command-center/agent/managed-skills/run-e2e-specs-from-isolated-worktree/SKILL.md at 1dc01bd0068df3380642e6983790dbbc61c05a7b

0 Fork 0

Files

T

Frank 8af40c402b chore(agent): commit the machine tier and the doctrine text the checkout was already running

Landing blocker for #61 and #63: the deployment checkout is 12 commits behind and
`merge --ff-only` refuses while tracked paths are dirty. Discard is not available here
(workspace policy: no `checkout`/`stash` on shared state), so the dirt is committed.

- `agent/APPEND_SYSTEM.md`: the point-of-use / one-work-log / PR-link doctrine, already
  byte-identical to `origin/main` (`cmp` against the trunk blob: no difference). No new
  prose — the commit exists so the trunk merge can proceed.
- `agent/config.yml` and `agent/managed-skills/**`: the machine-live tier the heartbeat
  owns (AGENTS.md § Live-sync tiers).

`ALLOW_SECRETS=1` was used, deliberately and after auditing the staged diff by hand: the
only credential-shaped strings in it are two copies of `AKIA0000000000000EXAMPLE` — the
inert all-zero AWS example id — and they appear inside the two skill pages that teach
that exact placeholder shape. This checkout is still running the pre-#61 hook; the merged
gate (value-scoped placeholder filter, `71601f7`) exempts this value, so the refusal
dies with this landing. No `--no-verify` was used: the gate ran and its verdict is
recorded here.

Refs #61

2026-10-21 01:44:51 -07:00

3.7 KiB

Raw Blame History

name, description

name	description
run-e2e-specs-from-isolated-worktree	Run serverAppConfigs Playwright e2e specs against the live fleet from a feature branch when git checkout is workspace-policy-blocked — isolated worktree + symlinked deps, with the variadic --project and gitignored-auth traps.

When

You are authoring/verifying a tests/e2e/*.spec.ts change for dank/serverAppConfigs and the shared workspace blocks git checkout / branch switch (concurrent-agent safety). You must run the new specs against the LIVE fleet (they are guard-chain tests: Anubis PoW + authentik outpost + app) but a fresh worktree has no node_modules, no .auth, and no .env.local.

This is NOT deploy.sh (which runs the full e2e gate itself from the main-tracking checkout — see serverappconfigs-deploy-execution-context). Use this to iterate/verify individual specs on a branch before opening a PR.

Setup the worktree

The main deploy checkout (has the deps + auth state) is /home/blank/Projects/serverAppConfig. Branch off origin/main into a throwaway worktree:

git -C <repo> worktree add -b feat/<topic> /tmp/wt-<topic> origin/main
ME=/home/blank/Projects/serverAppConfig/tests/e2e
ln -sfn "$ME/node_modules" /tmp/wt-<topic>/tests/e2e/node_modules
cp -r "$ME/.auth"          /tmp/wt-<topic>/tests/e2e/.auth
cp    "$ME/.env.local"     /tmp/wt-<topic>/tests/e2e/.env.local   # gitignored

.env.local is mandatory — without it the config throws missing E2E_STANDARD_USER — set it in tests/e2e/.env.local or the environment at load, even for --list. It is gitignored (a bats seam forbids tracking it), so a fresh worktree never has it.
.auth holds qa-e2e.json / qa-e2e-admin.json (the standard/admin/guest storage states); copying it avoids re-login, though the setup project refreshes it anyway.
The node_modules symlink resolves fine for playwright.

Validate wiring before running

cd /tmp/wt-<topic>/tests/e2e && npx playwright test --list

Confirms your new spec's NUMBER PREFIX is matched into a project. A spec whose prefix is not in any project's testMatch silently never runs — a green suite with a test that does not exist. The gate is the bats seam tests/e2e_scaffold.bats → "every e2e spec is matched by a playwright project". So a new spec 21-foo.spec.ts MUST also edit playwright.config.ts's standard (or other) testMatch: /(10|12|...|21)-.*\.spec\.ts/.

Running — the `--project` trap

--project is variadic: the space form swallows the positional filters as extra project names.

# WRONG: "21-notebook" parsed as a second project → Project(s) not found
npx playwright test --project standard 21-notebook 22-foo

# RIGHT: equals form, then positional title/file filters
npx playwright test --project=standard 21-notebook 22-foo
npx playwright test --project=guest 14-guard -g "notebook.franksdank.cloud is gated"

standard/admin/guest/frankbook all dependencies: ["setup"], so 00-auth.setup.ts runs first and logs in the qa-e2e accounts (~24 s each). Expect ~50 s wall for a couple of specs.

Verify the spec is meaningful, not vacuous

These specs prove the guard chain handed off to the app, so assert a positive app marker (title / app content string / the app's own API returning status:"success"), never just status < 500 or "not the IdP shell" — the latter passes on a 404 or a parked login wall (the 13-sso / 17-hermes class of silent-green bug).

Cleanup

git -C <repo> worktree remove --force /tmp/wt-<topic>   # symlink + copied auth are throwaway; branch already pushed

Full ./tests/run.sh (bats, incl. e2e_scaffold) must pass before commit; the deploy's own Playwright gate is the canonical live run after merge.

3.7 KiB Raw Blame History