internal/ci: test internal/e2e on protected branches

Only on Linux, since these end-to-end tests are slow,
and testing on different platforms or Go versions isn't useful.

Only on pushes to protected branches, since they use a github token
stored as the secret E2E_GITHUB_TOKEN, and we don't want to worry
about PR or CL trybot runs potentially leaking any secrets.
Plus, the end-to-end tests being slow means they aren't very well suited
to PR or CL trybot runs, where we want to finish relatively quickly.

Signed-off-by: Daniel Martí <[email protected]>
Change-Id: I7f687dc31010bc0e0005d3385c8388c6657d5362
Reviewed-on: https://review.gerrithub.io/c/cue-lang/cue/+/1171627
Reviewed-by: Roger Peppe <[email protected]>
TryBot-Result: CUEcueckoo <[email protected]>
Unity-Result: CUE porcuepine <[email protected]>

Author: mvdan

.github/workflows/trybot.yml

@@ -182,6 +182,15 @@ jobs:
         run: go test -race ./...
         env:
           GORACE: atexit_sleep_ms=10
+      - if: |-
+          ((github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/release-branch.')) && (! (contains(github.event.head_commit.message, '
+          Dispatch-Trailer: {"type":"')))) && (matrix.go-version == '1.21.x' && matrix.runner == 'ubuntu-22.04')
+        name: End-to-end test
+        run: |-
+          cd internal/e2e
+          go test
+        env:
+          GITHUB_TOKEN: ${{ secrets.E2E_GITHUB_TOKEN }}
       - if: (matrix.go-version == '1.21.x' && matrix.runner == 'ubuntu-22.04')
         name: Check
         run: go vet ./...

internal/ci/github/trybot.cue

@@ -75,6 +75,7 @@ workflows: trybot: _repo.bashWorkflow & {
 				_goTestRace & {
 					if: _isLatestLinux
 				},
+				_e2eTest,
 				_goCheck,
 				_repo.checkGitClean,
 			]
@@ -114,6 +115,22 @@ workflows: trybot: _repo.bashWorkflow & {
 		run:  "go test ./..."
 	}
 
+	_e2eTest: json.#step & {
+		name: "End-to-end test"
+		// The end-to-end tests require a github token secret and are a bit slow,
+		// so we only run them on pushes to protected branches and on one environment.
+		if: "\(_repo.isProtectedBranch) && \(_isLatestLinux)"
+		// The secret is the fine-grained access token "cue-lang/cue ci e2e for modules-testing"
+		// owned by the porcuepine bot account with read+write access to repo administration and code
+		// on the entire cue-labs-modules-testing org. Note that porcuepine is also an org admin,
+		// since otherwise the repo admin access to create and delete repos does not work.
+		env: GITHUB_TOKEN: "${{ secrets.E2E_GITHUB_TOKEN }}"
+		run:  """
+			cd internal/e2e
+			go test
+			"""
+	}
+
 	_goCheck: json.#step & {
 		// These checks can vary between platforms, as different code can be built
 		// based on GOOS and GOARCH build tags.