feat(e2e-ui): local workbench cluster gitops + SecretStack vault

.github/workflows/README.md

@@ -11,10 +11,12 @@ existing unbounded-tech quality provider plus the integration/* jobs below —
 |----------|-----------------|----------|
 | [`quality.yaml`](./quality.yaml) | yes | **Consumers:** fmt → clippy → build → test + coverage (sticky PR comment) |
 | [`test-all-features.yaml`](./test-all-features.yaml) | yes | **This repo:** workspace `--all-features` |
-| [`integration-*.yaml`](./) | yes | **This repo:** broker / DB / CLI / observability |
+| [`integration-*.yaml`](./) | yes | **This repo:** broker / DB / CLI / observability / GraphQL identity+OIDC |
+| [`integration-e2e-ui.yaml`](./integration-e2e-ui.yaml) | yes | **This repo:** `tests/e2e-ui` offline suite + Playwright browser e2e |
+| [`integration-js.yaml`](./integration-js.yaml) | yes | **This repo:** install, typecheck, test, build, and packed-consumer smoke test for `js/` |
 | [`on-pr-quality.yaml`](./on-pr-quality.yaml) | entry | **This repo** PR gate (not the consumer quality contract) |
 | [`on-push-main-version-and-tag.yaml`](./on-push-main-version-and-tag.yaml) | entry | **This repo** main → **vnext** tag |
-| [`on-v-tag-publish.yaml`](./on-v-tag-publish.yaml) | entry | **This repo** crates.io + `dctl` binary release |
+| [`on-v-tag-publish.yaml`](./on-v-tag-publish.yaml) | entry | **This repo** crates.io + npm + `dctl` binary release |
 
 **Version tagging (anywhere):** `unbounded-tech/workflow-vnext-tag`  
 **GitHub Release only (domain crates):** `unbounded-tech/workflow-simple-release`
@@ -90,12 +92,46 @@ jobs:
 
 **Pinning:** prefer a released tag once cut (`@vX.Y.Z` or git SHA). During development of quality, `@feat/shared-workflows` is fine.
 
+## npm release setup
+
+Version tags publish the package under [`js/`](../../js/) to npm as
+`@hops-ops/distributed`. The tag must have the exact form `vX.Y.Z`; the workflow
+uses `X.Y.Z` for both `js/package.json` and `js/package-lock.json`, runs the same
+package quality gate used on pull requests, and publishes with npm provenance.
+
+Configure an npm **Trusted Publisher** for `@hops-ops/distributed` with these
+exact GitHub Actions coordinates:
+
+- Organization or user: `hops-ops`
+- Repository: `distributed`
+- Workflow filename: `on-v-tag-publish.yaml`
+- Environment: `npm`
+- Allowed action: `npm publish`
+
+Trusted Publisher configuration is available only after the npm package exists.
+One-time bootstrap (already completed for this repo):
+
+1. Publish a throwaway non-release version such as `0.0.0` for
+   `@hops-ops/distributed` on the public npm registry.
+2. Configure the npm Trusted Publisher using the exact coordinates above
+   (`npm trust github @hops-ops/distributed --file on-v-tag-publish.yaml
+   --repo hops-ops/distributed --env npm --allow-publish`).
+3. Create the GitHub `npm` deployment environment (optional protection rules:
+   tag pattern `v*`, required reviewers).
+
+Release preflight validates the tag form and that `@hops-ops/distributed`
+exists on the public registry before any npm or crates.io write starts. Tagged
+npm releases authenticate through GitHub Actions OIDC. The workflow
+intentionally has job-scoped `id-token: write`, uses npm 11.5.1 or newer, and
+does **not** require or accept a long-lived `NPM_TOKEN` repository secret.
+
 ## Why this monorepo doesn’t call `quality.yaml`
 
 The framework workspace needs a different gate: default-features tests via
 unbounded quality (or similar), plus **all-features**, Postgres/NATS/Kafka/…
-integrations, and CLI/observability jobs. Consumer domain crates are single
-packages (or small libs) and only need the reusable quality contract.
+integrations, CLI/observability, and GraphQL identity/OIDC jobs. Consumer
+domain crates are single packages (or small libs) and only need the reusable
+quality contract.
 
 ## Out of scope (for now)
 

.github/workflows/integration-e2e-ui.yaml

@@ -0,0 +1,182 @@
+name: e2e-ui fixture (offline + browser)
+
+# Nested Todos template under tests/e2e-ui — not the root workspace.
+# Local parity:
+#   cd tests/e2e-ui && make check-client
+#   cd tests/e2e-ui && make test
+#   cd tests/e2e-ui && make up && make run   # then make test-browser
+on:
+  workflow_call:
+
+env:
+  CARGO_TERM_COLOR: always
+  # Playwright / Auth.js over HTTP on localhost
+  CI: true
+
+jobs:
+  offline:
+    name: e2e-ui offline (domain + suite + UI unit)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: tests/e2e-ui
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          toolchain: stable
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: tests/e2e-ui -> target
+          shared-key: e2e-ui-offline
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: |
+            js/package-lock.json
+            tests/e2e-ui/ui/package-lock.json
+
+      - name: Verify generated client artifacts
+        run: make check-client
+
+      - name: Offline test suite
+        run: make test
+
+  browser:
+    name: e2e-ui Playwright (live stack)
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    defaults:
+      run:
+        working-directory: tests/e2e-ui
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          toolchain: stable
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: tests/e2e-ui -> target
+          shared-key: e2e-ui-browser
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: |
+            js/package-lock.json
+            tests/e2e-ui/package-lock.json
+            tests/e2e-ui/ui/package-lock.json
+
+      - name: Install host tools
+        run: sudo apt-get update && sudo apt-get install -y jq openssl curl
+
+      - name: Docker stack + OIDC bootstrap (make up)
+        run: |
+          chmod +x scripts/up.sh
+          make up
+
+      - name: Build e2e-ui API binary
+        run: cargo build -p e2e-runner --bin e2e-ui
+
+      - name: Install UI deps
+        run: make ui-install
+
+      - name: Start API + UI
+        run: |
+          set -euo pipefail
+          set -a
+          # shellcheck disable=SC1091
+          . ./e2e-ui.env
+          set +a
+          export AUTH_URL="${E2E_UI_ORIGIN:-http://localhost:5180}"
+          export AUTH_USE_SECURE_COOKIES=false
+          export AUTH_TRUST_HOST=true
+
+          ./target/debug/e2e-ui > .make-runner.log 2>&1 &
+          echo $! > .make-runner.pid
+
+          ok=0
+          for i in $(seq 1 90); do
+            code=$(curl -s -o /dev/null -w '%{http_code}' -X POST "http://127.0.0.1:8791/graphql" \
+              -H 'content-type: application/json' \
+              -d '{"query":"{ __typename }"}' 2>/dev/null || echo 000)
+            if [ "$code" = "200" ] || [ "$code" = "401" ]; then ok=1; break; fi
+            sleep 0.5
+          done
+          if [ "$ok" != "1" ]; then
+            echo "API failed to become ready"; tail -100 .make-runner.log; exit 1
+          fi
+          echo "API ready (HTTP $code)"
+
+          cd ui
+          npm run dev -- --host localhost --port 5180 > ../.make-ui.log 2>&1 &
+          echo $! > ../.make-ui.pid
+          cd ..
+
+          ok=0
+          for i in $(seq 1 60); do
+            code=$(curl -s -o /dev/null -w '%{http_code}' "http://localhost:5180/" 2>/dev/null || echo 000)
+            # 200 home, or 303 redirect when auth wraps routes — not 000/5xx
+            if [ "$code" = "200" ] || [ "$code" = "303" ] || [ "$code" = "302" ]; then ok=1; break; fi
+            sleep 0.5
+          done
+          if [ "$ok" != "1" ]; then
+            echo "UI failed to become ready (last HTTP $code)"; tail -80 .make-ui.log; exit 1
+          fi
+          echo "UI ready (HTTP $code)"
+
+      - name: Install Playwright + Chromium
+        run: |
+          npm install
+          npx playwright install chromium --with-deps
+
+      - name: Run browser e2e
+        run: npm run test:browser
+        env:
+          E2E_UI_ORIGIN: http://localhost:5180
+          E2E_API_ORIGIN: http://127.0.0.1:8791
+          CI: true
+
+      - name: Upload Playwright report
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: e2e-ui-playwright-report
+          path: |
+            tests/e2e-ui/playwright-report
+            tests/e2e-ui/test-results
+          if-no-files-found: ignore
+          retention-days: 7
+
+      - name: Dump logs on failure
+        if: failure()
+        run: |
+          echo '=== API log ==='
+          tail -150 .make-runner.log || true
+          echo '=== UI log ==='
+          tail -80 .make-ui.log || true
+          docker compose -f docker/docker-compose.yml ps -a || true
+          docker compose -f docker/docker-compose.yml logs --tail=100 || true
+
+      - name: Stop API/UI
+        if: always()
+        run: |
+          [ -f .make-ui.pid ] && kill "$(cat .make-ui.pid)" 2>/dev/null || true
+          [ -f .make-runner.pid ] && kill "$(cat .make-runner.pid)" 2>/dev/null || true
+          lsof -ti:8791 2>/dev/null | xargs -r kill -9 2>/dev/null || true
+          lsof -ti:5180 2>/dev/null | xargs -r kill -9 2>/dev/null || true
+
+      - name: Tear down Docker
+        if: always()
+        run: docker compose -f docker/docker-compose.yml down -v || true