mattermost/.github/workflows/e2e-tests-on-release.yml

---
name: E2E Tests (release cut)
on:
  workflow_dispatch:
    inputs:
      branch:
        type: string
        required: true
        description: "Release branch (e.g., 'release-11.4')"
      commit_sha:
        type: string
        required: true
        description: "Commit SHA to test"
      server_image_tag:
        type: string
        required: true
        description: "Docker image tag (e.g., '11.4.0', '11.4.0-rc3', or 'release-11.4')"
      server_image_aliases:
        type: string
        required: false
        description: "Comma-separated alias tags (e.g., 'release-11.4, release-11')"

permissions: {}

jobs:
  validate:
    permissions:
      contents: read
    runs-on: ubuntu-24.04
    outputs:
      ref_branch: "${{ steps.check.outputs.ref_branch }}"
      fips_supported: "${{ steps.check.outputs.fips_supported }}"
    steps:
      - name: ci/checkout-repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          ref: ${{ inputs.branch }}
          fetch-depth: 50
      - name: ci/validate-inputs
        id: check
        env:
          BRANCH: ${{ inputs.branch }}
          COMMIT_SHA: ${{ inputs.commit_sha }}
        run: |
          # Strip refs/heads/ prefix if present
          BRANCH="${BRANCH#refs/heads/}"

          # FIPS builds were introduced in release-11.0; skip FIPS tests for older branches.
          if ! [[ "$BRANCH" =~ ^release-([0-9]+)\.[0-9]+$ ]]; then
            echo "::error::Branch ${BRANCH} must be 'release-X.Y' format."
            exit 1
          elif ! git merge-base --is-ancestor "$COMMIT_SHA" HEAD; then
            echo "::error::Commit ${COMMIT_SHA} is not on branch ${BRANCH}."
            exit 1
          fi

          if [[ "${BASH_REMATCH[1]}" -ge 11 ]]; then
            echo "fips_supported=true" >> $GITHUB_OUTPUT
          else
            echo "fips_supported=false" >> $GITHUB_OUTPUT
          fi

          echo "ref_branch=${BRANCH}" >> $GITHUB_OUTPUT

  # Enterprise Edition
  e2e-cypress:
    needs: validate
    permissions:
      contents: read
      statuses: write
      id-token: write
      pull-requests: write
    uses: ./.github/workflows/e2e-tests-cypress.yml
    with:
      commit_sha: ${{ inputs.commit_sha }}
      server_image_tag: ${{ inputs.server_image_tag }}
      server_image_repo: mattermost
      server_image_aliases: ${{ inputs.server_image_aliases }}
      server: onprem
      enable_reporting: true
      report_type: RELEASE_CUT
      ref_branch: ${{ needs.validate.outputs.ref_branch }}
    secrets:
      MM_LICENSE: "${{ secrets.MM_E2E_TEST_LICENSE_ONPREM_ENT }}"
      AUTOMATION_DASHBOARD_URL: "${{ secrets.MM_E2E_AUTOMATION_DASHBOARD_URL }}"
      AUTOMATION_DASHBOARD_TOKEN: "${{ secrets.MM_E2E_AUTOMATION_DASHBOARD_TOKEN }}"
      PUSH_NOTIFICATION_SERVER: "${{ secrets.MM_E2E_PUSH_NOTIFICATION_SERVER }}"
      REPORT_WEBHOOK_URL: "${{ secrets.MM_E2E_REPORT_WEBHOOK_URL }}"
      CWS_URL: "${{ secrets.MM_E2E_CWS_URL }}"
      CWS_EXTRA_HTTP_HEADERS: "${{ secrets.MM_E2E_CWS_EXTRA_HTTP_HEADERS }}"

  e2e-playwright:
    needs: validate
    permissions:
      contents: read
      statuses: write
      id-token: write
      pull-requests: write
    uses: ./.github/workflows/e2e-tests-playwright.yml
    with:
      commit_sha: ${{ inputs.commit_sha }}
      server_image_tag: ${{ inputs.server_image_tag }}
      server_image_repo: mattermost
      server_image_aliases: ${{ inputs.server_image_aliases }}
      server: onprem
      enable_reporting: true
      report_type: RELEASE_CUT
      ref_branch: ${{ needs.validate.outputs.ref_branch }}
      run_rolling_upgrades: ${{ 'true' }}
    secrets:
      MM_LICENSE: "${{ secrets.MM_E2E_TEST_LICENSE_ONPREM_ENT }}"
      REPORT_WEBHOOK_URL: "${{ secrets.MM_E2E_REPORT_WEBHOOK_URL }}"

  # Full Playwright suite against a server booted under a subpath (PW_SERVER_DEPLOY=subpath).
  # Release-cut only — not run on PR or master/release merges.
  e2e-playwright-subpath:
    needs: validate
    permissions:
      contents: read
      statuses: write
      id-token: write
      pull-requests: write
    uses: ./.github/workflows/e2e-tests-playwright.yml
    with:
      commit_sha: ${{ inputs.commit_sha }}
      server_image_tag: ${{ inputs.server_image_tag }}
      server_image_repo: mattermost
      server_image_aliases: ${{ inputs.server_image_aliases }}
      server: onprem
      enable_reporting: true
      report_type: RELEASE_CUT
      ref_branch: ${{ needs.validate.outputs.ref_branch }}
      server_deploy: subpath
      playwright_project: subpath
    secrets:
      MM_LICENSE: "${{ secrets.MM_E2E_TEST_LICENSE_ONPREM_ENT }}"
      REPORT_WEBHOOK_URL: "${{ secrets.MM_E2E_REPORT_WEBHOOK_URL }}"

  # Enterprise FIPS Edition
  # FIPS builds were introduced in release-11.0; skip for older branches.
  e2e-cypress-fips:
    needs: validate
    if: needs.validate.outputs.fips_supported == 'true'
    permissions:
      contents: read
      statuses: write
      id-token: write
      pull-requests: write
    uses: ./.github/workflows/e2e-tests-cypress.yml
    with:
      commit_sha: ${{ inputs.commit_sha }}
      server_image_tag: ${{ inputs.server_image_tag }}
      server_edition: fips
      server_image_repo: mattermost
      server_image_aliases: ${{ inputs.server_image_aliases }}
      server: onprem
      enable_reporting: true
      report_type: RELEASE_CUT
      ref_branch: ${{ needs.validate.outputs.ref_branch }}
    secrets:
      MM_LICENSE: "${{ secrets.MM_E2E_TEST_LICENSE_ONPREM_ENT }}"
      AUTOMATION_DASHBOARD_URL: "${{ secrets.MM_E2E_AUTOMATION_DASHBOARD_URL }}"
      AUTOMATION_DASHBOARD_TOKEN: "${{ secrets.MM_E2E_AUTOMATION_DASHBOARD_TOKEN }}"
      PUSH_NOTIFICATION_SERVER: "${{ secrets.MM_E2E_PUSH_NOTIFICATION_SERVER }}"
      REPORT_WEBHOOK_URL: "${{ secrets.MM_E2E_REPORT_WEBHOOK_URL }}"
      CWS_URL: "${{ secrets.MM_E2E_CWS_URL }}"
      CWS_EXTRA_HTTP_HEADERS: "${{ secrets.MM_E2E_CWS_EXTRA_HTTP_HEADERS }}"

  e2e-playwright-fips:
    needs: validate
    if: needs.validate.outputs.fips_supported == 'true'
    permissions:
      contents: read
      statuses: write
      id-token: write
      pull-requests: write
    uses: ./.github/workflows/e2e-tests-playwright.yml
    with:
      commit_sha: ${{ inputs.commit_sha }}
      server_image_tag: ${{ inputs.server_image_tag }}
      server_edition: fips
      server_image_repo: mattermost
      server_image_aliases: ${{ inputs.server_image_aliases }}
      server: onprem
      enable_reporting: true
      report_type: RELEASE_CUT
      ref_branch: ${{ needs.validate.outputs.ref_branch }}
      run_rolling_upgrades: ${{ 'true' }}
    secrets:
      MM_LICENSE: "${{ secrets.MM_E2E_TEST_LICENSE_ONPREM_ENT }}"
      REPORT_WEBHOOK_URL: "${{ secrets.MM_E2E_REPORT_WEBHOOK_URL }}"