ci: add manual-dispatch e2e acceptance workflow - #10
Merged
Merged
Conversation
Add a workflow_dispatch-only GitHub Actions workflow that runs the full DigitalOcean e2e acceptance suite (make test) on demand, plus Dependabot to keep the pinned actions current. - Inputs for brigade/flintlock refs, DO region, droplet size, microVM kernel/rootfs images, and an optional RUN_ID. - DO_API_TOKEN is the only secret; an ephemeral ed25519 keypair is generated per run rather than stored. - Concurrency serializes runs and never cancels in-flight ones, so the global reaper safety-net (make clean-tags, run on cancel/failure) cannot clobber a concurrent run. - All actions pinned to full commit SHAs; Dependabot bumps them weekly.
There was a problem hiding this comment.
Pull request overview
Adds baseline repository automation by introducing an on-demand GitHub Actions workflow to run the full DigitalOcean-backed end-to-end acceptance suite, plus Dependabot config to keep SHA-pinned actions up to date.
Changes:
- Add a
workflow_dispatch-onlye2eworkflow that provisions DO infra and runsmake test, then uploadsartifacts/**. - Add weekly Dependabot updates for the
github-actionsecosystem to refresh pinned action SHAs.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
.github/workflows/e2e.yml |
New manual-dispatch workflow to run the full DO e2e suite with serialized concurrency and artifact upload. |
.github/dependabot.yml |
Enable weekly Dependabot updates for GitHub Actions to keep SHA pins current. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+83
to
+88
| - name: Reap leaked infra (safety-net on cancel/failure) | ||
| # Serialized runs (concurrency above) mean no concurrent run exists for | ||
| # the global reaper to clobber. Covers the leak-on-kill gap when a job | ||
| # timeout / manual Cancel SIGKILLs the process before teardown finishes. | ||
| if: cancelled() || failure() | ||
| run: make clean-tags |
| if: always() | ||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | ||
| with: | ||
| name: artifacts-${{ github.run_id }} |
Comment on lines
+1
to
+2
| name: e2e | ||
|
|
- Add least-privilege permissions (contents: read) to the workflow. - Fix doc comment to reference AGENTS.md/README.md instead of CLAUDE.md. - Name uploaded artifacts by the RUN_ID input when provided, falling back to github.run_id. - Replace the in-job cancelled()/failure() reaper step with a separate workflow_run-triggered reaper.yml that fires after the e2e run concludes, so cleanup still runs when the e2e runner is terminated on manual Cancel or timeout. It shares the e2e-acceptance concurrency group so the global reaper can never clobber a live run, and only reaps when the e2e conclusion was failure or cancelled.
Comment on lines
+22
to
+23
| # A green run tore down its own infra; only clean up when it did not succeed. | ||
| if: ${{ github.event.workflow_run.conclusion == 'failure' || github.event.workflow_run.conclusion == 'cancelled' }} |
Comment on lines
+52
to
+55
| DO_DROPLET_SIZE: ${{ inputs.droplet_size }} | ||
| MICROVM_KERNEL_IMAGE: ${{ inputs.microvm_kernel_image }} | ||
| MICROVM_ROOTFS_IMAGE: ${{ inputs.microvm_rootfs_image }} | ||
| RUN_ID: ${{ inputs.run_id }} |
Comment on lines
+27
to
+29
| run_id: | ||
| description: Optional RUN_ID (blank = suite auto-generates at-<hex>) | ||
| default: "" |
Comment on lines
+93
to
+95
| with: | ||
| name: artifacts-${{ inputs.run_id || github.run_id }} | ||
| path: artifacts/** |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a manually triggered GitHub Actions workflow that runs the full DigitalOcean e2e acceptance suite (
make test) on demand, plus Dependabot to keep the pinned actions current. The repo previously had no CI.Files
.github/workflows/e2e.yml—workflow_dispatch-only (the suite provisions real DO infra and costs money, so no push/PR trigger)..github/dependabot.yml— weeklygithub-actionsupdates.Design
RUN_ID— all defaulted, mapped to the env varsconfig.pyreads.DO_API_TOKENonly. A fresh unencrypted ed25519 keypair is generated per run and uploaded to DO at provision time — no static key secret to rotate or leak.group: e2e-acceptance,cancel-in-progress: false— runs queue and are never cancelled mid-flight (cancelling skips the suite's teardown and leaks infra).make clean-tagsruns oncancelled() || failure()to close the leak-on-kill gap (job timeout / manual Cancel SIGKILLs before teardown). Safe because serialization means no concurrent run for the global reaper to clobber.timeout-minutes: 75; per-host logs uploaded asartifacts-<run_id>on every run.Before first run
Add the
DO_API_TOKENsecret (write scopes) in Settings → Secrets and variables → Actions.