name: E2E (E2B sandbox)

# This suite provisions external E2B sandboxes and is intentionally opt-in.
# It has no push, pull_request, schedule, or workflow_call trigger.
on:
  workflow_dispatch:

permissions:
  contents: read

env:
  # CI runs must never report to the production telemetry endpoint baked
  # into apps/cli/cordis.yml (AppCLIEntry disables the row when set).
  DSH_TELEMETRY_DISABLED: '1'

jobs:
  e2b:
    runs-on: ubuntu-latest
    name: E2B live Loader composition
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v6

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm

      - name: Install (immutable)
        run: pnpm install --frozen-lockfile

      # The tests self-skip locally when the credential is absent. A manually
      # dispatched run must fail instead of reporting an all-skipped green.
      - name: Preflight (require E2B API key)
        env:
          E2B_API_KEY: ${{ secrets.E2B_API_KEY_EXTERNAL }}
        run: |
          set -euo pipefail
          if [ -z "${E2B_API_KEY:-}" ]; then
            echo "::error::E2B_API_KEY is empty. Configure the E2B_API_KEY_EXTERNAL repository secret."
            exit 1
          fi
          echo "E2B_API_KEY present."

      # The Loader smoke runs package exports under plain Node in lib mode.
      - name: Build (lib for the E2B Loader smoke)
        run: pnpm run build

      - name: E2B tests (live sandbox)
        env:
          E2B_API_KEY: ${{ secrets.E2B_API_KEY_EXTERNAL }}
          DSH_E2E_MAX_WORKERS: '1'
          DSH_EXAMPLE_MODE: lib
        run: >-
          pnpm exec vitest run --config vitest.e2e.config.ts
          packages/e2b/e2b/tests/composition.e2e.ts