upstream-mattermost/.github/workflows/e2e-tests-playwright.yml

---
name: E2E Tests - Playwright
on:
  workflow_call:
    inputs:
      commit_sha:
        type: string
        required: true
      enable_reporting:
        type: boolean
        required: false
        default: false
      server:
        type: string
        required: false
        default: onprem
      report_type:
        type: string
        required: false
      pr_number:
        type: string
        required: false
      server_image_tag:
        type: string
        required: false
        description: "Server image tag (e.g., master or short SHA)"
      server_edition:
        type: string
        required: false
        description: "Server edition: enterprise (default), fips, or team"
      server_image_repo:
        type: string
        required: false
        default: mattermostdevelopment
        description: "Docker registry: mattermostdevelopment (default) or mattermost"
      server_image_aliases:
        type: string
        required: false
        description: "Comma-separated alias tags for context name (e.g., 'release-11.4, release-11')"
      ref_branch:
        type: string
        required: false
        description: "Source branch name for webhook messages (e.g., 'master' or 'release-11.4')"
      should_run:
        type: string
        required: false
        default: "true"
        description: "Set to 'false' to skip tests and post a success status without running E2E"
      run_rolling_upgrades:
        type: string
        required: false
        default: "false"
        description: "Set to 'true' to run playwright rolling-upgrade coverage (off by default on PR)"
    secrets:
      MM_LICENSE:
        required: false
      REPORT_WEBHOOK_URL:
        required: false

permissions: {}

jobs:
  generate-build-variables:
    runs-on: ubuntu-24.04
    outputs:
      branch: "${{ steps.build-vars.outputs.branch }}"
      build_id: "${{ steps.build-vars.outputs.build_id }}"
      server_image_tag: "${{ steps.build-vars.outputs.server_image_tag }}"
      server_image: "${{ steps.build-vars.outputs.server_image }}"
      context_suffix: "${{ steps.build-vars.outputs.context_suffix }}"
    steps:
      - name: ci/generate-build-variables
        id: build-vars
        env:
          COMMIT_SHA: ${{ inputs.commit_sha }}
          INPUT_REF_BRANCH: ${{ inputs.ref_branch }}
          INPUT_REPORT_TYPE: ${{ inputs.report_type }}
          INPUT_SERVER_EDITION: ${{ inputs.server_edition }}
          INPUT_SERVER_IMAGE_ALIASES: ${{ inputs.server_image_aliases }}
          INPUT_SERVER_IMAGE_REPO: ${{ inputs.server_image_repo }}
          INPUT_SERVER_IMAGE_TAG: ${{ inputs.server_image_tag }}
          PR_NUMBER: ${{ inputs.pr_number }}
          RUN_ATTEMPT: ${{ github.run_attempt }}
          RUN_ID: ${{ github.run_id }}
        run: |
          # Use provided server_image_tag or derive from commit SHA
          if [ -n "$INPUT_SERVER_IMAGE_TAG" ]; then
            SERVER_IMAGE_TAG="$INPUT_SERVER_IMAGE_TAG"
          else
            SERVER_IMAGE_TAG="${COMMIT_SHA::7}"
          fi

          # Validate server_image_tag format (alphanumeric, dots, hyphens, underscores)
          if ! [[ "$SERVER_IMAGE_TAG" =~ ^[a-zA-Z0-9._-]+$ ]]; then
            echo "::error::Invalid server_image_tag format: ${SERVER_IMAGE_TAG}"
            exit 1
          fi
          echo "server_image_tag=${SERVER_IMAGE_TAG}" >> $GITHUB_OUTPUT

          # Generate branch name. For master/release runs we pass the real
          # ref_branch through verbatim (`master`, `release-11.7`) so the
          # dashboard's /reports/{repo}/{branch} grouping aggregates every
          # build on that branch instead of treating each image tag as its
          # own "branch". PR and commit-only fallback paths keep their
          # synthetic prefix because there's no real branch to use.
          REF_BRANCH="${INPUT_REF_BRANCH}"
          if [ -n "$PR_NUMBER" ]; then
            echo "branch=pr-${PR_NUMBER}" >> $GITHUB_OUTPUT
          elif [ -n "$REF_BRANCH" ]; then
            echo "branch=${REF_BRANCH}" >> $GITHUB_OUTPUT
          else
            echo "branch=commit-${COMMIT_SHA::7}" >> $GITHUB_OUTPUT
          fi

          # Determine server image name
          EDITION="${INPUT_SERVER_EDITION}"
          REPO="${INPUT_SERVER_IMAGE_REPO}"
          REPO="${REPO:-mattermostdevelopment}"
          case "$EDITION" in
            fips) IMAGE_NAME="mattermost-enterprise-fips-edition" ;;
            team) IMAGE_NAME="mattermost-team-edition" ;;
            *)    IMAGE_NAME="mattermost-enterprise-edition" ;;
          esac
          SERVER_IMAGE="${REPO}/${IMAGE_NAME}:${SERVER_IMAGE_TAG}"
          echo "server_image=${SERVER_IMAGE}" >> $GITHUB_OUTPUT

          # Validate server_image_aliases format if provided
          ALIASES="${INPUT_SERVER_IMAGE_ALIASES}"
          if [ -n "$ALIASES" ] && ! [[ "$ALIASES" =~ ^[a-zA-Z0-9._,\ -]+$ ]]; then
            echo "::error::Invalid server_image_aliases format: ${ALIASES}"
            exit 1
          fi

          # Generate build ID
          if [ -n "$EDITION" ] && [ "$EDITION" != "enterprise" ]; then
            echo "build_id=${RUN_ID}_${RUN_ATTEMPT}-${SERVER_IMAGE_TAG}-playwright-onprem-${EDITION}" >> $GITHUB_OUTPUT
          else
            echo "build_id=${RUN_ID}_${RUN_ATTEMPT}-${SERVER_IMAGE_TAG}-playwright-onprem-ent" >> $GITHUB_OUTPUT
          fi

          # Generate context name suffix based on report type
          REPORT_TYPE="${INPUT_REPORT_TYPE}"
          case "$REPORT_TYPE" in
            MASTER) echo "context_suffix=/master" >> $GITHUB_OUTPUT ;;
            RELEASE) echo "context_suffix=/release" >> $GITHUB_OUTPUT ;;
            RELEASE_CUT) echo "context_suffix=/release-cut" >> $GITHUB_OUTPUT ;;
            *) echo "context_suffix=" >> $GITHUB_OUTPUT ;;
          esac

  skip:
    needs:
      - generate-build-variables
    if: inputs.should_run == 'false'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      statuses: write
    steps:
      - name: ci/post-skip-status
        env:
          COMMIT_SHA: ${{ inputs.commit_sha }}
          CONTEXT_NAME: "e2e-test/playwright-full/${{ inputs.server_edition || 'enterprise' }}${{ needs.generate-build-variables.outputs.context_suffix }}"
          GH_TOKEN: ${{ github.token }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_RUN_ID: ${{ github.run_id }}
        run: |
          gh api "repos/${GITHUB_REPOSITORY}/statuses/${COMMIT_SHA}" \
            -f state=success \
            -f context="${CONTEXT_NAME}" \
            -f description="No E2E-relevant changes - skipped" \
            -f target_url="https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
          echo "Posted success for ${CONTEXT_NAME}"

  playwright-full:
    needs:
      - generate-build-variables
    if: inputs.should_run != 'false'
    permissions:
      contents: read
      statuses: write
      id-token: write
      pull-requests: write
    uses: ./.github/workflows/e2e-tests-playwright-template.yml
    with:
      workers: 20
      enabled_docker_services: "postgres inbucket"
      commit_sha: ${{ inputs.commit_sha }}
      branch: ${{ needs.generate-build-variables.outputs.branch }}
      build_id: ${{ needs.generate-build-variables.outputs.build_id }}
      server_image_tag: ${{ needs.generate-build-variables.outputs.server_image_tag }}
      server_edition: ${{ inputs.server_edition }}
      server_image_repo: ${{ inputs.server_image_repo }}
      server_image_aliases: ${{ inputs.server_image_aliases }}
      server: ${{ inputs.server }}
      enable_reporting: ${{ inputs.enable_reporting }}
      report_type: ${{ inputs.report_type }}
      ref_branch: ${{ inputs.ref_branch }}
      pr_number: ${{ inputs.pr_number }}
      context_name: "e2e-test/playwright-full/${{ inputs.server_edition || 'enterprise' }}${{ needs.generate-build-variables.outputs.context_suffix }}"
    secrets:
      MM_LICENSE: ${{ secrets.MM_LICENSE }}
      REPORT_WEBHOOK_URL: ${{ secrets.REPORT_WEBHOOK_URL }}

  # Deliberately not gated on should_run: run_rolling_upgrades is already its own gate, decided from
  # the files this pipeline depends on (see e2e-tests-ci.yml's check-changes). should_run tracks
  # server/webapp/spec changes and does not match every one of those files — the matrix resolver is
  # a .mjs, outside its `^e2e-tests/.*\.(ts|tsx|js|jsx)$` pattern — so honouring it here would
  # silently drop runs this pipeline was asked for.
  playwright-rolling-upgrades:
    needs:
      - generate-build-variables
    if: inputs.run_rolling_upgrades == 'true'
    permissions:
      contents: read
      statuses: write
      id-token: write
      pull-requests: write
    uses: ./.github/workflows/e2e-tests-playwright-rolling-upgrades.yml
    with:
      commit_sha: ${{ inputs.commit_sha }}
      server: ${{ inputs.server }}
      server_image_tag: ${{ needs.generate-build-variables.outputs.server_image_tag }}
      server_edition: ${{ inputs.server_edition }}
      server_image_repo: ${{ inputs.server_image_repo }}
      server_image_aliases: ${{ inputs.server_image_aliases }}
      enable_reporting: ${{ inputs.enable_reporting }}
      report_type: ${{ inputs.report_type }}
      ref_branch: ${{ inputs.ref_branch }}
      pr_number: ${{ inputs.pr_number }}
    secrets:
      MM_LICENSE: ${{ secrets.MM_LICENSE }}
      REPORT_WEBHOOK_URL: ${{ secrets.REPORT_WEBHOOK_URL }}