Add control-plane E2E tests with device-flow login

[gtrrz-victor]

https://entire.io/gh/entireio/cli/trails/1324

Summary

Add a production control-plane E2E suite that signs in through the device flow and exercises organization, project, and repository creation, cloning, and deletion without a coding agent.

What Changed

• Complete GitHub sign-in and authenticator verification in headless Chromium using the dedicated test account.
• Isolate CLI credentials from developer state and uploaded artifacts, and delete test resources in reverse order.
• Bound CLI calls to two minutes and cleanup calls to 30 seconds, with a backstop for inherited output pipes. Add a local regression test covering timeout followed by cleanup.
• Add the mise task and serialized GitHub Actions workflow, using the E2E_GH_* secrets.

The temporary push trigger for feat/e2e-controlplane remains for branch validation and should be removed before merge.

Verification

• Formatting and full lint passed.
• Timeout regression test passed using a local fake CLI.
• Control-plane unit tests, execx tests, and E2E package compilation passed.
• Full unit/integration tests with race detection were run. With local agent shims excluded from PATH, the only failure was the unrelated TestOpenCodeSeedRepoPlantsDeps: the shared OpenCode cache was missing package.json.
• Deterministic Vogon E2E canary passed.

---

Note

Medium Risk
Tests hit production with real credentials and provision/delete live orgs/repos; CI concurrency rules matter because cancelled runs can leak quota-limited resources.

Overview
Adds a production control-plane E2E suite that runs the entire CLI without a coding agent: TestMain performs one entire login --device per run, with headless Chromium (playwright-go) completing GitHub password + TOTP and Entire device authorization using E2E_GH_* secrets.

The main scenario creates org → project → repo (e2e-cp-*), waits until the repo is clonable, clones and checks the entire:// remote, then deletes resources in order with t.Cleanup fallbacks. CLI helpers use bounded timeouts and WaitDelay so cleanup still runs after hangs; a small regression test covers timeout-then-cleanup.

CI and tooling: new mise run test:e2e:controlplane [filter] (Playwright/Chromium install, no --rerun-fails), serialized .github/workflows/e2e-controlplane.yml (cancel-in-progress: false for the shared three-org test account), artifact upload, and e2e/README.md updates. playwright-go is added to go.mod. The workflow still has a temporary push trigger on feat/e2e-controlplane to remove before merge.

^{Reviewed by Cursor Bugbot for commit 76950a8. Configure here.}

[Copilot]

🟡 Changes recommended

Unresolved workflow safety, cleanup, login cancellation, and environment-isolation issues block approval.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds production control-plane E2E coverage using device-flow authentication and live organization, project, and repository lifecycle tests.

Changes:

• Adds headless GitHub/TOTP login and isolated CLI credentials.
• Adds lifecycle, timeout, cleanup, and TOTP tests.
• Adds mise tooling, documentation, dependencies, and serialized CI workflow.

File summaries

File	Description
mise-tasks/test/e2e/controlplane	Local control-plane E2E runner
go.sum	Dependency checksums
go.mod	Adds Playwright dependency
e2e/README.md	E2E usage and secret documentation
e2e/controlplane/totp.go	TOTP generation
e2e/controlplane/totp_test.go	TOTP tests
e2e/controlplane/main_test.go	Test initialization and environment isolation
e2e/controlplane/login_test.go	Device-flow and browser authentication
e2e/controlplane/lifecycle_test.go	Resource lifecycle and clone scenario
e2e/controlplane/cli_timeout_test.go	Timeout and cleanup regression test
e2e/controlplane/cli_test.go	Bounded CLI execution helpers
.github/workflows/e2e-controlplane.yml	Production E2E workflow and concurrency controls

Review details

Suppressed comments (8)

.github/workflows/e2e-controlplane.yml:18

• cancel-in-progress: false only prevents GitHub's concurrency manager from cancelling an older run; manual cancellation, runner loss, and the job timeout can still skip t.Cleanup. With a three-organization account quota, one interrupted run can leave resources that block all later runs until someone cleans them up manually. Add a startup reaper for stale e2e-cp-* organizations (or an out-of-band cleanup workflow) before relying on this suite in production CI.

# One shared test account with a three-org quota: never two runs at once, and
# never cancel one mid-flight — a cancelled run skips t.Cleanup and leaks the
# resources it created.

e2e/controlplane/cli_timeout_test.go:17

• This test is in the same e2e-tagged package as TestMain, so even the local fake-CLI regression invokes TestMain first, requires all E2E_GH_* secrets, and performs a live five-minute device-flow login before it can test a 50 ms timeout. Running go test -tags=e2e -run TestRunEntireTimeoutAllowsCleanup therefore cannot be an offline/local regression; move this test/helper to a package or test target without the production-login TestMain.

func TestRunEntireTimeoutAllowsCleanup(t *testing.T) {

e2e/controlplane/lifecycle_test.go:29

• If the organization is created successfully but the CLI returns malformed JSON or omits id, decodeJSON/require.NotEmpty aborts the test before this cleanup is registered. That leaves a live organization behind and can exhaust the account's three-organization quota; register cleanup before validation with a name-based fallback (the delete command accepts names) or otherwise retain a cleanup handle as soon as creation starts.

	t.Cleanup(func() { deleteResource(t, dir, "org", org.ID) })

e2e/controlplane/lifecycle_test.go:36

• The project cleanup has the same leak window: a successful create followed by invalid output or a missing ID reaches FailNow before t.Cleanup is installed. Keep a cleanup registered from the create boundary and fall back to the project name if the response cannot be decoded.

	t.Cleanup(func() { deleteResource(t, dir, "project", project.ID) })

e2e/controlplane/lifecycle_test.go:41

• The repository can likewise be provisioned before JSON decoding or ID validation fails, but cleanup is only added afterward. A malformed/partial create response therefore leaves the repo (and its parent resources) behind; register a cleanup fallback at the create boundary rather than waiting for a valid ID.

	t.Cleanup(func() { deleteResource(t, dir, "repo", created.ID) })

e2e/controlplane/lifecycle_test.go:74

• The comment says the by-name read can lag after creation, but mustRunEntire treats a temporary no repo named/404 from repo get /et/... as fatal. That makes the test fail during the stated propagation window instead of retrying, while only the already-registered cleanup can run. Use a retryable lookup that distinguishes a not-yet-visible reference from a real provisioning failure.

		stdout, _ := mustRunEntire(t, dir, "repo", "get", ref, "--json")
		repo := decodeJSON[repoJSON](t, stdout)

e2e/controlplane/main_test.go:93

• gitenv.IsolateMain only neutralizes Git config variables; it does not clear GIT_DIR, GIT_WORK_TREE, or GIT_INDEX_FILE. When the suite is launched from a Git hook or another Git child, the test's cmd.Dir and the later git clone can therefore target the inherited repository instead of the temporary test directory. Scrub these repo-selector variables in the TestMain environment before spawning the CLI and Git commands.

	gitenv.IsolateMain()

e2e/controlplane/main_test.go:96

• Because this is a package-level TestMain, every -run selection—including TestRunEntireTimeoutAllowsCleanup—executes the five-minute production device login first. The local fake-CLI regression therefore still requires real E2E_GH_* secrets and can mutate production state even though it does not need authentication. Move that regression into a separate non-production package/TestMain so it can run independently.

	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
	err = deviceLogin(ctx, username, password, totpSecret)

• Files reviewed: 11/12 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.