ci(e2e): CMT scheduling + macOS E2E stabilization + CI/security hardening

.github/workflows/cmt-provisioner.yml

@@ -1,10 +1,20 @@
 name: CMT Provisioner
 
-# This is a stub workflow. Its only purpose is to fire a workflow_run webhook
-# to Matterwick, which provisions cloud servers for each server version and
-# then dispatches compatibility-matrix-testing.yml with the CMT_MATRIX input.
+# Trigger workflow for Compatibility Matrix Testing (CMT).
 #
-# Usage: Go to Actions → CMT Provisioner → Run workflow
+# Previous design: this workflow just echoed the inputs and relied on GitHub
+# firing a workflow_run webhook to matterwick, which would then read the
+# server_versions input from the webhook payload. That path is broken --
+# GitHub's workflow_run payload does not include workflow_dispatch inputs,
+# so matterwick never received server_versions and never dispatched
+# compatibility-matrix-testing.yml.
+#
+# New design: POST directly to matterwick's /cmt_dispatch endpoint with
+# everything it needs (server_versions, run_id, sha, ref, repo, owner).
+# Matterwick returns 202 immediately and provisions instances + dispatches
+# compatibility-matrix-testing.yml asynchronously.
+#
+# Usage: Go to Actions -> CMT Provisioner -> Run workflow
 #   server_versions: comma-separated Mattermost server versions
 #   Example: "v11.1.0, v11.2.0, v12.0.0"
 
@@ -17,13 +27,48 @@ on:
         type: string
 
 jobs:
-  notify:
+  trigger-matterwick:
     runs-on: ubuntu-22.04
     steps:
-      - name: Log CMT request
+      - name: Request CMT provisioning from matterwick
         env:
+          MATTERWICK_URL: ${{ vars.MATTERWICK_URL }}
+          CMT_TRIGGER_TOKEN: ${{ secrets.MATTERWICK_CMT_TRIGGER_SECRET }}
           SERVER_VERSIONS: ${{ inputs.server_versions }}
+          REPO: ${{ github.event.repository.name }}
+          OWNER: ${{ github.repository_owner }}
+          SHA: ${{ github.sha }}
+          REF: ${{ github.ref_name }}
+          RUN_ID: ${{ github.run_id }}
         run: |
-          echo "CMT Provisioner triggered"
-          echo "Server versions: ${SERVER_VERSIONS}"
-          echo "Matterwick will provision cloud instances and dispatch compatibility-matrix-testing.yml"
+          if [ -z "${MATTERWICK_URL}" ]; then
+            echo "ERROR: vars.MATTERWICK_URL is not set on this repository" >&2
+            exit 1
+          fi
+          if [ -z "${CMT_TRIGGER_TOKEN}" ]; then
+            echo "ERROR: secrets.MATTERWICK_CMT_TRIGGER_SECRET is not set on this repository" >&2
+            exit 1
+          fi
+
+          payload="$(jq -nc \
+            --arg owner    "${OWNER}" \
+            --arg repo     "${REPO}" \
+            --arg sha      "${SHA}" \
+            --arg ref      "${REF}" \
+            --argjson run_id ${RUN_ID} \
+            --arg versions "${SERVER_VERSIONS}" \
+            '{owner:$owner, repo:$repo, sha:$sha, ref:$ref, run_id:$run_id, server_versions:$versions}')"
+
+          echo "Requesting CMT provisioning for server versions: ${SERVER_VERSIONS}"
+
+          curl -sS -X POST "${MATTERWICK_URL}/cmt_dispatch" \
+            -H "Content-Type: application/json" \
+            -H "X-Trigger-Token: ${CMT_TRIGGER_TOKEN}" \
+            --data-binary "${payload}" \
+            --fail-with-body \
+            --retry 3 --retry-delay 5 --retry-connrefused \
+            --connect-timeout 10 --max-time 30
+
+          echo "matterwick accepted the CMT dispatch request."
+          echo "Provisioning will run asynchronously (~30 min) and then"
+          echo "compatibility-matrix-testing.yml will be dispatched automatically."