e2e.yml

name: E2E Tests

on:
  push:
    branches: [develop, main]
  pull_request:
    branches: [develop, main]

# I182: PR 側の e2e テストも CI の中で動くので、GITHUB_TOKEN は読み取りだけにする（最小権限）
permissions:
  contents: read

jobs:
  e2e:
    name: E2E Tests (Playwright)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

      - name: Generate one-time E2E password
        # I213: CI の使い捨ての DB の試験アカウントだけに使う値をジョブごとに作る。secrets にしない
        # （Dependabot の PR には secrets が渡らない）。伏せ字（add-mask）を GITHUB_ENV への書き込みより先に置く
        run: |
          pw="$(openssl rand -hex 24)"
          echo "::add-mask::$pw"
          echo "E2E_TEST_PASSWORD=$pw" >> "$GITHUB_ENV"

      - name: Start services and wait for healthy
        run: docker compose up -d --wait db backend frontend
        timeout-minutes: 5
        env:
          RATELIMIT_ENABLE: "false"  # E2E CI でのみ無効化（global-setup + テストの累積 POST が 5/5m 制限を超えるため）

      - name: Initialize E2E database
        # CI はホスト上で npm test を実行するため e2e-init コンテナを使わず直接 docker exec で初期化する
        run: |
          docker compose exec -T backend python manage.py migrate --noinput
          docker compose exec -T -e E2E_TEST_PASSWORD backend python manage.py seed_e2e --scenario tenant_isolation --password "$E2E_TEST_PASSWORD"
          docker compose exec -T -e E2E_TEST_PASSWORD backend python manage.py seed_e2e --scenario quiz_session --password "$E2E_TEST_PASSWORD"

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: '18'
          cache: 'npm'
          cache-dependency-path: e2e/package-lock.json

      - name: Install Playwright dependencies
        run: npm ci && npx playwright install --with-deps chromium
        working-directory: e2e

      - name: Run E2E tests
        run: npm test
        working-directory: e2e
        env:
          BASE_URL: http://localhost:3000

      - name: Show service logs on failure
        if: failure()
        run: |
          echo "=== backend logs ===" && docker compose logs backend --tail=100
          echo "=== db logs ===" && docker compose logs db --tail=50
          echo "=== docker compose ps ===" && docker compose ps

      # I187: 失敗時は画面キャプチャだけを上げる（trace・レポートにはログイン時のパスワードが残りうるため上げない）
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: failure()
        with:
          name: playwright-screenshots
          path: e2e/test-results/**/*.png
          retention-days: 14
          if-no-files-found: ignore