name: test-e2e
on:
  pull_request:
    paths-ignore:
      - 'README.md'
      - 'CHANGELOG.md'
      - '.changelog/**'
      - '.tours/**'
      - 'contributing/**'
      - 'demo/**'
      - 'dev/**'
      - 'integrations/**'
      - 'pkg/**'
      - 'scripts/**'
      - 'terraform/**'
      - 'ui/**'
      - 'website/**'
  push:
    branches:
      - main
      - release/**
    paths-ignore:
      - 'README.md'
      - 'CHANGELOG.md'
      - '.changelog/**'
      - '.tours/**'
      - 'contributing/**'
      - 'demo/**'
      - 'dev/**'
      - 'integrations/**'
      - 'pkg/**'
      - 'scripts/**'
      - 'terraform/**'
      - 'ui/**'
      - 'website/**'

jobs:
  test-e2e-vault:
    runs-on: ${{ endsWith(github.repository, '-enterprise') && fromJSON('["self-hosted", "ondemand", "linux"]') || 'ubuntu-22.04' }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Retrieve Vault-hosted Secrets
        if: endsWith(github.repository, '-enterprise')
        id: vault
        uses: hashicorp/vault-action@a1b77a09293a4366e48a5067a86692ac6e94fdc0 # v3.1.0
        with:
          url: ${{ vars.CI_VAULT_URL }}
          method: ${{ vars.CI_VAULT_METHOD }}
          path: ${{ vars.CI_VAULT_PATH }}
          jwtGithubAudience: ${{ vars.CI_VAULT_AUD }}
          secrets: |-
            kv/data/github/hashicorp/nomad-enterprise/gha ELEVATED_GITHUB_TOKEN ;
      - name: Git config token
        if: endsWith(github.repository, '-enterprise')
        run: git config --global url.'https://${{ env.ELEVATED_GITHUB_TOKEN }}@github.com'.insteadOf 'https://github.com'
      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          cache: ${{ contains(runner.name, 'Github Actions') }}
          go-version-file: .go-version
          cache-dependency-path: '**/go.sum'
      - run: make deps
      - name: Vault Compatability
        run: make integration-test
      - run: make e2e-test

  test-e2e-consul:
    runs-on: 'ubuntu-22.04' # this job requires sudo, so not currently suitable for self-hosted runners
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Git config token
        if: endsWith(github.repository, '-enterprise')
        run: git config --global url.'https://${{ secrets.ELEVATED_GITHUB_TOKEN }}@github.com'.insteadOf 'https://github.com'
      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          cache: ${{ contains(runner.name, 'Github Actions') }}
          go-version-file: .go-version
          cache-dependency-path: '**/go.sum'
      - name: Consul Compatability
        run: |
          make deps
          sudo make cni
          sudo sed -i 's!Defaults!#Defaults!g' /etc/sudoers
          sudo -E env "PATH=$PATH" make integration-test-consul

  test-e2e-client-intro:
    runs-on: ${{ endsWith(github.repository, '-enterprise') && fromJSON('["self-hosted", "ondemand", "linux"]') || 'ubuntu-22.04' }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Git config token
        if: endsWith(github.repository, '-enterprise')
        run: git config --global url.'https://${{ secrets.ELEVATED_GITHUB_TOKEN }}@github.com'.insteadOf 'https://github.com'
      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          cache: ${{ contains(runner.name, 'Github Actions') }}
          go-version-file: .go-version
          cache-dependency-path: "**/go.sum"
      - name: Client Introuction
        run: |
          make deps
          make integration-test-client-intro

  handle-failure:
    needs:
      - test-e2e-vault
      - test-e2e-consul
      - test-e2e-client-intro
    if: always() && github.event_name == 'push' && contains(needs.*.result, 'failure')
    uses: ./.github/workflows/test-failure-notification.yml
    secrets: inherit
    with:
      actor: ${{ github.triggering_actor }}
      git-branch: ${{ github.ref_name }}
      workflow-run-id: ${{ github.run_id }}
      workflow-name: ${{ github.workflow }}

permissions:
  contents: read
  id-token: write