live-e2e.yml

name: Live E2E

on:
  workflow_dispatch:
    inputs:
      adapters:
        description: "Comma-separated adapters to run: sdk,cli,mcp"
        default: "sdk,cli,mcp"
        required: true
      operations:
        description: "Optional comma-separated operationIds. Empty runs the protected read-only slice."
        default: ""
        required: false
      fixture_setup:
        description: "Allow gated fixture setup"
        type: boolean
        default: false
      mutations:
        description: "Allow mutations of verified dedicated/run-owned fixtures"
        type: boolean
        default: false
      binary:
        description: "Allow attachment certification with retention evidence"
        type: boolean
        default: false
      stream:
        description: "Allow bounded mailbox stream certification"
        type: boolean
        default: false
      send:
        description: "Allow sends to the configured recipient allowlist"
        type: boolean
        default: false

concurrency:
  group: sendmux-live-e2e
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  read-only:
    runs-on: ubuntu-latest
    environment: sendmux-live-e2e
    timeout-minutes: 120
    env:
      SENDMUX_LIVE_E2E_RUN_ID: gha-${{ github.run_id }}-${{ github.run_attempt }}
    steps:
      - name: Check out SDK
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check out OpenAPI snapshots
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: Sendmux/docs
          path: sendmux-docs

      - name: Set up pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
        with:
          version: 10.22.0

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: .nvmrc
          cache: pnpm

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go/go.mod
          cache-dependency-path: go/go.sum

      - name: Set up Ruby
        uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
        with:
          ruby-version: "3.4.1"
          bundler-cache: false

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build generated surfaces
        run: pnpm build:live-e2e-surfaces

      - name: Run protected live E2E and write this run's audit
        id: certification
        env:
          SENDMUX_LIVE_E2E: "1"
          SENDMUX_LIVE_E2E_ADAPTERS: ${{ inputs.adapters }}
          SENDMUX_LIVE_E2E_APP_BASE_URL: ${{ vars.SENDMUX_LIVE_E2E_APP_BASE_URL }}
          SENDMUX_LIVE_E2E_ALLOWED_APP_BASE_URLS: ${{ vars.SENDMUX_LIVE_E2E_ALLOWED_APP_BASE_URLS }}
          SENDMUX_LIVE_E2E_ALLOWED_SENDING_BASE_URLS: ${{ vars.SENDMUX_LIVE_E2E_ALLOWED_SENDING_BASE_URLS }}
          SENDMUX_LIVE_E2E_FIXTURE_SEND_TO: ${{ vars.SENDMUX_LIVE_E2E_FIXTURE_SEND_TO }}
          SENDMUX_LIVE_E2E_FIXTURE_SETUP: ${{ inputs.fixture_setup && '1' || '0' }}
          SENDMUX_LIVE_E2E_MUTATIONS: ${{ inputs.mutations && '1' || '0' }}
          SENDMUX_LIVE_E2E_BINARY: ${{ inputs.binary && '1' || '0' }}
          SENDMUX_LIVE_E2E_STREAM: ${{ inputs.stream && '1' || '0' }}
          SENDMUX_STAGING_SEND: ${{ inputs.send && '1' || '0' }}
          SENDMUX_LIVE_E2E_EXPECTED_TEAM_ID: ${{ vars.SENDMUX_LIVE_E2E_EXPECTED_TEAM_ID }}
          SENDMUX_LIVE_E2E_EXPECTED_MAILBOX_ID: ${{ vars.SENDMUX_LIVE_E2E_EXPECTED_MAILBOX_ID }}
          SENDMUX_LIVE_E2E_EXPECTED_MAILBOX_EMAIL: ${{ vars.SENDMUX_LIVE_E2E_EXPECTED_MAILBOX_EMAIL }}
          SENDMUX_LIVE_E2E_DEDICATED_MAILBOX_ID: ${{ vars.SENDMUX_LIVE_E2E_DEDICATED_MAILBOX_ID }}
          SENDMUX_LIVE_E2E_DOMAIN_ID: ${{ vars.SENDMUX_LIVE_E2E_DOMAIN_ID }}
          SENDMUX_LIVE_E2E_DOMAIN_NAME: ${{ vars.SENDMUX_LIVE_E2E_DOMAIN_NAME }}
          SENDMUX_LIVE_E2E_MAILBOX_API_KEY: ${{ secrets.SENDMUX_LIVE_E2E_MAILBOX_API_KEY }}
          SENDMUX_LIVE_E2E_OPERATIONS: ${{ inputs.operations }}
          SENDMUX_LIVE_E2E_ROOT_API_KEY: ${{ secrets.SENDMUX_LIVE_E2E_ROOT_API_KEY }}
          SENDMUX_LIVE_E2E_SENDING_BASE_URL: ${{ vars.SENDMUX_LIVE_E2E_SENDING_BASE_URL }}
          SENDMUX_LIVE_E2E_WEBHOOK_URL: ${{ vars.SENDMUX_LIVE_E2E_WEBHOOK_URL }}
          SENDMUX_LIVE_E2E_WEBHOOK_URL_ALLOWLIST: ${{ vars.SENDMUX_LIVE_E2E_WEBHOOK_URL_ALLOWLIST }}
        run: |
          args=(--adapter "${SENDMUX_LIVE_E2E_ADAPTERS}")
          if [ -n "${SENDMUX_LIVE_E2E_OPERATIONS}" ]; then
            args+=(--operation "${SENDMUX_LIVE_E2E_OPERATIONS}")
          fi
          set +e
          node scripts/run-live-e2e.mjs "${args[@]}"
          status=$?
          node scripts/write-live-e2e-audit-manifest.mjs \
            --result ".tmp/live-e2e/${SENDMUX_LIVE_E2E_RUN_ID}/result.json" \
            --out ".tmp/live-e2e/${SENDMUX_LIVE_E2E_RUN_ID}/audit-manifest.json" \
            --run-id "$SENDMUX_LIVE_E2E_RUN_ID" \
            --commit "$GITHUB_SHA" \
            --source "github-actions:${GITHUB_RUN_ID}"
          writer_status=$?
          set -e
          if [ "$writer_status" -eq 0 ]; then
            echo "manifest_written=true" >> "$GITHUB_OUTPUT"
          fi
          if [ "$status" -ne 0 ]; then
            exit "$status"
          fi
          exit "$writer_status"

      - name: Validate this run's recovery ledger
        id: recovery
        if: ${{ always() }}
        run: |
          ledger_path=".tmp/live-e2e/${SENDMUX_LIVE_E2E_RUN_ID}/resources.json"
          if [ ! -f "$ledger_path" ]; then
            exit 0
          fi
          node --input-type=module - "$ledger_path" "$SENDMUX_LIVE_E2E_RUN_ID" <<'NODE'
          import { readFileSync } from "node:fs";
          import { validateRecoveryLedger } from "./scripts/live-e2e-contract.mjs";
          validateRecoveryLedger(JSON.parse(readFileSync(process.argv[2], "utf8")), { runId: process.argv[3] });
          NODE
          echo "recovery_written=true" >> "$GITHUB_OUTPUT"

      - name: Add live E2E audit manifest to summary
        if: ${{ always() && steps.certification.outputs.manifest_written == 'true' }}
        run: |
          echo "### Live E2E audit manifest" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "\`\`\`json" >> "$GITHUB_STEP_SUMMARY"
          cat ".tmp/live-e2e/${SENDMUX_LIVE_E2E_RUN_ID}/audit-manifest.json" >> "$GITHUB_STEP_SUMMARY"
          echo "\`\`\`" >> "$GITHUB_STEP_SUMMARY"

      - name: Upload live E2E audit manifest
        if: ${{ always() && steps.certification.outputs.manifest_written == 'true' }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: live-e2e-audit-${{ env.SENDMUX_LIVE_E2E_RUN_ID }}
          path: .tmp/live-e2e/${{ env.SENDMUX_LIVE_E2E_RUN_ID }}/audit-manifest.json
          if-no-files-found: error
          include-hidden-files: true
          retention-days: 90

      - name: Upload live E2E recovery ledger
        if: ${{ always() && steps.recovery.outputs.recovery_written == 'true' }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: live-e2e-recovery-${{ env.SENDMUX_LIVE_E2E_RUN_ID }}
          path: .tmp/live-e2e/${{ env.SENDMUX_LIVE_E2E_RUN_ID }}/resources.json
          if-no-files-found: error
          include-hidden-files: true
          retention-days: 90