ci(agent-e2e): drop agentspan server JAR, run against conductor-oss

conductor-oss ships the agent runtime by default from 3.32.0-rc.8, so the
e2e server leg no longer needs the Agentspan release JAR. Server download
switches to the conductor-oss boot jar (Maven Central); the Agentspan CLI
binary stays on its own separate pin since test_suite16_cli_skills.py still
drives it against this same server.

Author: Kowser

.github/workflows/agent-e2e.yml

@@ -1,7 +1,11 @@
 name: Agent E2E
 
-# Runs the agent e2e suites (e2e/) against the released Agentspan
-# server JAR — a full Conductor server with the agent runtime baked in.
+# Runs the agent e2e suites (e2e/) against the Conductor OSS server boot
+# JAR (Maven Central) — the server this SDK ships against, with the agent
+# runtime on by default from 3.32.0-rc.8 onward. The Agentspan server JAR
+# is no longer used here; the Agentspan CLI binary is still downloaded
+# (its own separate pin) since e2e/test_suite16_cli_skills.py drives it
+# against this same server.
 # tests/integration/ai stays manual-only (same as upstream Agentspan,
 # which never ran its tests/integration in CI): run it locally against
 # a live server with `pytest tests/integration/ai`.
@@ -12,12 +16,18 @@ name: Agent E2E
 
 on: [pull_request, workflow_dispatch]
 
+# least privilege: the token is only used to download the public agentspan
+# CLI release asset (gh release download) — read access suffices
+permissions:
+  contents: read
+
 concurrency:
   group: agent-e2e-${{ github.ref }}
   cancel-in-progress: true
 
 env:
-  AGENTSPAN_VERSION: "0.4.3"   # pinned server/CLI release — bump deliberately
+  CONDUCTOR_OSS_VERSION: "3.32.0-rc.8"   # pinned server release — bump deliberately
+  AGENTSPAN_CLI_VERSION: "0.4.3"          # pinned CLI release — independent of the server
 
 jobs:
   agent-e2e:
@@ -48,22 +58,20 @@ jobs:
         id: jar_cache
         uses: actions/cache@v4
         with:
-          path: agentspan-server.jar
-          key: agentspan-server-${{ env.AGENTSPAN_VERSION }}
+          path: conductor-server.jar
+          key: conductor-oss-server-${{ env.CONDUCTOR_OSS_VERSION }}
 
-      - name: Download server JAR from release
+      - name: Download server JAR from Maven Central
         if: steps.jar_cache.outputs.cache-hit != 'true'
-        env:
-          GH_TOKEN: ${{ github.token }}
         run: |
-          gh release download "v${AGENTSPAN_VERSION}" --repo agentspan-ai/agentspan \
-            --pattern "agentspan-server-${AGENTSPAN_VERSION}.jar" --output agentspan-server.jar
+          curl -fL --retry 3 -o conductor-server.jar \
+            "https://repo1.maven.org/maven2/org/conductoross/conductor-server/${CONDUCTOR_OSS_VERSION}/conductor-server-${CONDUCTOR_OSS_VERSION}-boot.jar"
 
       - name: Download CLI binary from release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh release download "v${AGENTSPAN_VERSION}" --repo agentspan-ai/agentspan \
+          gh release download "v${AGENTSPAN_CLI_VERSION}" --repo agentspan-ai/agentspan \
             --pattern "agentspan_linux_amd64" --output agentspan
           chmod +x agentspan
 
@@ -80,7 +88,7 @@ jobs:
 
       - name: Start server
         run: |
-          java -jar agentspan-server.jar --server.port=8080 > server.log 2>&1 &
+          java -jar conductor-server.jar --server.port=8080 > server.log 2>&1 &
 
       - name: Wait for server health
         run: |

e2e/conftest.py

@@ -162,9 +162,10 @@ def get_task_by_name(execution_id: str, task_ref_prefix: str) -> list:
 # reason unrelated to the SDK. Probe the running server once and skip those tests
 # when unsupported.
 #
-# TODO: once agentspan cuts a release that implements runtimeMetadata, bump
-# AGENTSPAN_VERSION in .github/workflows/agent-e2e.yml — this guard then lets the
-# credential tests run automatically (no test change needed).
+# conductor-oss implements this from 3.32.0-rc.8 onward (see
+# .github/workflows/agent-e2e.yml's CONDUCTOR_OSS_VERSION) — this guard lets the
+# credential tests run automatically against any server that has it, no test
+# change needed.
 
 _RUNTIME_METADATA_SUPPORT = None
 
@@ -208,6 +209,6 @@ def requires_runtime_metadata():
         pytest.skip(
             "server does not persist/deliver TaskDef.runtimeMetadata "
             "(conductor-oss PR #1255) — worker credential injection requires it. "
-            "TODO: bump AGENTSPAN_VERSION in .github/workflows/agent-e2e.yml once a "
-            "release ships runtimeMetadata support."
+            "Needs conductor-oss >= 3.32.0-rc.8 (see CONDUCTOR_OSS_VERSION in "
+            ".github/workflows/agent-e2e.yml)."
         )