helm-external-secrets/e2e/matrix.yaml

# Source of truth for the non-managed e2e fan-out (e2e.yml). Each area is one CI
# leg: a suite binary run under a Ginkgo label filter. The build job compiles
# the images once; every enabled area runs as its own matrix leg on its own kind
# cluster, so a flaky addon in one provider cannot fail the others.
#
# Fields:
#   name          leg id, shown as "test (<name>)" in the checks list.
#   suite         which suite binary to run (TEST_SUITES). One suite per leg so a
#                 label filter never has to span binaries that lack the labels.
#   labels        Ginkgo -label-filter (GINKGO_LABELS). This workflow is
#                 non-managed only; the managed IRSA/workload-identity specs run
#                 in e2e-managed.yml, so every filter ends with "&& !managed".
#   providers     provider case names this leg covers. Used only by
#                 check-matrix.sh to prove every provider compiled into the suite
#                 (suites/provider/cases/import.go) is tested somewhere. Not read
#                 by CI at run time.
#   secret_groups external credential groups this leg receives. The reusable
#                 workflow injects a provider's secrets only when its group is
#                 listed here, so a vault leg never sees AWS creds. Empty means
#                 the leg runs against in-cluster addons only (fork-safe). Group
#                 names map to secret sets in e2e-reusable.yml.
#   needs_secrets convenience mirror of "secret_groups is non-empty". Documents
#                 intent; not read by CI.
#   paths         globs whose change should trigger this leg. Seed for the
#                 phase 2 affected-only resolver; ignored by the static phase 1
#                 matrix, which runs every enabled area.
#   enabled       whether phase 1 CI runs this leg now. Disabled areas still
#                 count for coverage and document the target matrix; flip to true
#                 to expand the fan-out.
#
# All legs are enabled. Set enabled: false on an area to skip it (e.g. while a
# provider's e2e is being fixed) without deleting its definition.

areas:
  # In-cluster only, no external credentials. The required floor: this leg runs
  # on every PR (including forks) and is the stable branch-protection gate.
  - name: core-smoke
    suite: provider
    labels: "(fake || kubernetes || template) && !managed"
    providers: [fake, kubernetes, template]
    secret_groups: []
    needs_secrets: false
    paths:
      - "apis/**"
      - "pkg/**"
      - "runtime/**"
      - "cmd/**"
      - "deploy/**"
      - "e2e/framework/**"
      - "e2e/suites/provider/cases/fake/**"
      - "e2e/suites/provider/cases/kubernetes/**"
      - "e2e/suites/provider/cases/template/**"
      - "e2e/suites/provider/cases/common/**"
    enabled: true

  # The CRD provider reads arbitrary custom resources from the local cluster
  # API, so it needs no credentials and no addon. It gets its own leg rather
  # than joining core-smoke because its specs install a cluster-scoped test CRD
  # and cluster-wide RBAC, heavier setup than the rest of that leg carries.
  # Like every enabled area it feeds e2e-required, so a failure here does turn
  # the gate red; the split buys attribution (the failing leg names the
  # provider) and keeps a crd break from also failing the fake, kubernetes, and
  # template specs.
  - name: crd
    suite: provider
    labels: "crd && !managed"
    providers: [crd]
    secret_groups: []
    needs_secrets: false
    paths:
      - "providers/v1/crd/**"
      - "e2e/suites/provider/cases/crd/**"
    enabled: true

  # The webhook provider talks to an HTTP backend the suite runs inside its own
  # test process (spec.url accepts any address), so it needs no credentials and
  # no addon. Its own leg for the same reason as crd: attribution, and so a
  # webhook break does not also fail the fake, kubernetes and template specs.
  - name: webhook
    suite: provider
    labels: "webhook && !managed"
    providers: [webhook]
    secret_groups: []
    needs_secrets: false
    paths:
      - "providers/v1/webhook/**"
      - "e2e/suites/provider/cases/webhook/**"
    enabled: true

  # Self-hosted secret backends, installed as in-cluster addons (no cloud
  # creds). One leg per provider so a broken addon (e.g. conjur) fails only its
  # own leg, not the others, and the leg name matches what it runs.
  - name: vault
    suite: provider
    labels: "vault && !managed"
    providers: [vault]
    secret_groups: []
    needs_secrets: false
    paths:
      - "providers/v1/vault/**"
      - "e2e/suites/provider/cases/vault/**"
    enabled: true

  - name: openbao
    suite: provider
    labels: "openbao && !managed"
    providers: [openbao]
    secret_groups: []
    needs_secrets: false
    paths:
      - "providers/v1/openbao/**"
      - "e2e/suites/provider/cases/openbao/**"
    enabled: true

  - name: conjur
    suite: provider
    labels: "conjur && !managed"
    providers: [conjur]
    secret_groups: []
    needs_secrets: false
    paths:
      - "providers/v1/conjur/**"
      - "e2e/suites/provider/cases/conjur/**"
    enabled: true

  # Cloud provider, non-managed specs. Needs AWS OIDC credentials.
  - name: aws
    suite: provider
    labels: "aws && !managed"
    providers: [aws]
    secret_groups: [aws]
    needs_secrets: true
    paths:
      - "providers/v1/aws/**"
      - "e2e/suites/provider/cases/aws/**"
    enabled: true

  # ---- Cloud / external-API providers (each scoped to its own secret group). ----

  - name: gcp
    suite: provider
    labels: "gcp && !managed"
    providers: [gcp]
    secret_groups: [gcp]
    needs_secrets: true
    paths:
      - "providers/v1/gcp/**"
      - "e2e/suites/provider/cases/gcp/**"
    enabled: true

  - name: azure
    suite: provider
    labels: "azure && !managed"
    providers: [azure]
    secret_groups: [azure]
    needs_secrets: true
    paths:
      - "providers/v1/azure/**"
      - "e2e/suites/provider/cases/azure/**"
    enabled: true

  - name: scaleway
    suite: provider
    labels: "scaleway && !managed"
    providers: [scaleway]
    secret_groups: [scaleway]
    needs_secrets: true
    paths:
      - "providers/v1/scaleway/**"
      - "e2e/suites/provider/cases/scaleway/**"
    enabled: true

  - name: delinea
    suite: provider
    labels: "delinea && !managed"
    providers: [delinea]
    secret_groups: [delinea]
    needs_secrets: true
    paths:
      - "providers/v1/delinea/**"
      - "e2e/suites/provider/cases/delinea/**"
    enabled: true

  - name: secretserver
    suite: provider
    labels: "secretserver && !managed"
    providers: [secretserver]
    secret_groups: [secretserver]
    needs_secrets: true
    paths:
      - "providers/v1/secretserver/**"
      - "e2e/suites/provider/cases/secretserver/**"
    enabled: true

  # Infisical runs against an in-cluster Infisical addon (addon.NewInfisical),
  # not an external tenant, so it needs no repo secrets despite being a SaaS.
  - name: infisical
    suite: provider
    labels: "infisical && !managed"
    providers: [infisical]
    secret_groups: []
    needs_secrets: false
    paths:
      - "providers/v1/infisical/**"
      - "e2e/suites/provider/cases/infisical/**"
    enabled: true

  # Non-provider suites. No provider labels, so providers is empty; they run the
  # whole non-managed suite. flux and argocd exercise ESO under GitOps tools and
  # need no creds.
  #
  # The generator suite is split in two: the grafana generator talks to a live
  # external Grafana Cloud instance (its own leg below), while every other
  # generator runs in-cluster. This leg runs all generators except grafana; the
  # ecr and sts generators mint tokens against real AWS, so it needs the aws
  # group.
  - name: generator
    suite: generator
    labels: "!managed && !grafana"
    providers: []
    secret_groups: [aws]
    needs_secrets: true
    paths:
      - "apis/**"
      - "pkg/**"
      - "runtime/**"
      - "generators/**"
      - "e2e/suites/generator/**"
    enabled: true

  # The grafana generator, isolated. It depends on a live external Grafana Cloud
  # instance (GRAFANA_URL / GRAFANA_TOKEN); the suite even wakes a sleepy
  # instance in BeforeEach. Kept as its own leg so its external flakiness is
  # attributable and never masks the other generators.
  - name: grafana
    suite: generator
    labels: "grafana && !managed"
    providers: []
    secret_groups: [grafana]
    needs_secrets: true
    paths:
      - "generators/v1/grafana/**"
      - "e2e/suites/generator/grafana.go"
    enabled: true

  - name: flux
    suite: flux
    labels: "!managed"
    providers: []
    secret_groups: []
    needs_secrets: false
    paths:
      - "apis/**"
      - "pkg/**"
      - "runtime/**"
      - "e2e/suites/flux/**"
    enabled: true

  - name: argocd
    suite: argocd
    labels: "!managed"
    providers: []
    secret_groups: []
    needs_secrets: false
    paths:
      - "apis/**"
      - "pkg/**"
      - "runtime/**"
      - "e2e/suites/argocd/**"
    enabled: true