helm-external-secrets/e2e/matrix.yaml

# Source of truth for the non-managed e2e fan-out (e2e.yml). Each area is one CI
# leg: a suite binary run under a Ginkgo label filter. The build job compiles
# the images once; each selected area runs as its own matrix leg on its own kind
# cluster, so a flaky addon in one provider cannot fail the others. On a pull
# request the selection is the legs the diff can affect (see paths below); every
# other event runs all enabled areas.
#
# Fields:
#   name          leg id, shown as "test (<name>)" in the checks list.
#   suite         which suite binary to run (TEST_SUITES). One suite per leg so a
#                 label filter never has to span binaries that lack the labels.
#   labels        Ginkgo -label-filter (GINKGO_LABELS). This workflow is
#                 non-managed only; the managed IRSA/workload-identity specs run
#                 in e2e-managed.yml, so every filter ends with "&& !managed".
#   providers     provider case names this leg covers. Used only by
#                 check-matrix.sh to prove every provider compiled into the suite
#                 (suites/provider/cases/import.go) is tested somewhere. Not read
#                 by CI at run time.
#   secret_groups external credential groups this leg receives. The reusable
#                 workflow injects a provider's secrets only when its group is
#                 listed here, so a vault leg never sees AWS creds. Empty means
#                 the leg runs against in-cluster addons only (fork-safe). Group
#                 names map to secret sets in e2e-reusable.yml.
#   needs_secrets convenience mirror of "secret_groups is non-empty". Documents
#                 intent; not read by CI.
#   paths         globs whose change triggers this leg. Read by the resolver
#                 (matrix.py json --changed) on pull requests; every enabled
#                 area runs on other events. Required on enabled areas, or the
#                 leg would sit out nearly every PR.
#   always        opt this leg out of affected-only filtering, so it runs on
#                 every PR whatever changed. Set on the required floor only:
#                 something must always run, or the matrix could come out empty.
#   enabled       whether CI runs this leg at all. Disabled areas still count
#                 for coverage and document the target matrix; flip to true to
#                 expand the fan-out.
#
# All legs are enabled. Set enabled: false on an area to skip it (e.g. while a
# provider's e2e is being fixed) without deleting its definition.

# Shared machinery no single leg owns: a change here runs every enabled leg.
# Not belt-and-braces: apis/, pkg/ and runtime/ appear in only four areas'
# paths, so per-area matching alone would skip every provider leg on a core
# change, losing coverage exactly when it matters most.
#
# The e2e entries are listed file by file on purpose. Globs are fnmatch, where
# * crosses /, so "e2e/*" would also match e2e/suites/... and make every change
# run everything. e2e/README.md is left out so a docs edit stays cheap.
full_matrix_paths:
  - "apis/**"
  - "pkg/**"
  - "runtime/**"
  - "cmd/**"
  - "deploy/**"
  - "hack/**"
  - "go.mod"
  - "go.sum"
  - "Makefile"
  - "Dockerfile*"
  - ".github/workflows/**"
  # Every leg runs the same image and the same kind cluster, so all of this is
  # shared: the Dockerfile ADDs entrypoint.sh, k8s/ and all four suite
  # binaries, and the Makefile creates the cluster from kind.yaml.
  - "e2e/Dockerfile"
  - "e2e/entrypoint.sh"
  - "e2e/go.mod"
  - "e2e/go.sum"
  - "e2e/kind.yaml"
  - "e2e/Makefile"
  - "e2e/matrix.py"
  - "e2e/matrix.yaml"
  - "e2e/run.sh"
  - "e2e/tools.go"
  - "e2e/framework/**"
  - "e2e/k8s/**"
  - "e2e/suites/provider/cases/common/**"
  - "e2e/suites/provider/cases/import.go"
  # The provider suite's bootstrap sits one level above every provider leg's
  # cases/<name>/** globs, so nothing else selects it. check rule 6 keeps any
  # future sibling from going uncovered the same way.
  - "e2e/suites/provider/suite_test.go"

areas:
  # In-cluster only, no external credentials. The required floor: never
  # filtered out, so it runs whatever a pull request changed. Not "including
  # forks": a fork PR runs no leg at all until /ok-to-test dispatches.
  - name: core-smoke
    suite: provider
    labels: "(fake || kubernetes || template) && !managed"
    providers: [fake, kubernetes, template]
    secret_groups: []
    needs_secrets: false
    paths:
      - "apis/**"
      - "pkg/**"
      - "runtime/**"
      - "cmd/**"
      - "deploy/**"
      - "e2e/framework/**"
      - "e2e/suites/provider/cases/fake/**"
      - "e2e/suites/provider/cases/kubernetes/**"
      - "e2e/suites/provider/cases/template/**"
      - "e2e/suites/provider/cases/common/**"
      # The providers these specs drive through the controller. Listed even
      # though always: true already forces this leg, so coverage does not
      # silently depend on that flag staying set.
      - "providers/v1/fake/**"
      - "providers/v1/kubernetes/**"
    always: true
    enabled: true

  # The CRD provider reads arbitrary custom resources from the local cluster
  # API, so it needs no credentials and no addon. It gets its own leg rather
  # than joining core-smoke because its specs install a cluster-scoped test CRD
  # and cluster-wide RBAC, heavier setup than the rest of that leg carries.
  # Like every enabled area it feeds e2e-required, so a failure here does turn
  # the gate red; the split buys attribution (the failing leg names the
  # provider) and keeps a crd break from also failing the fake, kubernetes, and
  # template specs.
  - name: crd
    suite: provider
    labels: "crd && !managed"
    providers: [crd]
    secret_groups: []
    needs_secrets: false
    paths:
      - "providers/v1/crd/**"
      - "e2e/suites/provider/cases/crd/**"
    enabled: true

  # Self-hosted secret backends, installed as in-cluster addons (no cloud
  # creds). One leg per provider so a broken addon (e.g. conjur) fails only its
  # own leg, not the others, and the leg name matches what it runs.
  - name: vault
    suite: provider
    labels: "vault && !managed"
    providers: [vault]
    secret_groups: []
    needs_secrets: false
    paths:
      - "providers/v1/vault/**"
      - "e2e/suites/provider/cases/vault/**"
    enabled: true

  - name: openbao
    suite: provider
    labels: "openbao && !managed"
    providers: [openbao]
    secret_groups: []
    needs_secrets: false
    paths:
      - "providers/v1/openbao/**"
      - "e2e/suites/provider/cases/openbao/**"
    enabled: true

  - name: conjur
    suite: provider
    labels: "conjur && !managed"
    providers: [conjur]
    secret_groups: []
    needs_secrets: false
    paths:
      - "providers/v1/conjur/**"
      - "e2e/suites/provider/cases/conjur/**"
    enabled: true

  # Cloud provider, non-managed specs. Needs AWS OIDC credentials.
  - name: aws
    suite: provider
    labels: "aws && !managed"
    providers: [aws]
    secret_groups: [aws]
    needs_secrets: true
    paths:
      - "providers/v1/aws/**"
      - "e2e/suites/provider/cases/aws/**"
    enabled: true

  # ---- Cloud / external-API providers (each scoped to its own secret group). ----

  - name: gcp
    suite: provider
    labels: "gcp && !managed"
    providers: [gcp]
    secret_groups: [gcp]
    needs_secrets: true
    paths:
      - "providers/v1/gcp/**"
      - "e2e/suites/provider/cases/gcp/**"
    enabled: true

  - name: azure
    suite: provider
    labels: "azure && !managed"
    providers: [azure]
    secret_groups: [azure]
    needs_secrets: true
    paths:
      - "providers/v1/azure/**"
      - "e2e/suites/provider/cases/azure/**"
    enabled: true

  - name: scaleway
    suite: provider
    labels: "scaleway && !managed"
    providers: [scaleway]
    secret_groups: [scaleway]
    needs_secrets: true
    paths:
      - "providers/v1/scaleway/**"
      - "e2e/suites/provider/cases/scaleway/**"
    enabled: true

  - name: delinea
    suite: provider
    labels: "delinea && !managed"
    providers: [delinea]
    secret_groups: [delinea]
    needs_secrets: true
    paths:
      - "providers/v1/delinea/**"
      - "e2e/suites/provider/cases/delinea/**"
    enabled: true

  - name: secretserver
    suite: provider
    labels: "secretserver && !managed"
    providers: [secretserver]
    secret_groups: [secretserver]
    needs_secrets: true
    paths:
      - "providers/v1/secretserver/**"
      - "e2e/suites/provider/cases/secretserver/**"
    enabled: true

  # Infisical runs against an in-cluster Infisical addon (addon.NewInfisical),
  # not an external tenant, so it needs no repo secrets despite being a SaaS.
  - name: infisical
    suite: provider
    labels: "infisical && !managed"
    providers: [infisical]
    secret_groups: []
    needs_secrets: false
    paths:
      - "providers/v1/infisical/**"
      - "e2e/suites/provider/cases/infisical/**"
    enabled: true

  # Non-provider suites. No provider labels, so providers is empty; they run the
  # whole non-managed suite. flux and argocd exercise ESO under GitOps tools and
  # need no creds.
  #
  # The generator suite is split in two: the grafana generator talks to a live
  # external Grafana Cloud instance (its own leg below), while every other
  # generator runs in-cluster. This leg runs all generators except grafana; the
  # ecr and sts generators mint tokens against real AWS, so it needs the aws
  # group.
  - name: generator
    suite: generator
    labels: "!managed && !grafana"
    providers: []
    secret_groups: [aws]
    needs_secrets: true
    paths:
      - "apis/**"
      - "pkg/**"
      - "runtime/**"
      - "generators/**"
      - "e2e/suites/generator/**"
    enabled: true

  # The grafana generator, isolated. It depends on a live external Grafana Cloud
  # instance (GRAFANA_URL / GRAFANA_TOKEN); the suite even wakes a sleepy
  # instance in BeforeEach. Kept as its own leg so its external flakiness is
  # attributable and never masks the other generators.
  - name: grafana
    suite: generator
    labels: "grafana && !managed"
    providers: []
    secret_groups: [grafana]
    needs_secrets: true
    paths:
      - "generators/v1/grafana/**"
      # The whole suite dir, not just grafana.go: the bootstrap and the shared
      # assertion helper live beside it, and naming files one by one would miss
      # the next shared one somebody adds.
      - "e2e/suites/generator/**"
    enabled: true

  - name: flux
    suite: flux
    labels: "!managed"
    providers: []
    secret_groups: []
    needs_secrets: false
    paths:
      - "apis/**"
      - "pkg/**"
      - "runtime/**"
      - "e2e/suites/flux/**"
      - "e2e/suites/provider/cases/fake/**" # flux.go drives the fake provider
    enabled: true

  - name: argocd
    suite: argocd
    labels: "!managed"
    providers: []
    secret_groups: []
    needs_secrets: false
    paths:
      - "apis/**"
      - "pkg/**"
      - "runtime/**"
      - "e2e/suites/argocd/**"
      - "e2e/suites/provider/cases/fake/**" # argocd.go drives the fake provider
    enabled: true