Migrate and expand Semaphore integration test suite

.github/workflows/ci.yml

@@ -56,7 +56,7 @@ jobs:
           retention-days: 14
 
   core-sqlite:
-    name: Core API · SQLite
+    name: Core API + UI · SQLite
     needs: quality
     runs-on: ubuntu-latest
     timeout-minutes: 35
@@ -75,6 +75,9 @@ jobs:
       - name: Set up Gradle
         uses: gradle/actions/setup-gradle@v6
 
+      - name: Install Playwright Chromium
+        run: ./gradlew --no-daemon playwrightInstallChromium
+
       - name: Show Docker versions
         run: |
           docker version
@@ -86,6 +89,12 @@ jobs:
       - name: Run core API suite
         run: test-environment/profile test "$PROFILE" --no-daemon
 
+      - name: Run core UI smoke
+        run: >-
+          ./gradlew --no-daemon uiTest
+          -DSTAND=semaphore
+          -DSEMAPHORE_PROFILE="$PROFILE"
+
       - name: Capture failure diagnostics
         if: failure()
         run: |
@@ -101,6 +110,8 @@ jobs:
           path: |
             build/reports/tests/apiTest/
             build/test-results/apiTest/
+            build/reports/tests/uiTest/
+            build/test-results/uiTest/
             build/ci-diagnostics/
           if-no-files-found: ignore
           retention-days: 14

.github/workflows/configuration-matrix.yml

@@ -4,6 +4,12 @@ on:
   schedule:
     - cron: "30 1 * * *"
   workflow_dispatch:
+    inputs:
+      include_schedule_investigation:
+        description: Include the known-failing schedule execution reproducer
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -20,11 +26,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        profile:
-          - core-postgres-local
-          - core-mysql-local
-          - core-mariadb-local
-          - prod-postgres-runner
+        profile: ${{ fromJSON(inputs.include_schedule_investigation && '["core-postgres-local","core-mysql-local","core-mariadb-local","prod-postgres-runner","feature-ssh-local","feature-git-https","feature-oidc-local","feature-proxy-oidc","feature-ldap-tls","feature-totp-local","feature-encryption-rotation","feature-schedule-timezone"]' || '["core-postgres-local","core-mysql-local","core-mariadb-local","prod-postgres-runner","feature-ssh-local","feature-git-https","feature-oidc-local","feature-proxy-oidc","feature-ldap-tls","feature-totp-local","feature-encryption-rotation"]') }}
     env:
       PROFILE: ${{ matrix.profile }}
     steps:
@@ -40,17 +42,27 @@ jobs:
       - name: Set up Gradle
         uses: gradle/actions/setup-gradle@v6
 
+      - name: Install Playwright Chromium
+        if: matrix.profile == 'feature-oidc-local' || matrix.profile == 'feature-proxy-oidc' || matrix.profile == 'feature-totp-local'
+        run: ./gradlew --no-daemon playwrightInstallChromium
+
       - name: Show Docker versions
         run: |
           docker version
           docker compose version
 
       - name: Start profile
+        if: matrix.profile != 'feature-encryption-rotation'
         run: test-environment/profile up "$PROFILE"
 
-      - name: Run core API suite
+      - name: Run profile suite
+        if: matrix.profile != 'feature-encryption-rotation'
         run: test-environment/profile test "$PROFILE" --no-daemon
 
+      - name: Run encryption rotation lifecycle
+        if: matrix.profile == 'feature-encryption-rotation'
+        run: test-environment/profile encryption-rotation-test "$PROFILE"
+
       - name: Capture failure diagnostics
         if: failure()
         run: |
@@ -66,6 +78,12 @@ jobs:
           path: |
             build/reports/tests/apiTest/
             build/test-results/apiTest/
+            build/reports/tests/uiTest/
+            build/test-results/uiTest/
+            build/reports/tests/totpTest/
+            build/test-results/totpTest/
+            build/reports/tests/encryptionRotationTest/
+            build/test-results/encryptionRotationTest/
             build/ci-diagnostics/
           if-no-files-found: ignore
           retention-days: 14

CHANGELOG.md

@@ -6,8 +6,43 @@ All notable changes to the Semaphore UI test automation project are documented i
 
 ### Added
 
+- Read-only `externalTest` suite with explicit target credentials and no dependency on local task fixtures.
+- API-token lifecycle coverage for creation, prefix-only listing, bearer authentication, project access, revocation, expiry validation, and secret-safe HTTP diagnostics.
+- Supported local-user lifecycle coverage for create, update, delete, absence verification, and recreation; unsupported deactivate/reactivate semantics are documented explicitly.
+- Private HTTPS Git profile with trusted self-signed TLS, Basic Auth, successful playbook execution, missing-credential failure, and credential-leak checks.
+- Repository-backed Ansible file inventory execution and a canary for create/update path-validation inconsistency.
+- INI and YAML static multi-group inventory execution proving that a template limit selects only the requested host group.
+- Plan-only Terraform and OpenTofu execution with real workspace inventory selection and no external provider downloads.
+- Terraform/OpenTofu `TF_VAR_*` secret injection from a Variable Group with hash-based execution proof and API/output/report leak checks.
+- Build-to-Deploy template chaining with successful-build selection, persisted linkage, nested history version, and executor target/incoming version checks.
+- Password-login security coverage for account-enumeration resistance, empty credentials, session-cookie absence, repeated failures, and recovery through a valid login.
+- Project deletion coverage after a stopped task and a reproducer for deletion during execution causing continued automation and foreign-key errors.
+- SSH access-key rotation coverage using isolated servers with distinct authorized keys.
+- Browser-based OIDC discovery, callback, session, return-path, and external-user provisioning coverage through a pinned local Dex provider.
+- OIDC repeat-login, logout, local-account collision, and unavailable-provider coverage.
+- Pinned OpenLDAP LDAPS profile covering bind/search, provisioning, repeat login, logout, invalid credentials, and local-account collision.
+- Dynamic one-off runner profile covering webhook start, task execution, finish callback, and the runner process lifecycle.
+- Reproducer and source-level analysis for the `v2.19.8` defect where a successful one-off runner never exits.
+- PostgreSQL/Dex OIDC profile behind pinned NGINX with TLS termination and a non-root `/semaphore` public URL.
+- Explicit OIDC session-cookie checks for `HttpOnly`, HTTPS-dependent `Secure`, and path attributes.
+- PostgreSQL encryption-keyring rotation coverage for hot reload, mixed-key reads, `vault check`, backup/rekey, retired-key removal, and post-rekey task execution.
+- TOTP self-enrollment, login challenge, invalid passcode, recovery, and recovery-code rotation coverage.
+- TOTP secret, passcode, and recovery-code redaction in both HTTP attachments and raw Allure step parameters.
+- Browser TOTP enrollment through Security settings, QR rendering, challenge, invalid passcode, and recovery-form coverage with sensitive failure artifacts suppressed.
+- Core browser smoke for password login, launching an API-provisioned executable template, and client-side project-name validation without a create request.
+- Variable Group API coverage for mixed JSON/ENV/secret values, secret rename persistence, task execution, masking, and empty-name validation.
+- Survey-variable and launch-time override coverage for enum/int/string/env/secret values, template/task arguments, Ansible params, persistence, execution, and secret masking.
+- Reproducer and upstream fix trace for the `v2.19.8` backend gap that accepts enum defaults outside their allowed survey values.
+- Project queue coverage proving `max_parallel_tasks` admission at limits one and two with a parallel-capable template.
+- Persistent runner routing coverage for exact tags, `used_runner_id`, capacity re-queueing, active-state recovery through a fresh task, and unmatched tags.
+- Reproducer and source-level boundary for tasks failing instead of waiting when no matching active runner is available.
+- Persistent-runner canary and upstream fix trace for survey secrets being lost during remote dispatch on `v2.19.8`.
+- Webhook integration coverage for token authentication, project-alias matcher routing, body/header extraction, task linkage, and ignored invalid requests.
+- Project backup/restore round-trip coverage for resource relinking, omitted task history and authentication secrets, and post-restore task execution.
+- Documented Pro subscription boundaries for Workflows and external Secret Storage management in the Community image.
+- Reproducer and source-level analysis for project restore accepting duplicate resource names because of an off-by-one validation boundary.
 - GitHub Actions pull-request gate with framework checks and the SQLite core profile.
-- Daily PostgreSQL, MySQL, MariaDB, and persistent-runner configuration matrix.
+- Daily PostgreSQL, MySQL, MariaDB, persistent-runner, SSH, OIDC, LDAPS, TOTP, and encryption-rotation configuration matrix.
 - Weekly and manually triggered SQLite/PostgreSQL release-upgrade verification.
 - CI artifacts containing JUnit, HTML, Allure, and failure diagnostics.
 - Downloadable HTML site with a separate Allure report for every executed profile.