name: E2E (dev)

# The last stage of the pipeline: security -> test -> build -> deploy -> e2e. Runs the Playwright
# browser suite (apps/web/e2e) against the DEPLOYED dev dashboard, AFTER a dev deploy succeeds -
# the shared post-deploy stage lives in e2e-post-deploy.yml (M24-9), including the E2E-7
# promote/auto-rollback handling.
#
# Gating posture (non-blocking, M12 decision 4): this runs *after* the deploy via workflow_run, so a
# failure surfaces as a red run without blocking the deploy that already happened. Promote to a
# blocking pre-merge gate later, once the suite proves stable on an ephemeral preview (E2E-6).
#
# DORMANT until the E2E_BASE_URL repository variable points at the deployed dev dashboard origin.
# That origin must (a) serve /api same-origin - the Pages Functions proxy (apps/web/functions)
# does this, as does the k3s ingress after the M24-5 cutover - and (b) run the API with
# BLOOM_ENABLE_TEST_LOGIN=true + BLOOM_TEST_LOGIN_PASSWORD (runtime-only Actions secrets, never
# committed). Activation runbook: docs/deployment.md; suite docs: apps/web/e2e/README.md.

on:
  workflow_run:
    workflows: ["Deploy (dev)", "Deploy Web (dev)", "Deploy (dev, k3s)"]
    types: [completed]
    branches: [main]
  workflow_dispatch:

concurrency:
  group: e2e-dev
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  e2e:
    # Only after a successful dev deploy, and only once an E2E target URL is configured
    # (the repo-level E2E_BASE_URL variable - env-scoped variables are not visible to a
    # job-level `if`, so the gate stays on a repo variable).
    if: >-
      ${{ vars.E2E_BASE_URL != '' &&
          (github.event_name == 'workflow_dispatch' ||
           github.event.workflow_run.conclusion == 'success') }}
    permissions:
      contents: read
      packages: read
    uses: ./.github/workflows/e2e-post-deploy.yml
    with:
      # The `dev` environment's secrets supply BLOOM_TEST_LOGIN_PASSWORD (suite auth) and
      # DEPLOY_HOST/DEPLOY_SSH_KEY (the E2E-7 promote / auto-rollback steps).
      environment: dev
      base-url: ${{ vars.E2E_BASE_URL }}
    secrets: inherit