Frank
8af40c402b
Landing blocker for #61 and #63: the deployment checkout is 12 commits behind and `merge --ff-only` refuses while tracked paths are dirty. Discard is not available here (workspace policy: no `checkout`/`stash` on shared state), so the dirt is committed. - `agent/APPEND_SYSTEM.md`: the point-of-use / one-work-log / PR-link doctrine, already byte-identical to `origin/main` (`cmp` against the trunk blob: no difference). No new prose — the commit exists so the trunk merge can proceed. - `agent/config.yml` and `agent/managed-skills/**`: the machine-live tier the heartbeat owns (AGENTS.md § Live-sync tiers). `ALLOW_SECRETS=1` was used, deliberately and after auditing the staged diff by hand: the only credential-shaped strings in it are two copies of `AKIA0000000000000EXAMPLE` — the inert all-zero AWS example id — and they appear inside the two skill pages that teach that exact placeholder shape. This checkout is still running the pre-#61 hook; the merged gate (value-scoped placeholder filter, `71601f7`) exempts this value, so the refusal dies with this landing. No `--no-verify` was used: the gate ran and its verdict is recorded here. Refs #61
62 lines
3.7 KiB
Markdown
62 lines
3.7 KiB
Markdown
---
|
|
name: run-e2e-specs-from-isolated-worktree
|
|
description: "Run serverAppConfigs Playwright e2e specs against the live fleet from a feature branch when git checkout is workspace-policy-blocked — isolated worktree + symlinked deps, with the variadic --project and gitignored-auth traps."
|
|
---
|
|
|
|
## When
|
|
|
|
You are authoring/verifying a `tests/e2e/*.spec.ts` change for `dank/serverAppConfigs` and the shared workspace blocks `git checkout` / branch switch (concurrent-agent safety). You must run the new specs against the LIVE fleet (they are guard-chain tests: Anubis PoW + authentik outpost + app) but a fresh worktree has no `node_modules`, no `.auth`, and no `.env.local`.
|
|
|
|
This is NOT `deploy.sh` (which runs the full e2e gate itself from the main-tracking checkout — see `serverappconfigs-deploy-execution-context`). Use this to iterate/verify individual specs on a branch before opening a PR.
|
|
|
|
## Setup the worktree
|
|
|
|
The main deploy checkout (has the deps + auth state) is `/home/blank/Projects/serverAppConfig`. Branch off `origin/main` into a throwaway worktree:
|
|
|
|
```bash
|
|
git -C <repo> worktree add -b feat/<topic> /tmp/wt-<topic> origin/main
|
|
ME=/home/blank/Projects/serverAppConfig/tests/e2e
|
|
ln -sfn "$ME/node_modules" /tmp/wt-<topic>/tests/e2e/node_modules
|
|
cp -r "$ME/.auth" /tmp/wt-<topic>/tests/e2e/.auth
|
|
cp "$ME/.env.local" /tmp/wt-<topic>/tests/e2e/.env.local # gitignored
|
|
```
|
|
|
|
- **`.env.local` is mandatory** — without it the config throws `missing E2E_STANDARD_USER — set it in tests/e2e/.env.local or the environment` at load, even for `--list`. It is gitignored (a bats seam forbids tracking it), so a fresh worktree never has it.
|
|
- `.auth` holds `qa-e2e.json` / `qa-e2e-admin.json` (the `standard`/`admin`/`guest` storage states); copying it avoids re-login, though the `setup` project refreshes it anyway.
|
|
- The node_modules symlink resolves fine for playwright.
|
|
|
|
## Validate wiring before running
|
|
|
|
```bash
|
|
cd /tmp/wt-<topic>/tests/e2e && npx playwright test --list
|
|
```
|
|
|
|
Confirms your new spec's NUMBER PREFIX is matched into a project. **A spec whose prefix is not in any project's `testMatch` silently never runs** — a green suite with a test that does not exist. The gate is the bats seam `tests/e2e_scaffold.bats` → "every e2e spec is matched by a playwright project". So a new spec `21-foo.spec.ts` MUST also edit `playwright.config.ts`'s `standard` (or other) `testMatch: /(10|12|...|21)-.*\.spec\.ts/`.
|
|
|
|
## Running — the `--project` trap
|
|
|
|
`--project` is **variadic**: the space form swallows the positional filters as extra project names.
|
|
|
|
```bash
|
|
# WRONG: "21-notebook" parsed as a second project → Project(s) not found
|
|
npx playwright test --project standard 21-notebook 22-foo
|
|
|
|
# RIGHT: equals form, then positional title/file filters
|
|
npx playwright test --project=standard 21-notebook 22-foo
|
|
npx playwright test --project=guest 14-guard -g "notebook.franksdank.cloud is gated"
|
|
```
|
|
|
|
`standard`/`admin`/`guest`/`frankbook` all `dependencies: ["setup"]`, so `00-auth.setup.ts` runs first and logs in the qa-e2e accounts (~24 s each). Expect ~50 s wall for a couple of specs.
|
|
|
|
## Verify the spec is meaningful, not vacuous
|
|
|
|
These specs prove the guard chain handed off to the **app**, so assert a positive app marker (title / app content string / the app's own API returning `status:"success"`), never just `status < 500` or "not the IdP shell" — the latter passes on a 404 or a parked login wall (the 13-sso / 17-hermes class of silent-green bug).
|
|
|
|
## Cleanup
|
|
|
|
```bash
|
|
git -C <repo> worktree remove --force /tmp/wt-<topic> # symlink + copied auth are throwaway; branch already pushed
|
|
```
|
|
|
|
Full `./tests/run.sh` (bats, incl. `e2e_scaffold`) must pass before commit; the deploy's own Playwright gate is the canonical live run after merge.
|