refactor(e2e): reduce the briklab E2E suite to orchestrator parity + real deploy#15
Merged
Conversation
Per-stage, per-stack, planner and findings behavior is now covered by the brik repo's contract/unit/integration suites and brik-images smoke tests, so the GitLab and Jenkins E2E suites only keep the scenarios that need a live orchestrator or real deploy infrastructure: - GitLab: node-full (parity), node-deploy-gitops, node-deploy-rollback. - Jenkins: node-full, node-complete (parity).
The lab now validates orchestrator parity and real ArgoCD/GitOps deploy and rollback rather than the full fixture matrix. Update the tagline, badge, rationale, feature sections, scenario tables and command list accordingly.
jest-junit@16 pulled a vulnerable uuid (<11.1.1, GHSA-w5hq-g745-h8pq), which made the node-complete deps scan fail with exit 10. Bump to jest-junit@17 and regenerate the lockfile; npm audit reports zero vulnerabilities again.
trigger_build only pre-registered job parameters when the job had none, but casc seeds node-full with BRIK_DRY_RUN and BRIK_TAG, so the gate never fired and Jenkins silently dropped the undeclared BRIK_RUNNER_CLASSES_FILE and BRIK_WITH_DEPLOY from buildWithParameters. Pre-register whenever ci_vars are requested; pre_register_params merges only the missing parameters and is a no-op otherwise.
Exercises the full shared-library workflow (context, planner, gates, needs, image parity) on the real orchestrator with every stage pinned to the single brik-runner-stub image via BRIK_RUNNER_CLASSES_FILE, without pulling the heavy stack images. GitLab passes an absolute override path; Jenkins passes a path relative to the brik library root (resolved per stage container against brikHome).
The 2026-05-20 validation campaign, the v0.6.0 validation writeup, and the standalone known-issues file are obsolete after the e2e suite reduction. Living e2e status is tracked with the suites themselves.
The tag.gpgsign trap is already explained inline at each call site; the pointers to the deleted doc are now dead. Drop them and reference the e2e.git.tag header instead.
…d images Decompose briklab.sh into a thin dispatcher plus lib/cli modules (lifecycle, setup, test, reset). Add a readiness gate: pure predicates (checks.sh) composed by preflight.sh, covering PAT, Nexus, ArgoCD, k3d node and application-controller health. With --fix the gate heals each failure (recovery.sh: regenerate token, restart a NotReady node, reschedule a stranded controller) and re-verifies; test runs it by default so a deploy run no longer hangs on a bad-state lab. Derive the runner-image pre-pull set from briks registry instead of a hardcoded mirror. Add --stub to run any scenario on the single stub image. Deduplicate the PAT/token probes so verify_* and the ensure_* fast paths share one implementation. Remove the dead jenkins_reload_casc.
Remove 28 test-projects whose per-stage and per-stack behaviour is now covered by brik/spec, keeping only fixtures that need a live orchestrator or real infrastructure (full pipeline, gitops, rollback, promote-on-tag, CVE scan gating, trunk workflow). Drop their Jenkins CasC jobs and prune the reset repo list to match the surviving set.
Update the README CLI tables and feature notes for preflight,
--fix/--no-repair/--stub and the self-heal behaviour; refresh the
architecture module tree for the thin dispatcher, lib/cli and the new
lib/{checks,preflight,recovery,runner-images} modules; add the E2E
coverage map (stage/feature -> brik/spec vs live scenario).
The fixture's vulnerable dependency (brace-expansion, GHSA-jxxr-4gwj-5jf2) is rated medium, but the default gating floor is high, so the dependency scan now correctly passes it as below-threshold. Set severity_threshold: medium so the scan gates on it and fails, restoring this project's purpose of proving CVE gating.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Trims and consolidates the briklab E2E suite. The per-stack and
*-minimaltest-projects whose behavior is now covered by brik's notion-based L0 unit
contracts (shipped in getbrik/brik#23) are removed, leaving a focused set of
scenarios that exercise real orchestrator behavior (GitLab + Jenkins) and
real deploy/rollback rather than re-testing stack mechanics. Adds a
self-healing preflight, a stub-image mode, and registry-derived runner images.
(~276 files, +1.5k / -24k -- almost entirely deletions of redundant
test-projects; the runtime/CLI surface shrinks accordingly.)
E2E scope reduction
3cd325c).python-minimal,rust-complete,rust-minimal, etc. -- whose coverage now lives in brik'sspec/L0/unit contracts (4ad9564).node-full-stubscenario to the GitLab and Jenkins suites (09e25cb).Scripts / preflight
92ebe35).ci_varsare set (6864ef2).03f352d).Fixtures
node-full-cveon its medium CVE viasecurity.severity_threshold: medium(d60c29f) -- pairs with the brik#23 change that makes the dependency scan honor the severity policy (a medium CVE under the defaulthighfloor is correctly ignored, so the fixture must opt intomediumto prove CVE gating).node-completejest-junit to 17 to clear the uuid advisory (e8e0bb9).Docs
5623847); remove superseded e2e validation notes and dead references toe2e-known-issues.md(c201321,082e723).Test plan
Notes
node-full-cvefixture depends on the merged brik dependency-scan severity-policy behavior.