ci(e2e): prefix E2E check names so branch protection can match them #477

Merged

nrupard merged 1 commit from fix/BUNYIP-478-e2e-check-names into main

2026-08-05 21:38:16 +02:00

nrupard commented

2026-08-05 21:03:46 +02:00

Owner

What

Rename the two E2E job/check names to a shared E2E / prefix so a single branch-protection pattern can match them:

Playwright against deployment -> E2E / deployment (e2e.yml; push to main + workflow_dispatch, the main/deploy check, never runs on a PR)
Install + reachability (no deployment secrets) -> E2E / PR gate (e2e-pr.yml; pull_request, credential-free, the actual per-PR check)

Why (BUNYIP-478)

Branch protection matches required checks by name pattern. The intended E2E PR gate was matched by nothing: Playwright against deployment has no pull_request trigger (BUNYIP-425), so it is never reported on a PR to satisfy a requirement, and the real PR check (Install + reachability ...) carried no E2E-shaped token, so an E2E-shaped pattern matched neither. The team believed the PR gate was enforced when it was not.

With the shared prefix, one E2E /* required-check pattern matches both, and branch protection can require E2E / PR gate on pull requests while E2E / deployment stays reporting-only on main.

Scope

Names only. Job ids (e2e, e2e-pr), triggers, env: secret scope, and concurrency groups are unchanged. check-workflow-secrets.sh and check-runner-labels.sh both pass.
Delivers AC-1 (documented on the issue) and AC-2 (this rename).
Coordination: the old required-check name stops being produced once this merges, so the branch-protection pattern edit should follow immediately after merge (per the plan agreed on the issue). AC-3 (branch-protection pattern verified against the live matched-checks list), AC-4 (rollout to PIMP-9 / DUNITE-5), and AC-5 (a failing-E2E PR proven unmergeable) are the settings-UI / cross-repo follow-ups tracked on BUNYIP-478.

#BUNYIP-478

## What Rename the two E2E job/check names to a shared `E2E /` prefix so a single branch-protection pattern can match them: - `Playwright against deployment` -> `E2E / deployment` (e2e.yml; push to main + workflow_dispatch, the main/deploy check, never runs on a PR) - `Install + reachability (no deployment secrets)` -> `E2E / PR gate` (e2e-pr.yml; pull_request, credential-free, the actual per-PR check) ## Why (BUNYIP-478) Branch protection matches required checks by name pattern. The intended E2E PR gate was matched by nothing: `Playwright against deployment` has no `pull_request` trigger (BUNYIP-425), so it is never reported on a PR to satisfy a requirement, and the real PR check (`Install + reachability ...`) carried no E2E-shaped token, so an `E2E`-shaped pattern matched neither. The team believed the PR gate was enforced when it was not. With the shared prefix, one `E2E /*` required-check pattern matches both, and branch protection can require `E2E / PR gate` on pull requests while `E2E / deployment` stays reporting-only on main. ## Scope - Names only. Job ids (`e2e`, `e2e-pr`), triggers, `env:` secret scope, and concurrency groups are unchanged. `check-workflow-secrets.sh` and `check-runner-labels.sh` both pass. - Delivers AC-1 (documented on the issue) and AC-2 (this rename). - **Coordination**: the old required-check name stops being produced once this merges, so the branch-protection pattern edit should follow immediately after merge (per the plan agreed on the issue). AC-3 (branch-protection pattern verified against the live matched-checks list), AC-4 (rollout to PIMP-9 / DUNITE-5), and AC-5 (a failing-E2E PR proven unmergeable) are the settings-UI / cross-repo follow-ups tracked on BUNYIP-478. #BUNYIP-478

nrupard added 1 commit

2026-08-05 21:03:46 +02:00

ci(e2e): prefix E2E check names so branch protection can match them

E2E PR gate / E2E / PR gate (pull_request) Successful in 13s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 4m15s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

8502ba75a9

Rename the two E2E job/check names to a shared `E2E /` prefix: `Playwright against deployment` becomes `E2E / deployment` (push + workflow_dispatch, the main/deploy check) and `Install + reachability (no deployment secrets)` becomes `E2E / PR gate` (pull_request, credential-free, the actual PR gate).

Before this, no branch-protection pattern could match the intended PR gate: `Playwright against deployment` never runs on pull_request so it is never reported on a PR to satisfy a requirement, and the real PR check name carried no E2E-shaped token, so an `E2E`-shaped pattern matched neither. A single `E2E /*` required-check pattern now matches both, and branch protection can require `E2E / PR gate` on pull requests while `E2E / deployment` stays reporting-only on main.

Names only: job ids (`e2e`, `e2e-pr`), triggers, and secret scope are unchanged (both workflow validators pass). The branch-protection pattern edit, the rollout to the other repos, and the failing-PR-unmergeable proof are separate follow-ups tracked on the issue.

#BUNYIP-478