name: E2E (staging)

# Post-deploy Playwright suite against the DEPLOYED staging dashboard - the staging twin of
# E2E (dev) (e2e.yml), sharing the same reusable stage (e2e-post-deploy.yml, M24-9).
#
# Manual dispatch only until M25 stands up the staging deploy workflow - add that workflow's
# name to a workflow_run trigger here then (mirroring e2e.yml), and extend the promote/rollback
# handler (scripts/deploy/e2e-promote-rollback.sh) with the staging deploy target; until then
# the handler no-ops for staging by design.
#
# DORMANT until the E2E_STAGING_BASE_URL repository variable points at the staging dashboard
# origin, whose API must run with BLOOM_ENABLE_TEST_LOGIN=true + BLOOM_TEST_LOGIN_PASSWORD
# (runtime-only Actions secrets in the `staging` environment, never committed - test-login is
# structurally forbidden in production, so this lane exists for dev/staging only). Activation
# runbook: docs/deployment.md; suite docs: apps/web/e2e/README.md.

on:
  workflow_dispatch:

concurrency:
  group: e2e-staging
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  e2e:
    # Dormant until the staging E2E target URL is configured (repo-level variable -
    # env-scoped variables are not visible to a job-level `if`).
    if: ${{ vars.E2E_STAGING_BASE_URL != '' }}
    permissions:
      contents: read
      packages: read
    uses: ./.github/workflows/e2e-post-deploy.yml
    with:
      # The `staging` environment's secrets supply BLOOM_TEST_LOGIN_PASSWORD; its DEPLOY_*
      # secrets stay unset until M25, so promote/rollback is a clean no-op.
      environment: staging
      base-url: ${{ vars.E2E_STAGING_BASE_URL }}
    secrets: inherit