name: Test — Hetzner Sovereign E2E (real cloud)

# Closes #141 — end-to-end provisioning test on a real Hetzner test
# project. The test does NOT run on every push (each run costs real
# Hetzner CX22 minutes); it runs only on:
#   1. workflow_dispatch (manually triggered by an operator)
#   2. PRs labeled "test/hetzner-e2e"
#
# The test itself skips cleanly when HETZNER_TEST_TOKEN is missing — see
# tests/e2e/hetzner-provisioning/main_test.go. The job below is a no-op
# when the secret is absent, exiting 0 so the matrix doesn't go red.

on:
  workflow_dispatch:
    inputs:
      region:
        description: 'Hetzner region (fsn1, nbg1, hel1, ash, hil)'
        default: 'fsn1'
        required: false
  pull_request:
    types: [labeled, opened, synchronize]

jobs:
  e2e:
    if: |
      github.event_name == 'workflow_dispatch' ||
      contains(github.event.pull_request.labels.*.name, 'test/hetzner-e2e')
    runs-on: ubuntu-latest
    timeout-minutes: 60
    defaults:
      run:
        working-directory: tests/e2e/hetzner-provisioning
    env:
      # Operator populates these in repo secrets. The test SKIPS when
      # HETZNER_TEST_TOKEN is empty — never falls back to mocking.
      HETZNER_TEST_TOKEN: ${{ secrets.HETZNER_TEST_TOKEN }}
      HETZNER_TEST_PROJECT_ID: ${{ secrets.HETZNER_TEST_PROJECT_ID }}
      HETZNER_TEST_REGION: ${{ inputs.region || 'fsn1' }}
      # SSH key — generated below.
      HETZNER_TEST_SSH_PUBLIC_KEY: ''
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.22'
          cache-dependency-path: tests/e2e/hetzner-provisioning/go.sum

      - name: Install OpenTofu
        uses: opentofu/setup-opentofu@v1
        with:
          tofu_version: 1.8.5

      - name: Generate throwaway SSH keypair
        id: sshkey
        run: |
          ssh-keygen -t ed25519 -N "" -f /tmp/e2e_id_ed25519 -C "hetzner-e2e-${{ github.run_id }}"
          {
            echo "HETZNER_TEST_SSH_PUBLIC_KEY<<EOF"
            cat /tmp/e2e_id_ed25519.pub
            echo "EOF"
          } >> "$GITHUB_ENV"

      - name: Run E2E test
        run: |
          if [ -z "$HETZNER_TEST_TOKEN" ]; then
            echo "HETZNER_TEST_TOKEN not populated — test will skip cleanly. This is expected for PRs from forks; operator triggers the real run via workflow_dispatch."
          fi
          go test -v -count=1 -timeout 55m ./...
