maidn-cli/docs/e2e.md

OCI E2E runner

cicd-tool e2e is a read-only verifier: it uses kubectl get and HTTP GET only. It never applies resources, reconciles Flux, or calls bootstrap/rebuild. It emits one JSON result and exits non-zero when a check fails.

Supply explicit resource identifiers and credential-free URLs. The runner waits independently (bounded by --timeout, maximum ten minutes) for Flux Kustomizations and an ExternalSecret Ready=True, a terminal PipelineRun, the preview response sentinel, and exactly one open Forgejo promotion PR for the supplied branch. It reads the Forgejo token only from --promotion-token-env or --promotion-token-file; do not pass tokens or credential-bearing URLs.

cicd-tool e2e \
  --kubeconfig /run/secrets/kubeconfig \
  --flux-kustomization flux-system/tekton \
  --external-secret tekton-pipelines/forgejo-webhook \
  --pipelinerun tekton-pipelines/<run-name> \
  --preview-url https://<preview-host>/ \
  --preview-sentinel <non-secret-sentinel> \
  --promotion-pulls-url https://<forgejo>/api/v1/repos/<owner>/<manifests>/pulls \
  --promotion-owner <owner> \
  --promotion-head maidn/promotion-<app>-<sha> \
  --promotion-token-env FORGEJO_TOKEN

Build the portable OCI runner with docker build -t maidn-e2e-runner .. Mount the kubeconfig and optional token file read-only; ensure they are readable by the image's non-root user. The build context excludes known secret-bearing bootstrap inputs.

Fixture Boundary

Use cicd-tool e2e-mutate only with canonical Maidn/maidn-e2e-* fixtures. The test runner must prove preview, staging, production promotion, runtime secret/database access, preview cleanup, and orphan cleanup against central delivery resources. It must not mutate test-org-2 as a fixture source.