OpenShell/.github/workflows/e2e-kubernetes-test.yml

name: Kubernetes E2E Test

on:
  workflow_call:
    inputs:
      image-tag:
        description: "Image tag to test (typically the commit SHA)"
        required: true
        type: string
      runner:
        description: "GitHub Actions runner label"
        required: false
        type: string
        default: "linux-amd64-cpu8"
      checkout-ref:
        description: "Git ref to check out for test inputs (defaults to the workflow SHA)"
        required: false
        type: string
        default: ""
      job-name:
        description: "Display name for the Kubernetes e2e job"
        required: false
        type: string
        default: "Kubernetes E2E (Rust smoke)"
      extra-helm-values:
        description: "Colon-separated Helm values files to layer on the Kubernetes e2e chart install"
        required: false
        type: string
        default: ""
      external-postgres-secret:
        description: "Create an ephemeral external PostgreSQL fixture and write its URI to this Secret"
        required: false
        type: string
        default: ""
      agent-sandbox-version:
        description: "Agent Sandbox release to install before OpenShell"
        required: false
        type: string
        default: "v1.0.3"
      e2e-task:
        description: "mise task to run for the Kubernetes e2e job"
        required: false
        type: string
        default: "e2e:kubernetes"
      test-name:
        description: "Rust e2e test target to run (sets OPENSHELL_E2E_KUBE_TEST)"
        required: false
        type: string
        default: ""
      kubernetes-features:
        description: "Cargo feature list for the Kubernetes e2e crate (uses script defaults when empty)"
        required: false
        type: string
        default: ""
      use-envoy-gateway:
        description: "Route the test through Envoy Gateway instead of a direct gateway Service port-forward"
        required: false
        type: boolean
        default: false
      mise-version:
        description: "mise version to install on the bare Kubernetes e2e runner"
        required: false
        type: string
        default: "v2026.9.9"
      gateway-artifact:
        description: "Optional prebuilt gateway artifact used to compose a local test image"
        required: false
        type: string
        default: ""
      conformance-artifact-prefix:
        description: "Optional prebuilt conformance CLI artifact prefix (artifact suffix is <triple>)"
        required: false
        type: string
        default: ""
      external-driver-binary:
        description: "Optional standalone compute driver binary used to compose a local test image"
        required: false
        type: string
        default: ""
      cluster-images:
        description: "Space-separated published images to preload into kind"
        required: false
        type: string
        default: "gateway sandbox supervisor"

permissions:
  actions: read
  contents: read
  packages: read

jobs:
  e2e-kubernetes:
    name: ${{ inputs.job-name }}
    # Bare runner: running kind-in-container hits nested-Docker / kubeconfig
    # complications. The runner has Docker; mise installs helm, kubectl, and
    # the Rust toolchain.
    runs-on: ${{ inputs.runner }}
    timeout-minutes: 60
    permissions:
      actions: read
      contents: read
      packages: read
    env:
      MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      # Keep bare-runner installs aligned with the project CI image.
      MISE_VERSION: ${{ inputs.mise-version }}
      KIND_CLUSTER_NAME: kube-e2e-${{ github.run_id }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs['checkout-ref'] || github.sha }}

      - name: Use prebuilt OpenShell CLI
        uses: ./.github/actions/setup-e2e-cli
        with:
          conformance-artifact-prefix: ${{ inputs.conformance-artifact-prefix }}

      - name: Use prebuilt OpenShell gateway
        if: inputs.gateway-artifact != ''
        uses: ./.github/actions/setup-e2e-gateway
        with:
          artifact-name: ${{ inputs.gateway-artifact }}

      - name: Use prebuilt external compute driver
        if: inputs.external-driver-binary != ''
        uses: ./.github/actions/setup-e2e-driver
        with:
          binary: ${{ inputs.external-driver-binary }}

      - name: Set up kind cluster
        uses: ./.github/actions/setup-e2e-kind
        with:
          cluster-name: ${{ env.KIND_CLUSTER_NAME }}
          image-tag: ${{ inputs.image-tag }}
          images: ${{ inputs.cluster-images }}
          registry-username: ${{ github.actor }}
          registry-password: ${{ secrets.GITHUB_TOKEN }}
          mise-version: ${{ inputs.mise-version }}

      - name: Run Kubernetes E2E
        env:
          AGENT_SANDBOX_VERSION: ${{ inputs.agent-sandbox-version }}
          OPENSHELL_E2E_KUBE_CONTEXT: kind-${{ env.KIND_CLUSTER_NAME }}
          OPENSHELL_E2E_KUBE_EXTRA_VALUES: ${{ inputs.extra-helm-values }}
          OPENSHELL_E2E_KUBE_EXTERNAL_POSTGRES_SECRET: ${{ inputs.external-postgres-secret }}
          OPENSHELL_E2E_KUBE_TEST: ${{ inputs.test-name }}
          OPENSHELL_E2E_KUBERNETES_FEATURES: ${{ inputs.kubernetes-features }}
          OPENSHELL_E2E_KUBE_USE_ENVOY: ${{ inputs.use-envoy-gateway && '1' || '0' }}
          IMAGE_TAG: ${{ inputs.image-tag }}
          OPENSHELL_REGISTRY: ghcr.io/nvidia/openshell
          E2E_TASK: ${{ inputs.e2e-task }}
        run: mise run --no-deps --skip-deps "$E2E_TASK"