ci: parallelize e2e tests with BUILD_ID-scoped resources#293
Merged
Conversation
Signed-off-by: Zoltan Szabo <zoltan.szabo03@sap.com>
Signed-off-by: Zoltan Szabo <zoltan.szabo03@sap.com>
Signed-off-by: Zoltan Szabo <zoltan.szabo03@sap.com>
SatabdiG
reviewed
May 27, 2026
Collaborator
SatabdiG
left a comment
There was a problem hiding this comment.
I really like this, the security stuff especially 🔥 Just some minor comments
Signed-off-by: Zoltan Szabo <zoltan.szabo03@sap.com>
SatabdiG
previously approved these changes
May 28, 2026
Collaborator
SatabdiG
left a comment
There was a problem hiding this comment.
lgtm! thanks for taking this up, much needed 🦸
Signed-off-by: Zoltan Szabo <zoltan.szabo03@sap.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #274
Each
Test*function now runs as its own matrix entry in GitHub Actions, so the e2e suite finishes at the time of the slowest test instead of the sum of all tests. Every test-created CF resource name gets a-$BUILD_IDsuffix (except the role-import usernames - see Trade-offs) so parallel jobs and concurrent workflow runs don't collide on the sharedcf-ci-e2eorg.What changed
Test*functions via grep and fans them out (fail-fast: false)runScopedName()/NewID()- CRS YAMLs are rendered into.work/rendered-crs/withenvsubst '$BUILD_ID', tracked files stay cleanBUILD_IDis a workflow-level env in CI (run_id-run_attempt) -make test-acceptancedefaults toHHMMSS-cleanup.gofalls back to0000when invoked manually without itcleanup.godeletes BUILD_ID-scoped resources after the matrix finishes - checks outgithub.base_ref(not the PR head) so PR authors can't inject code that runs with CF credentialsconcurrency: e2e-cf-ci-e2e(cancel-in-progress: false) queues concurrent workflow runs - orgrole/spacerole import tests use staticsap.idsusernames that can't be BUILD_ID-scoped without IDS provisioningresetTestOrgand the sequential-era CF-cleanup helpers fromtest_env.go(they'd race in parallel -cleanup.godoes the job now)cf-ci-e2e,upgrade-test-org,*-donotdeletespaces,upgrade-test-import-space, system domains, sap.ids test users) are Observe-only and untouchedTrade-offs
cleanup.goonly take effect after merge - base-ref checkout is a deliberate security choice (matches the BTP provider)The valid e2e test run:
https://github.com/SAP/crossplane-provider-cloudfoundry/actions/runs/26230189808