test-e2e.yml

name: E2E Tests

# NOTE: This workflow intentionally has no top-level `paths` filter so it always
# triggers on pull_request. The required status check "E2E Tests / e2e" must be
# reported for every PR (including kubernetes-only PRs targeting release branches).
# The expensive Playwright job is gated below on the `changes` job: when no
# application paths changed, `e2e` is skipped, which branch protection treats as a
# successful required check. Operator/helm changes are validated by operator-ci.yml.
on:
  pull_request:
  workflow_dispatch:

env:
  NODE_VERSION: "22"
  PYTHON_VERSION: "3.13"
  # Define the directory where Playwright browsers will be installed.
  # This path is used for caching across workflows
  PLAYWRIGHT_BROWSERS_PATH: "ms-playwright"
  PLAYWRIGHT_VERSION: "1.57.0"

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      app: ${{ steps.filter.outputs.app }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Detect application changes
        uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            app:
              - 'src/**'
              - 'frontend/**'
              - 'tests/**'
              - 'scripts/**'
              - 'flows/**'
              - 'docker-compose.yml'
              - 'Dockerfile*'
              - 'Makefile'
              - '.github/workflows/test-e2e.yml'

  e2e:
    needs: changes
    # Run the full suite when application paths changed, or when triggered
    # manually via workflow_dispatch. Otherwise the job is skipped, which
    # branch protection treats as a successful required check.
    if: ${{ needs.changes.outputs.app == 'true' || github.event_name == 'workflow_dispatch' }}
    runs-on:
      labels: ["self-hosted", "linux", "ARM64", "langflow-ai-arm64-40gb-ephemeral-sudo"]
    env:
      LANGFLOW_AUTO_LOGIN: "True"
      LANGFLOW_NEW_USER_IS_ACTIVE: "True"
      LANGFLOW_ENABLE_SUPERUSER_CLI: "True"
      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
      WATSONX_API_KEY: ${{ secrets.WATSONX_API_KEY }}
      WATSONX_ENDPOINT: ${{ secrets.WATSONX_ENDPOINT }}
      WATSONX_PROJECT_ID: ${{ secrets.WATSONX_PROJECT_ID }}
      OLLAMA_ENDPOINT: ${{ secrets.OLLAMA_ENDPOINT }}
      GOOGLE_OAUTH_CLIENT_ID: ${{ secrets.GOOGLE_OAUTH_CLIENT_ID }}
      GOOGLE_OAUTH_CLIENT_SECRET: ${{ secrets.GOOGLE_OAUTH_CLIENT_SECRET }}
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      OPENSEARCH_PASSWORD: ${{ vars.OPENSEARCH_PASSWORD || secrets.OPENSEARCH_PASSWORD || 'OpenRag#2025!' }}
      LANGFLOW_CHAT_FLOW_ID: ${{ vars.LANGFLOW_CHAT_FLOW_ID || '1098eea1-6649-4e1d-aed1-b77249fb8dd0' }}
      LANGFLOW_INGEST_FLOW_ID: ${{ vars.LANGFLOW_INGEST_FLOW_ID || '5488df7c-b93f-4f87-a446-b67028bc0813' }}
      LANGFLOW_URL_INGEST_FLOW_ID: ${{ vars.LANGFLOW_URL_INGEST_FLOW_ID || '72c3d17c-2dac-4a73-b48a-6518473d7830' }}
      NUDGES_FLOW_ID: ${{ vars.NUDGES_FLOW_ID || 'ebc01d31-1976-46ce-a385-b0240327226c' }}

    steps:
      - name: Cleanup Docker cache
        run: |
          docker system prune -af || true
          docker builder prune -af || true
          docker compose -f docker-compose.yml down -v --remove-orphans || true

      - name: Cleanup root-owned files (OpenSearch data, config, Langflow data, keys, data, flows, documents)
        run: |
          for i in 1 2 3; do
            docker run --rm -v $(pwd):/work alpine sh -c "rm -rf /work/opensearch-data /work/config /work/langflow-data /work/keys /work/data /work/flows /work/openrag-documents" && break
            echo "Attempt $i failed, retrying in 5s..."
            sleep 5
          done || true

      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up UV
        uses: astral-sh/setup-uv@v3
        with:
          version: latest

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Python
        run: uv python install 3.13


      - name: Install frontend dependencies
        working-directory: frontend
        run: npm ci

      - name: Install Playwright Browsers
        working-directory: frontend
        run: |
          npx playwright install --with-deps chromium

      - name: Build Docker images
        run: |
          make build
          docker builder prune -af

      - name: Setup E2E infrastructure
        run: |
          chmod +x scripts/setup-e2e.sh
          ./scripts/setup-e2e.sh


      - name: Run Playwright tests
        working-directory: frontend
        env:
          CI: "true"
          OPENSEARCH_HOST: localhost
          OPENSEARCH_PORT: "9200"
          OPENSEARCH_USERNAME: admin
          OPENSEARCH_PASSWORD: ${{ env.OPENSEARCH_PASSWORD }}
          GOOGLE_OAUTH_CLIENT_ID: ""
          GOOGLE_OAUTH_CLIENT_SECRET: ""
        run: npx playwright test

      - name: Collect service logs on failure
        if: failure()
        run: |
          mkdir -p service-logs
          docker logs os > service-logs/opensearch.log 2>&1 || true
          docker logs openrag-backend > service-logs/backend.log 2>&1 || true
          docker logs langflow > service-logs/langflow.log 2>&1 || true
          docker logs openrag-backend-proxy > service-logs/backend-proxy.log 2>&1 || true

      - name: Upload service logs
        uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: service-logs
          path: service-logs/
          retention-days: 7

      - name: Upload Playwright report
        uses: actions/upload-artifact@v4
        if: ${{ !cancelled() }}
        with:
          name: playwright-report
          path: frontend/playwright-report/
          retention-days: 14

      - name: Upload test results
        uses: actions/upload-artifact@v4
        if: ${{ !cancelled() }}
        with:
          name: playwright-test-results
          path: frontend/test-results/
          retention-days: 7

      - name: Teardown infrastructure
        if: always()
        run: |
          make docling-stop || true
          docker rm -f openrag-backend-proxy 2>/dev/null || true
          make clean || true
          docker system prune -f || true