Add E2E CI workflow on release branches

Static lint + config-sanity checks (markdown, yaml, sh, compose, tasks)
catch a lot, but not "does the stack actually boot, run migrations, and
serve /admin/?". Adds a GitHub Actions workflow that does exactly that
on release-branch PRs.

The workflow walks the localhost-cert install recipe end to end:

1. task env:init  (domain prompt piped: os2display.localhost)
2. APP_ENV=prod sed (until upstream display-api-service ships PR #435
   in a tagged release; the image's bundled .env defaults to dev mode
   but the image is built --no-dev)
3. task env:traefik (cert-file branch, prompts piped)
4. task dev:cert
5. install-secrets.sh + compose pull + compose up --wait
6. bin/console app:update + lexik:jwt:generate-keypair
7. bin/console app:tenant:add + app:user:add (direct compose exec — task
   install's nested task: subtasks don't pipe stdin reliably per B23)
8. curl /admin/ via --cacert traefik/ssl/dev.crt + --resolve. Asserts 200.
9. compose down --volumes (always-runs cleanup)

Triggers on pull_request against release/** and push to release/**.
Doesn't run on every PR — too slow (~5 min) and too much docker churn
for the casual review cycle. Acts as the release-cut quality bar.

Known fragility points documented in the workflow comments for the
next operator who has to debug a flake: the APP_ENV workaround,
GHCR rate limits, and the task-install stdin-piping caveat.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: turegjorup

.github/workflows/e2e.yaml

@@ -0,0 +1,117 @@
+### ### E2E
+###
+### End-to-end test of the localhost-cert install recipe: bootstrap env
+### files via `task env:init`, generate the self-signed cert via
+### `task dev:cert`, bring the stack up, create a tenant + admin user,
+### and curl the admin route over HTTPS using the generated cert.
+###
+### Triggers on `pull_request` against `release/**` and pushes to
+### `release/**` only — too slow + too much docker churn to run on every
+### casual PR. Acts as the release-cut quality bar that the static
+### `markdown` / `yaml` / `sh` / `compose` / `tasks` workflows can't catch:
+### actual stack boot, Doctrine migrations, JWT keypair generation, and
+### Traefik routing.
+###
+### #### Known fragility points
+###
+### - `APP_ENV=dev` workaround: the upstream display-api-service image's
+###   bundled .env still defaults to `APP_ENV=dev` until a 3.0.0-rc3+ tag
+###   ships the fix from display-api-service#435. We sed it to `prod`
+###   before bringing the stack up. Drop the override once a fixed tag
+###   is in `OS2DISPLAY_VERSION_API`.
+### - `task install` chains `task: <subtask>` calls that don't reliably
+###   pipe stdin to the Symfony console (B23 caveat). The workflow
+###   sidesteps by running the install steps directly via
+###   `docker compose exec`.
+### - GHCR pulls without auth: bot quota, can flake on heavy CI days.
+
+name: E2E
+
+on:
+  pull_request:
+    branches:
+      - "release/**"
+  push:
+    branches:
+      - "release/**"
+
+jobs:
+  install-localhost:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install Task
+        uses: arduino/setup-task@v2
+        with:
+          version: 3.x
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Bootstrap env files (domain prompt piped)
+        # `task env:init` prompts for the public domain; pipe the localhost
+        # default. The script also extracts .env.symfony from the API image,
+        # auto-generates APP_SECRET + JWT_PASSPHRASE, and bumps serverVersion.
+        run: printf 'os2display.localhost\n' | task env:init
+
+      - name: APP_ENV=prod workaround (upstream image bug)
+        # The image's bundled .env defaults to APP_ENV=dev but the image is
+        # built --no-dev, so dev-mode boot fails on a missing WebProfilerBundle.
+        # Drop this step once the fix from display-api-service#435 ships
+        # in a 3.0.0-rc3+ tag.
+        run: sed -i 's|^APP_ENV=dev|APP_ENV=prod|' .env.symfony
+
+      - name: Configure traefik (cert-file branch, prompts piped)
+        # Choice 2 = cert-file. Domain = traefik.localhost. LE email
+        # skipped via blank line (cert-file branch ignores it). Cert
+        # filename defaults accepted via blank lines. Dashboard
+        # admin / password.
+        run: |
+          printf '2\ntraefik.localhost\n\n\nadmin\npassword\n' | task env:traefik
+
+      - name: Generate self-signed cert
+        run: task dev:cert
+
+      - name: Bring stack up
+        # `task install`'s chained `task: <subtask>` calls don't pipe
+        # stdin reliably for tenant:add / user:add (B23 caveat), so
+        # we step through manually below. install-secrets.sh
+        # (auto-fills MARIADB_*=CHANGE_ME sentinels) gets called first
+        # to match the real `task install` order.
+        run: |
+          ./scripts/install-secrets.sh
+          docker compose --env-file .env --env-file .env.traefik pull
+          docker compose --env-file .env --env-file .env.traefik up --detach --wait
+
+      - name: Run database migrations
+        run: |
+          docker compose --env-file .env --env-file .env.traefik exec -T os2display \
+            bin/console --no-interaction app:update
+
+      - name: Generate JWT keypair
+        run: |
+          docker compose --env-file .env --env-file .env.traefik exec -T os2display \
+            bin/console lexik:jwt:generate-keypair --skip-if-exists
+
+      - name: Create tenant + admin user
+        run: |
+          docker compose --env-file .env --env-file .env.traefik exec -T os2display \
+            bin/console app:tenant:add e2e 'E2E Tenant' 'CI'
+          docker compose --env-file .env --env-file .env.traefik exec -T os2display \
+            bin/console app:user:add admin@os2display.localhost e2epassword 'E2E Admin' admin e2e
+
+      - name: Smoke test — admin route over HTTPS
+        # --resolve maps os2display.localhost → 127.0.0.1; --cacert trusts
+        # the generated dev cert (covers os2display.localhost as a SAN).
+        # -f makes curl exit non-zero on >=400.
+        run: |
+          curl -fv \
+            --resolve os2display.localhost:443:127.0.0.1 \
+            --cacert traefik/ssl/dev.crt \
+            https://os2display.localhost/admin/ \
+            -o /dev/null
+
+      - name: Tear down
+        if: always()
+        run: |
+          docker compose --env-file .env --env-file .env.traefik down --volumes --remove-orphans

CHANGELOG.md

@@ -53,6 +53,12 @@ and aligned to the v3 image's env contract. **For 1.x → 3.x operators: see
   aggregate) — set-membership comparison of `task --list` against the README block. Section
   headings, descriptions, and alias notes in the README stay human-curated; only the SET of
   task names is checked. Caught the missing `dev:teardown` entry in the existing block.
+- New **`E2E`** workflow on release branches: bootstraps env files via `task env:init`,
+  generates a self-signed cert via `task dev:cert`, brings the full stack up, runs Doctrine
+  migrations, creates a tenant + admin user, and curls `/admin/` over HTTPS via the dev cert.
+  Catches install-path regressions the static checks can't (image boot, migration replay,
+  Traefik routing). Triggers on `pull_request` against `release/**` and pushes to
+  `release/**` — too slow (~5 min wall-clock) for every casual PR.
 - `scripts/` directory: extracted helpers for the longer Taskfile bodies that the upstream
   [Taskfile style guide](https://taskfile.dev/styleguide/) recommends moving out
   ("Prefer using external scripts instead of multi-line commands"). `host-resources.sh`,

README.md

@@ -939,14 +939,17 @@ file-copy header at the top of each lints config preserves provenance for sync.
 
 ### CI workflows
 
-`.github/workflows/`, four files:
+`.github/workflows/`, five static checks plus a release-branch e2e:
 
 - **`markdown.yaml`** — runs markdownlint via `docker compose --profile dev run --rm
   markdownlint`. Catches doc rot.
 - **`yaml.yaml`** — runs prettier via the same pattern. Catches YAML drift.
 - **`sh.yaml`** — runs shellcheck against `scripts/*.sh` via the `shellcheck` dev-profile
   service. Catches shell footguns in the extracted helpers (unquoted vars, masked exit
   codes, etc.).
+- **`tasks.yaml`** — runs `scripts/check-tasks-readme.sh`, asserting the set of task
+  names in the README's "All tasks" reference block matches `task --list`. Section
+  labels, descriptions, and alias notes stay human-curated; only membership is checked.
 - **`compose.yaml`** — three jobs:
   1. `compose-config` — synthesises the stack with example env files + a stub `.env.symfony`.
      Catches typos and dangling `${VAR}` references.
@@ -955,8 +958,15 @@ file-copy header at the top of each lints config preserves provenance for sync.
   3. `env-coverage` — every bare `${VAR}` reference in `docker-compose.yml` is declared in
      `.env.example` or `.env.traefik.example`. Catches the silent-empty
      substitution case.
-
-All four trigger on `pull_request` and pushes to `main` / `develop` / `release/**`.
+- **`e2e.yaml`** — release-branch only (`pull_request` against `release/**`, push to
+  `release/**`). Bootstraps env files via `task env:init`, generates a self-signed cert,
+  brings the full stack up, runs migrations, creates a tenant + admin user, and curls
+  `/admin/` over HTTPS via the cert. Catches install-path regressions the static checks
+  can't (image boot, migration replay, Traefik routing). ~5 minutes wall-clock.
+
+All static checks trigger on `pull_request` and pushes to `main` / `develop` /
+`release/**`. The e2e workflow runs on release branches only — too slow + too much docker
+churn for the casual review cycle.
 
 ---