helm-external-secrets/e2e/matrix.yaml

# Source of truth for the non-managed e2e fan-out (e2e.yml). Each area is one CI
# leg: a suite binary run under a Ginkgo label filter. The build job compiles
# the images once; every enabled area runs as its own matrix leg on its own kind
# cluster, so a flaky addon in one provider cannot fail the others.
#
# Fields:
#   name          leg id, shown as "test (<name>)" in the checks list.
#   suite         which suite binary to run (TEST_SUITES). One suite per leg so a
#                 label filter never has to span binaries that lack the labels.
#   labels        Ginkgo -label-filter (GINKGO_LABELS). This workflow is
#                 non-managed only; the managed IRSA/workload-identity specs run
#                 in e2e-managed.yml, so every filter ends with "&& !managed".
#   providers     provider case names this leg covers. Used only by matrix.py
#                 check, to prove every provider compiled into the suite
#                 (suites/provider/cases/import.go) is classified: covered by an
#                 enabled leg, or listed under local_only. Not read at run time.
#   secret_groups external credential groups this leg receives. The reusable
#                 workflow injects a provider's secrets only when its group is
#                 listed here, so a vault leg never sees AWS creds. Empty means
#                 the leg runs against in-cluster addons only (fork-safe). Group
#                 names map to secret sets in e2e-reusable.yml.
#   needs_secrets convenience mirror of "secret_groups is non-empty". Documents
#                 intent; not read by CI.
#   paths         globs whose change should trigger this leg. Seed for the
#                 phase 2 affected-only resolver; ignored by the static phase 1
#                 matrix, which runs every enabled area.
#   enabled       whether CI runs this leg. A disabled area does NOT count as
#                 coverage: an imported provider whose only area is disabled runs
#                 nowhere, which matrix.py check now rejects. Use it to park a
#                 leg briefly, not to record an intention.
#
# All legs are enabled. A second top-level key, local_only, lists providers that
# are compiled in but deliberately have no leg; see the end of this file.

areas:
  # In-cluster only, no external credentials. The required floor: this leg runs
  # on every PR (including forks) and is the stable branch-protection gate.
  - name: core-smoke
    suite: provider
    labels: "(fake || kubernetes || template) && !managed"
    providers: [fake, kubernetes, template]
    secret_groups: []
    needs_secrets: false
    paths:
      - "apis/**"
      - "pkg/**"
      - "runtime/**"
      - "cmd/**"
      - "deploy/**"
      - "e2e/framework/**"
      - "e2e/suites/provider/cases/fake/**"
      - "e2e/suites/provider/cases/kubernetes/**"
      - "e2e/suites/provider/cases/template/**"
      - "e2e/suites/provider/cases/common/**"
    enabled: true

  # The CRD provider reads arbitrary custom resources from the local cluster
  # API, so it needs no credentials and no addon. It gets its own leg rather
  # than joining core-smoke because its specs install a cluster-scoped test CRD
  # and cluster-wide RBAC, heavier setup than the rest of that leg carries.
  # Like every enabled area it feeds e2e-required, so a failure here does turn
  # the gate red; the split buys attribution (the failing leg names the
  # provider) and keeps a crd break from also failing the fake, kubernetes, and
  # template specs.
  - name: crd
    suite: provider
    labels: "crd && !managed"
    providers: [crd]
    secret_groups: []
    needs_secrets: false
    paths:
      - "providers/v1/crd/**"
      - "e2e/suites/provider/cases/crd/**"
    enabled: true

  # Self-hosted secret backends, installed as in-cluster addons (no cloud
  # creds). One leg per provider so a broken addon (e.g. conjur) fails only its
  # own leg, not the others, and the leg name matches what it runs.
  - name: vault
    suite: provider
    labels: "vault && !managed"
    providers: [vault]
    secret_groups: []
    needs_secrets: false
    paths:
      - "providers/v1/vault/**"
      - "e2e/suites/provider/cases/vault/**"
    enabled: true

  - name: openbao
    suite: provider
    labels: "openbao && !managed"
    providers: [openbao]
    secret_groups: []
    needs_secrets: false
    paths:
      - "providers/v1/openbao/**"
      - "e2e/suites/provider/cases/openbao/**"
    enabled: true

  - name: conjur
    suite: provider
    labels: "conjur && !managed"
    providers: [conjur]
    secret_groups: []
    needs_secrets: false
    paths:
      - "providers/v1/conjur/**"
      - "e2e/suites/provider/cases/conjur/**"
    enabled: true

  # Cloud provider, non-managed specs. Needs AWS OIDC credentials.
  - name: aws
    suite: provider
    labels: "aws && !managed"
    providers: [aws]
    secret_groups: [aws]
    needs_secrets: true
    paths:
      - "providers/v1/aws/**"
      - "e2e/suites/provider/cases/aws/**"
    enabled: true

  # ---- Cloud / external-API providers (each scoped to its own secret group). ----

  - name: gcp
    suite: provider
    labels: "gcp && !managed"
    providers: [gcp]
    secret_groups: [gcp]
    needs_secrets: true
    paths:
      - "providers/v1/gcp/**"
      - "e2e/suites/provider/cases/gcp/**"
    enabled: true

  - name: azure
    suite: provider
    labels: "azure && !managed"
    providers: [azure]
    secret_groups: [azure]
    needs_secrets: true
    paths:
      - "providers/v1/azure/**"
      - "e2e/suites/provider/cases/azure/**"
    enabled: true

  - name: scaleway
    suite: provider
    labels: "scaleway && !managed"
    providers: [scaleway]
    secret_groups: [scaleway]
    needs_secrets: true
    paths:
      - "providers/v1/scaleway/**"
      - "e2e/suites/provider/cases/scaleway/**"
    enabled: true

  - name: delinea
    suite: provider
    labels: "delinea && !managed"
    providers: [delinea]
    secret_groups: [delinea]
    needs_secrets: true
    paths:
      - "providers/v1/delinea/**"
      - "e2e/suites/provider/cases/delinea/**"
    enabled: true

  - name: secretserver
    suite: provider
    labels: "secretserver && !managed"
    providers: [secretserver]
    secret_groups: [secretserver]
    needs_secrets: true
    paths:
      - "providers/v1/secretserver/**"
      - "e2e/suites/provider/cases/secretserver/**"
    enabled: true

  # Infisical runs against an in-cluster Infisical addon (addon.NewInfisical),
  # not an external tenant, so it needs no repo secrets despite being a SaaS.
  - name: infisical
    suite: provider
    labels: "infisical && !managed"
    providers: [infisical]
    secret_groups: []
    needs_secrets: false
    paths:
      - "providers/v1/infisical/**"
      - "e2e/suites/provider/cases/infisical/**"
    enabled: true

  # Non-provider suites. No provider labels, so providers is empty; they run the
  # whole non-managed suite. flux and argocd exercise ESO under GitOps tools and
  # need no creds.
  #
  # The generator suite is split in two: the grafana generator talks to a live
  # external Grafana Cloud instance (its own leg below), while every other
  # generator runs in-cluster. This leg runs all generators except grafana; the
  # ecr and sts generators mint tokens against real AWS, so it needs the aws
  # group.
  - name: generator
    suite: generator
    labels: "!managed && !grafana"
    providers: []
    secret_groups: [aws]
    needs_secrets: true
    paths:
      - "apis/**"
      - "pkg/**"
      - "runtime/**"
      - "generators/**"
      - "e2e/suites/generator/**"
    enabled: true

  # The grafana generator, isolated. It depends on a live external Grafana Cloud
  # instance (GRAFANA_URL / GRAFANA_TOKEN); the suite even wakes a sleepy
  # instance in BeforeEach. Kept as its own leg so its external flakiness is
  # attributable and never masks the other generators.
  - name: grafana
    suite: generator
    labels: "grafana && !managed"
    providers: []
    secret_groups: [grafana]
    needs_secrets: true
    paths:
      - "generators/v1/grafana/**"
      - "e2e/suites/generator/grafana.go"
    enabled: true

  - name: flux
    suite: flux
    labels: "!managed"
    providers: []
    secret_groups: []
    needs_secrets: false
    paths:
      - "apis/**"
      - "pkg/**"
      - "runtime/**"
      - "e2e/suites/flux/**"
    enabled: true

  - name: argocd
    suite: argocd
    labels: "!managed"
    providers: []
    secret_groups: []
    needs_secrets: false
    paths:
      - "apis/**"
      - "pkg/**"
      - "runtime/**"
      - "e2e/suites/argocd/**"
    enabled: true

# Suites that are compiled in but deliberately have no leg. They need an account
# on an external service, and the project is not taking on further external
# accounts: these providers are community maintained, and holding a leg green
# against a third-party account (quotas, rate limits, credential rotation,
# vendor-side breakage) is upkeep that falls on maintainers rather than on
# whoever owns the provider. Existing external legs above predate this and stay.
#
# Whoever maintains one of these runs its suite locally with their own account;
# see docs/contributing/e2e-credentials.md. They are still blank imported, so
# they compile and a local GINKGO_LABELS selects them. matrix.py check requires
# every imported provider to be covered by an enabled area or listed here, so a
# new suite cannot end up running nowhere.
local_only:
  - akeyless
  - gitlab
  - oracle