e2e-test.yml

name: End-to-end Tests
# This workflow determines whether a PR comes from an external fork
# (which requires approval from us) or from a branch on this repository
# (which means it was made by us and can run immediately).  Once a PR
# is approved, the PR code gains access to secrets referenced in this
# workflow.
# Any changes to this job, even from internal contributors, require
# heavy scrutiny.

on:
  pull_request_target:
    paths:
    - '**.go'
    - 'go.mod'
    - 'go.sum'
  workflow_dispatch:

permissions:
  pull-requests: read
  contents: read

jobs:
  authorize:
    environment:
      ${{ github.event_name == 'pull_request_target' &&
      github.event.pull_request.head.repo.full_name != github.repository &&
      'external' || 'internal' }}
    runs-on: ubuntu-latest
    concurrency:
      group: ${{ github.event_name == 'pull_request_target' && format('e2e-authorize-pr-{0}', github.event.pull_request.number) || 'e2e-authorize' }}
      cancel-in-progress: true
    steps:
      - run: true

  e2e-test:
    needs: authorize
    runs-on: ubuntu-latest
    concurrency: 'e2e-test'
    steps:
    - name: Check out code into the Go module directory
      uses: actions/checkout@v4
      with:
          ref: ${{ github.event.pull_request.head.sha || github.ref }}
    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version-file: go.mod
    - name: Get dependencies
      run: go mod download
    - name: Run end-to-end tests
      run: go test -v -cover -coverpkg=./... -parallel 4 ./test/e2e/... -timeout 180m
      env:
        METAL_AUTH_TOKEN: ${{ secrets.METAL_AUTH_TOKEN }}