mattermost-mobile-upstream/.github/workflows/e2e-maestro-pr.yml
yasser khan 16dd7dbdba
ci(e2e): make E2E/Override waive checks instead of cancelling runs (#9975)
* ci(e2e): make E2E/Override waive checks instead of cancelling runs

E2E/Override previously cancelled in-flight E2E runs and posted success on
their commit statuses. Cancelling destroys the very signal the maintainer
might still want, and reporting success for a run that never finished
attributes a conclusion to work that never happened.

Override now means one thing only: the required e2e-test/* contexts go green
so the PR can merge. Runs keep going and keep reporting to TSIO.

- Add .github/actions/e2e-override-status to post success (or pending) on all
  five required e2e-test/* contexts for a SHA.
- Label manager posts success on `labeled` and pending on `unlabeled`, so
  removing the escape hatch re-blocks the PR instead of leaving a stale waiver
  on the head SHA. It comments the runs it left running rather than killing
  them, and drops to `actions: read` now that it never cancels.
- tsio-report-status re-reads the PR labels before posting a failure. Because
  runs are no longer cancelled, a result landing after the override was applied
  would otherwise re-red a check the maintainer deliberately bypassed. The
  lookup fails closed so an unreadable label list cannot turn a real failure
  green, and the step itself no longer fails under override.
- Guard e2e-cancel-on-label-removal: stripping E2E/Run* is exactly what the
  Honor E2E/Override step does, so without this the indirect unlabeled event
  would cancel the runs the redesign is meant to preserve.
- e2e-detox-pr posts the success itself when the policy skips E2E, since every
  downstream job is skipped and a skipped job leaves the required contexts
  absent, blocking the merge forever.
- cancel-e2e-runs drops status_state: a cancelled run has no conclusion to
  report, so it always resets to pending.
- Thread `issues: read` through the reusable workflow callers so finalize can
  read the labels; a reusable workflow cannot escalate past its caller.

Co-authored-by: Cursor <cursoragent@cursor.com>

* ci(e2e): derive required E2E contexts from one definition

The override and cancel actions each carried their own copy of the five
required e2e-test/* contexts, kept aligned with build-tsio-job-config.js by
comment alone. A job renamed in PR_MAIN_JOBS would silently leave the actions
waiving or resetting a context that no longer exists, so a PR either cannot
merge or merges while a real context still blocks it.

Export E2E_STATUS_CONTEXTS from detox/utils/build-tsio-job-config.js, derived
from PR_MAIN_JOBS, and require it from both composite actions. github-script
resolves relative requires against the workspace, and every call site already
checks out the repo before using the action.

Also set persist-credentials: false on the e2e-label-manager checkout, matching
the other checkout steps.

Co-authored-by: Cursor <cursoragent@cursor.com>

* ci(e2e): drop the cancel action for native concurrency, keep GitHub calls in Actions

Review feedback from @saturninoabril.

Superseding an in-flight E2E run is what GitHub's `concurrency` already does, so
`e2e-detox-pr.yml` now declares `concurrency: e2e-<ref>` with `cancel-in-progress`
instead of cancelling from a step inside the run that supersedes it. The older run
is cancelled the moment the new dispatch is created rather than once a runner picks
up the first job.

That removes the only two remaining callers of `.github/actions/cancel-e2e-runs`,
along with the commit statuses it forced to `pending` on cancel — a cancelled run
has no conclusion to report, so the state is left to GitHub. Forcing a commit status
is now reserved for real test results and the override waiver. The action is deleted.

`e2e-cancel-on-label-removal.yml` goes with it: with `E2E/Run` on its way out and
override no longer cancelling, removing the label to stop a run has no remaining
practical case, and dropping the workflow also removes the back-door cancel guard
it needed.

The `E2E/Override` lookup moves out of `tsio-report-status.js` into a new
`.github/actions/e2e-override-label` composite action, which the finalize steps
call and pass in via `--e2e-override`. Talking to GitHub stays in the Actions
layer and the reporter is left deciding on its inputs.

Co-authored-by: Cursor <cursoragent@cursor.com>

* ci(e2e): paginate PR label lookups for E2E/Override

Co-authored-by: Cursor <cursoragent@cursor.com>

* ci(e2e): re-post E2E/Override success on new commits

Override success is SHA-scoped: it is posted only on the head SHA at
label-apply time (e2e-label-manager 'labeled' path) and when Matterwick
dispatches e2e-detox-pr.yml (post-e2e-override-status). On a push after
E2E/Override is applied, refresh-e2e-run-label strips the run labels and
returns — Matterwick is not dispatched, so the new head SHA gets no
e2e-test/* statuses. With those checks Required, the new commit is
blocked until the label is re-toggled.

Carry the override onto the new commit: refresh-e2e-run-label now emits
an e2e_override output, and when it is set a gated checkout +
e2e-override-status step re-posts success on the new head SHA. Reuses
the existing e2e-override-status action (same 5 required e2e-test/*
contexts, same 'E2E bypassed' description), so it is idempotent with the
labeled path. Adds statuses: write / contents: read to the job.

Note: refresh-e2e-run-label is gated on base.ref == 'main', so stacked
PRs (base != main) are not covered; non-main-base already posts success
at dispatch time.

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-31 14:22:19 +02:00

101 lines
3.4 KiB
YAML

# Maestro E2E orchestration — reusable workflow only.
# Called from e2e-detox-pr.yml after shared builds and server provisioning complete.
# Downloads ios-build-simulator-* and android-maestro-build-files-* from the parent run
# via artifact_run_id; does not build apps or provision servers on its own.
name: Maestro E2E
on:
workflow_call:
inputs:
MOBILE_VERSION:
required: true
type: string
PLATFORM:
required: false
type: string
default: "both"
ANDROID_SITE_1_URL:
required: true
type: string
ANDROID_SITE_2_URL:
required: true
type: string
IOS_SITE_1_URL:
required: true
type: string
IOS_SITE_2_URL:
required: true
type: string
SITE_3_URL:
required: true
type: string
run_type:
required: false
type: string
default: "PR"
artifact_run_id:
description: "Run ID of the parent workflow that uploaded build artifacts"
required: true
type: string
record_tests_in_zephyr:
description: "Record Maestro test results in Zephyr Scale"
required: false
type: boolean
default: false
tsio-job-configs:
description: "JSON map of per-platform TSIO configs from parent calculate-tsio-identity"
required: true
type: string
# Least-privilege defaults; the TSIO upload (in the nested maestro template)
# needs id-token: write to mint an OIDC token and actions: read to resolve
# gh_job_id. Reusable workflows cannot escalate beyond the caller, so grant
# here too.
permissions:
contents: read
id-token: write
actions: read
statuses: write
# Nested template finalize reads PR labels to honour E2E/Override.
issues: read
# iOS and Android are invoked as separate workflow_call runs from e2e-detox-pr.yml;
# include PLATFORM so parallel calls do not cancel each other (same github.run_id).
concurrency:
group: "${{ github.workflow }}-${{ inputs.PLATFORM }}-${{ inputs.MOBILE_VERSION }}-${{ github.run_id }}"
cancel-in-progress: true
env:
ARTIFACT_RUN_ID: ${{ inputs.artifact_run_id }}
jobs:
run-maestro-ios:
name: Maestro iOS
if: inputs.PLATFORM == 'ios' || inputs.PLATFORM == 'both'
uses: ./.github/workflows/e2e-maestro-template.yml
with:
platform: ios
run-type: ${{ inputs.run_type || 'PR' }}
MOBILE_VERSION: ${{ inputs.MOBILE_VERSION }}
MM_TEST_SERVER_URL: ${{ inputs.IOS_SITE_1_URL }}
artifact_run_id: ${{ inputs.artifact_run_id }}
record_tests_in_zephyr: ${{ inputs.record_tests_in_zephyr }}
tsio-config: ${{ toJSON(fromJSON(inputs.tsio-job-configs)['maestro-ios-e2e']) }}
tsio-shard-name: maestro-ios-e2e
secrets: inherit
run-maestro-android:
name: Maestro Android
if: inputs.PLATFORM == 'android' || inputs.PLATFORM == 'both'
uses: ./.github/workflows/e2e-maestro-template.yml
with:
platform: android
run-type: ${{ inputs.run_type || 'PR' }}
MOBILE_VERSION: ${{ inputs.MOBILE_VERSION }}
MM_TEST_SERVER_URL: ${{ inputs.ANDROID_SITE_1_URL }}
artifact_run_id: ${{ inputs.artifact_run_id }}
record_tests_in_zephyr: ${{ inputs.record_tests_in_zephyr }}
tsio-config: ${{ toJSON(fromJSON(inputs.tsio-job-configs)['maestro-android-e2e']) }}
tsio-shard-name: maestro-android-e2e
secrets: inherit