OpenShell/.github/workflows/e2e-kubernetes-test.yml

name: Kubernetes E2E Test

on:
  workflow_call:
    inputs:
      image-tag:
        description: "Image tag to test (typically the commit SHA)"
        required: true
        type: string
      runner:
        description: "GitHub Actions runner label"
        required: false
        type: string
        default: "linux-amd64-cpu8"
      checkout-ref:
        description: "Git ref to check out for test inputs (defaults to the workflow SHA)"
        required: false
        type: string
        default: ""
      job-name:
        description: "Display name for the Kubernetes e2e job"
        required: false
        type: string
        default: "Kubernetes E2E (Rust smoke)"
      extra-helm-values:
        description: "Colon-separated Helm values files to layer on the Kubernetes e2e chart install"
        required: false
        type: string
        default: ""
      external-postgres-secret:
        description: "Create an ephemeral external PostgreSQL fixture and write its URI to this Secret"
        required: false
        type: string
        default: ""
      agent-sandbox-version:
        description: "Agent Sandbox release to install before OpenShell"
        required: false
        type: string
        default: "v0.5.0"
      mise-version:
        description: "mise version to install on the bare Kubernetes e2e runner"
        required: false
        type: string
        default: "v2026.4.25"
      cli-artifact-prefix:
        description: "Optional prebuilt CLI artifact prefix (artifact suffix is linux-<arch>)"
        required: false
        type: string
        default: ""

permissions:
  actions: read
  contents: read
  packages: read

jobs:
  e2e-kubernetes:
    name: ${{ inputs.job-name }}
    # Bare runner: running kind-in-container hits nested-Docker / kubeconfig
    # complications. The runner has Docker; mise installs helm, kubectl, and
    # the Rust toolchain.
    runs-on: ${{ inputs.runner }}
    timeout-minutes: 60
    permissions:
      actions: read
      contents: read
      packages: read
    env:
      MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      # Keep bare-runner installs aligned with the project CI image.
      MISE_VERSION: ${{ inputs.mise-version }}
      KIND_CLUSTER_NAME: kube-e2e-${{ github.run_id }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs['checkout-ref'] || github.sha }}

      - name: Use prebuilt OpenShell CLI
        if: inputs.cli-artifact-prefix != ''
        uses: ./.github/actions/setup-e2e-cli
        with:
          artifact-prefix: ${{ inputs.cli-artifact-prefix }}

      - name: Install mise
        run: |
          curl https://mise.run | MISE_VERSION=v2026.4.25 sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
          echo "$HOME/.local/share/mise/shims" >> "$GITHUB_PATH"

      - name: Install tools
        run: mise install --locked

      # The openshell-policy crate transitively pulls in z3-sys, whose
      # build script needs the z3 C/C++ headers and clang/bindgen to
      # compile. The bare runner doesn't ship them; the CI container
      # image used by other Rust e2e jobs does, but we can't run this job
      # there (the runner's container handler injects its own --network
      # bridge, which conflicts with the --network host we need so kind's
      # API server is reachable from the test process).
      - name: Install z3 build deps
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libz3-dev clang

      - name: Log in to GHCR
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin

      - name: Create kind cluster
        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
        with:
          cluster_name: ${{ env.KIND_CLUSTER_NAME }}
          wait: 120s

      # mise.toml sets KUBECONFIG="{{config_root}}/kubeconfig"; helm/kind-action
      # writes to ~/.kube/config. Materialize the kind context at the mise path
      # so `mise run e2e:kubernetes` (and the wrapper's `kubectl --context=...`)
      # finds the kind cluster.
      - name: Export kind kubeconfig to mise path
        run: |
          set -euo pipefail
          kind get kubeconfig --name "$KIND_CLUSTER_NAME" > "$GITHUB_WORKSPACE/kubeconfig"
          chmod 600 "$GITHUB_WORKSPACE/kubeconfig"

      - name: Load gateway and supervisor images into kind
        run: |
          set -euo pipefail
          for component in gateway supervisor; do
            image="ghcr.io/nvidia/openshell/${component}:${{ inputs.image-tag }}"
            archive="${RUNNER_TEMP:-/tmp}/openshell-${component}-linux-amd64.tar"
            docker pull --platform linux/amd64 "$image"
            docker image save --platform linux/amd64 --output "$archive" "$image"
            kind load image-archive "$archive" --name "$KIND_CLUSTER_NAME"
          done

      - name: Run Kubernetes E2E (Rust smoke)
        env:
          AGENT_SANDBOX_VERSION: ${{ inputs.agent-sandbox-version }}
          OPENSHELL_E2E_KUBE_CONTEXT: kind-${{ env.KIND_CLUSTER_NAME }}
          OPENSHELL_E2E_KUBE_EXTRA_VALUES: ${{ inputs.extra-helm-values }}
          OPENSHELL_E2E_KUBE_EXTERNAL_POSTGRES_SECRET: ${{ inputs.external-postgres-secret }}
          IMAGE_TAG: ${{ inputs.image-tag }}
          OPENSHELL_REGISTRY: ghcr.io/nvidia/openshell
        run: mise run --no-deps --skip-deps e2e:kubernetes