
        run: |
          set -euo pipefail
          bash scripts/audit-lock-regeneration.sh \
            .github/workflows/actions.lock "$RUNNER_TEMP/lock-regeneration/.github/workflows/actions.lock"
      - name: Verify reviewed source closure against regeneration
        run: |
          set -euo pipefail
          # The regeneration comparison alone covers only shared vendor roots.
          # Independently authenticate the job-level reusable closure, including
          # the scanner, against the regenerated lock and caller tree.
          rc=0
          bash scripts/audit-pinned-reusable-sources.sh \
            --repo-root "$RUNNER_TEMP/lock-regeneration" \
            --lock "$RUNNER_TEMP/lock-regeneration/.github/workflows/actions.lock" \
            > "$RUNNER_TEMP/regenerated-source-audit.txt" 2>&1 || rc=$?
          cat "$RUNNER_TEMP/regenerated-source-audit.txt"
          if [ "$rc" -ne 0 ]; then
            # Surface a bounded, escaped diagnostic in the check annotation as
            # well as the logs; never turn an incomplete comparison into green.
            detail=$(head -c 3000 "$RUNNER_TEMP/regenerated-source-audit.txt")
            detail=${detail//'%'/'%25'}
            detail=${detail//$'\r'/'%0D'}
            detail=${detail//$'\n'/'%0A'}
            echo "::error::Regenerated source audit exited $rc: $detail"
            exit "$rc"
          fi