# OCI E2E runner

`cicd-tool e2e` is a read-only verifier: it uses `kubectl get` and HTTP GET
only. It never applies resources, reconciles Flux, or calls bootstrap/rebuild.
It emits one JSON result and exits non-zero when a check fails.

Supply explicit resource identifiers and credential-free URLs. The runner waits
independently (bounded by `--timeout`, maximum ten minutes) for Flux
Kustomizations and an ExternalSecret `Ready=True`, a terminal PipelineRun,
the preview response sentinel, and exactly one open Forgejo promotion PR for
the supplied branch. It reads the Forgejo token only from `--promotion-token-env`
or `--promotion-token-file`; do not pass tokens or credential-bearing URLs.

```sh
cicd-tool e2e \
  --kubeconfig /run/secrets/kubeconfig \
  --flux-kustomization flux-system/tekton \
  --external-secret tekton-pipelines/forgejo-webhook \
  --pipelinerun tekton-pipelines/<run-name> \
  --preview-url https://<preview-host>/ \
  --preview-sentinel <non-secret-sentinel> \
  --promotion-pulls-url https://<forgejo>/api/v1/repos/<owner>/<manifests>/pulls \
  --promotion-owner <owner> \
  --promotion-head maidn/promotion-<app>-<sha> \
  --promotion-token-env FORGEJO_TOKEN
```

Build the portable OCI runner with `docker build -t maidn-e2e-runner .`.
Mount the kubeconfig and optional token file read-only; ensure they are readable
by the image's non-root user. The build context excludes known secret-bearing
bootstrap inputs.

## Fixture Boundary

Use `cicd-tool e2e-mutate` only with canonical `Maidn/maidn-e2e-*` fixtures.
The test runner must prove preview, staging, production promotion, runtime
secret/database access, preview cleanup, and orphan cleanup against central
delivery resources. It must not mutate `test-org-2` as a fixture source.