fix: resolve pr review comments

Signed-off-by: Yeganathan S <63534555+skwowet@users.noreply.github.com>

Author: skwowet

.github/scripts/public-api-e2e-tests.sh

@@ -5,10 +5,10 @@
 # Database setup/reset is handled externally.
 #
 # Required environment variables (same names as GitHub Actions secrets/vars):
-#   AUTH0_API_E2E_CLIENT_ID
-#   AUTH0_API_E2E_CLIENT_SECRET
 #   AUTH0_STAGING_AUDIENCE
 #   AUTH0_STAGING_ISSUER
+#   AUTH0_API_E2E_CLIENT_ID
+#   AUTH0_API_E2E_CLIENT_SECRET
 #   CDP_API_E2E_BASE_URL
 #
 # Do not enable `set -x`; requests include sensitive credentials.

.github/workflows/api-e2e-tests.yml

@@ -9,20 +9,10 @@ concurrency:
   group: api-e2e-tests
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 env:
-  CLOUD_ENV: lf-oracle-staging
-  ORACLE_DOCKER_USERNAME: ${{ secrets.ORACLE_DOCKER_USERNAME }}
-  ORACLE_DOCKER_PASSWORD: ${{ secrets.ORACLE_DOCKER_PASSWORD }}
-  ORACLE_USER: ${{ secrets.ORACLE_USER }}
-  ORACLE_TENANT: ${{ secrets.ORACLE_TENANT }}
-  ORACLE_REGION: ${{ secrets.ORACLE_REGION }}
-  ORACLE_FINGERPRINT: ${{ secrets.ORACLE_FINGERPRINT }}
-  ORACLE_KEY: ${{ secrets.ORACLE_KEY }}
-  ORACLE_CLUSTER: ${{ secrets.ORACLE_STAGING_CLUSTER }}
-  AUTH0_API_E2E_CLIENT_ID: ${{ secrets.AUTH0_API_E2E_CLIENT_ID }}
-  AUTH0_API_E2E_CLIENT_SECRET: ${{ secrets.AUTH0_API_E2E_CLIENT_SECRET }}
-  AUTH0_STAGING_AUDIENCE: ${{ vars.AUTH0_STAGING_AUDIENCE }}
-  AUTH0_STAGING_ISSUER: ${{ vars.AUTH0_STAGING_ISSUER }}
   CDP_API_E2E_BASE_URL: ${{ vars.CDP_API_E2E_BASE_URL }}
 
 jobs:
@@ -35,22 +25,39 @@ jobs:
           ref: main
 
       - name: Install OCI
+        env:
+          OCI_CLI_INSTALL_REF: v3.89.3
+          OCI_CLI_VERSION: 3.89.3
         run: |
-          curl -L https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh > install.sh
+          set -euo pipefail
+          curl -fsSL "https://raw.githubusercontent.com/oracle/oci-cli/${OCI_CLI_INSTALL_REF}/scripts/install/install.sh" -o install.sh
           chmod +x install.sh
-          ./install.sh --accept-all-defaults
-          echo "OCI_CLI_DIR=/home/runner/bin" >> $GITHUB_ENV
+          ./install.sh --accept-all-defaults --oci-cli-version "${OCI_CLI_VERSION}"
+          echo "OCI_CLI_DIR=/home/runner/bin" >> "$GITHUB_ENV"
 
       - name: Update PATH
-        run: echo "${{ env.OCI_CLI_DIR }}" >> $GITHUB_PATH
+        run: echo "${{ env.OCI_CLI_DIR }}" >> "$GITHUB_PATH"
 
-      - uses: ./.github/actions/node/builder
+      - name: Deploy api-e2e
+        uses: ./.github/actions/node/builder
+        env:
+          CLOUD_ENV: lf-oracle-staging
+          ORACLE_DOCKER_USERNAME: ${{ secrets.ORACLE_DOCKER_USERNAME }}
+          ORACLE_DOCKER_PASSWORD: ${{ secrets.ORACLE_DOCKER_PASSWORD }}
+          ORACLE_USER: ${{ secrets.ORACLE_USER }}
+          ORACLE_TENANT: ${{ secrets.ORACLE_TENANT }}
+          ORACLE_REGION: ${{ secrets.ORACLE_REGION }}
+          ORACLE_FINGERPRINT: ${{ secrets.ORACLE_FINGERPRINT }}
+          ORACLE_KEY: ${{ secrets.ORACLE_KEY }}
+          ORACLE_CLUSTER: ${{ secrets.ORACLE_STAGING_CLUSTER }}
         with:
           services: api-e2e
 
       - name: Wait for api-e2e
         run: |
           set -euo pipefail
+          # Builder only runs kubectl set image; wait for the new revision before health.
+          kubectl rollout status deployment/api-e2e-dpl --timeout=600s
           health_url="${CDP_API_E2E_BASE_URL%/v1}/health"
           for i in $(seq 1 36); do
             curl -fsS --max-time 10 "$health_url" >/dev/null && exit 0
@@ -60,4 +67,9 @@ jobs:
           exit 1
 
       - name: Run Public API e2e tests
+        env:
+          AUTH0_STAGING_AUDIENCE: ${{ vars.AUTH0_STAGING_AUDIENCE }}
+          AUTH0_STAGING_ISSUER: ${{ vars.AUTH0_STAGING_ISSUER }}
+          AUTH0_API_E2E_CLIENT_ID: ${{ secrets.AUTH0_API_E2E_CLIENT_ID }}
+          AUTH0_API_E2E_CLIENT_SECRET: ${{ secrets.AUTH0_API_E2E_CLIENT_SECRET }}
         run: bash .github/scripts/public-api-e2e-tests.sh

docs/adr/0011-api-e2e-test-architecture.md

@@ -6,13 +6,13 @@
 
 ## Context
 
-We need to catch regressions on the API on `main` sooner (auth, routing, validation, and the sync HTTP response contract) without waiting for a consumer to hit a break. Relying on manually running the script every time is hard and not reliable. It pollutes staging data, depends on ambient fixtures, and does not work as a team habit.
+We want to catch API regressions on main sooner (auth, routing, validation, and the synchronous HTTP response contract) instead of waiting for a consumer to hit a problem. Manually running the test script is easy to forget, pollutes staging data, depends on existing fixtures, and is not something we can rely on as a team.
 
-A fuller API e2e harness in the server test setup (PR CI, isolated fixtures, typed asserts) is planned and sits in the backlog. Until that is ready, we need a short-term automated check that is isolated from staging data and cheap to operate.
+A more complete API e2e harness in the server test setup (PR CI, isolated fixtures, typed assertions) is planned for future work. Until then, we need a simple automated check that runs against an isolated environment and gives us confidence that the deployed API is still working as expected.
 
-**Focus for now is the Public API.** Those endpoints are consumed outside the product, so we need a minimum unbroken contract there first. Internal API routes are not the priority for these tests; we can add coverage for them later when there is a real need, using the same stack and suite pattern.
+The first test suite covers the Public API. These endpoints are the external contract our consumers rely on, so they are the best place to start. We can add more API e2e suites over time using the same runtime and suite pattern as needed.
 
-This ADR is the **runtime and isolation** decision. How e2e test cases are written lives in [ADR-0012](./0012-api-e2e-test-suite-design.md). Current suite: [`.github/scripts/public-api-e2e-tests.sh`](../../.github/scripts/public-api-e2e-tests.sh).
+This ADR covers the runtime and isolation architecture for API e2e tests. The design of the test suites themselves is covered in [ADR-0012](./0012-api-e2e-test-suite-design.md). The current suite lives in [`.github/scripts/public-api-e2e-tests.sh`](../../.github/scripts/public-api-e2e-tests.sh).
 
 ## Decision
 
@@ -78,7 +78,7 @@ A single shared `api-e2e` cannot safely gate concurrent PRs, because deploys and
 
 ### Database reset (ops)
 
-[`reset_api_e2e_test_db.sh`](../../reset_api_e2e_test_db.sh) runs on the EC2 host used to reach staging Postgres over SSH. It creates `crowd_api_e2e` if needed, applies normal Flyway migrations, truncates tables, and seeds the default tenant.
+`reset_api_e2e_test_db.sh` runs on the EC2 host used to reach staging Postgres over SSH. It creates `crowd_api_e2e` if needed, applies normal Flyway migrations, truncates tables, and seeds the default tenant.
 
 Run it after migrations land on `main`, or when leftover e2e test rows should be cleared. Keep that host’s crowd.dev checkout on latest `main` so Flyway matches the deployed `api-e2e`.
 

docs/adr/0012-api-e2e-test-suite-design.md

@@ -6,17 +6,17 @@
 
 ## Context
 
-API e2e tests need a maintainable HTTP suite that can grow as endpoints are added. For now the suite covers the **Public API** (see [ADR-0011](./0011-api-e2e-test-architecture.md)); the same writing pattern should hold if we later add internal API e2e tests when there is a real need.
+API e2e tests need a maintainable HTTP suite pattern that can grow as endpoints are added. Without shared structure, suites tend to split by HTTP method, accumulate one-off asserts, and become hard to extend or review.
 
-Without a shared structure, suites tend to split by HTTP method, accumulate one-off asserts, and become hard to extend or review. We want a thin, boring pattern: shared helpers, clear grouping, and an obvious place to add the next resource. This is how we write durable e2e cases until a fuller PR-time API e2e harness exists (backlog).
+We want a thin, boring pattern: shared helpers, clear grouping, and an obvious place to add the next resource. This is how we write durable e2e cases until a fuller PR-time API e2e harness exists (backlog).
 
-This ADR is the **suite design** (how tests are written). Runtime, isolation, scheduled CI, and ops live in [ADR-0011](./0011-api-e2e-test-architecture.md).
+This ADR is the **suite design** (how tests are written). Runtime, isolation, scheduled CI, which surfaces we cover, and ops live in [ADR-0011](./0011-api-e2e-test-architecture.md).
 
 ## Decision
 
-Implement API e2e tests as HTTP bash script(s) with this structure. Current entrypoint: [`.github/scripts/public-api-e2e-tests.sh`](../../.github/scripts/public-api-e2e-tests.sh) (Public API). New surfaces should reuse this pattern (same script or additional scripts), not invent a parallel style.
+Implement API e2e tests as HTTP bash script(s) with this structure. Current entrypoint: [`.github/scripts/public-api-e2e-tests.sh`](../../.github/scripts/public-api-e2e-tests.sh). New suites should reuse this pattern (same script or additional scripts), not invent a parallel style.
 
-The suite is **regression-oriented and intentionally thin**: contract and critical flows over HTTP, not a full matrix of edge cases.
+The suite is **thin**: assert the HTTP contract and critical flows so regressions show up early. Leave exhaustive edge-case matrices to unit or focused contract tests.
 
 | Layer | Role |
 | --- | --- |
@@ -61,7 +61,6 @@ The suite is **regression-oriented and intentionally thin**: contract and critic
 - Adding an endpoint is: open (or create) the resource suite, add `api` + `check`, register in `main` if new.
 - Reviews focus on cases, not harness inventiveness.
 - Soft `check` keeps the run going so one failure does not hide the rest.
-- Public API suites land first; internal API can follow the same rules later without a new design debate.
 
 ### Negative