name: Agent Network E2E

on:
  # Nightly at 03:00 UTC, plus on demand from the Actions tab.
  schedule:
    - cron: "0 3 * * *"
  workflow_dispatch:
    inputs:
      bedrock_model:
        description: >-
          Bedrock inference-profile id to drive the matrix with, exactly as
          AWS issues it. Leave empty for the Sonnet 4.6 default.
        required: false
        default: ""

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  e2e:
    name: Agent Network E2E
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: "go.mod"

      # Container-driver builder so the harness can build the combined/proxy/
      # client images from source with a local layer cache.
      - name: Set up Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      # Persist the Docker layer cache across runs. This caches the base, apt,
      # and go-mod-download layers; the Go compile still re-runs, as BuildKit
      # mount caches cannot be exported to the GitHub cache.
      - name: Cache Docker layers
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-anet-e2e-buildx-${{ hashFiles('go.sum', 'combined/Dockerfile.multistage', 'proxy/Dockerfile.multistage', 'e2e/harness/Dockerfile.client') }}
          restore-keys: |
            ${{ runner.os }}-anet-e2e-buildx-

      - name: Run agent-network e2e
        env:
          # Build the images from source (this branch's code) with the shared
          # local layer cache.
          NB_E2E_BUILDX_CACHE: /tmp/.buildx-cache
          # Provider credentials. Each provider scenario skips if its
          # token (and URL, for gateways) is unset, so partial coverage is fine.
          OPENAI_TOKEN: ${{ secrets.E2E_OPENAI_TOKEN }}
          ANTHROPIC_TOKEN: ${{ secrets.E2E_ANTHROPIC_TOKEN }}
          # Moonshot AI platform key (platform.kimi.ai); drives both Kimi wire
          # shapes (OpenAI /v1 and Anthropic /anthropic) through kimi_api.
          KIMI_TOKEN: ${{ secrets.E2E_KIMI_TOKEN }}
          VERCEL_URL: ${{ secrets.E2E_VERCEL_URL }}
          VERCEL_TOKEN: ${{ secrets.E2E_VERCEL_TOKEN }}
          OPENROUTER_URL: ${{ secrets.E2E_OPENROUTER_URL }}
          OPENROUTER_TOKEN: ${{ secrets.E2E_OPENROUTER_TOKEN }}
          CLOUDFLARE_URL: ${{ secrets.E2E_CLOUDFLARE_URL }}
          CLOUDFLARE_TOKEN: ${{ secrets.E2E_CLOUDFLARE_TOKEN }}
          AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.E2E_AWS_BEARER_TOKEN_BEDROCK }}
          AWS_REGION: ${{ secrets.E2E_AWS_REGION }}
          # Bedrock model override: dispatch input wins, then the repo variable, else the test default.
          AWS_BEDROCK_MODEL: ${{ inputs.bedrock_model || vars.E2E_AWS_BEDROCK_MODEL }}
          # Vertex (Anthropic-on-Vertex): SA + project required; region defaults
          # to "global", model to a pinned claude snapshot.
          GOOGLE_VERTEX_SA_BASE64: ${{ secrets.E2E_GOOGLE_VERTEX_SA_BASE64 }}
          GOOGLE_VERTEX_PROJECT: ${{ secrets.E2E_GOOGLE_VERTEX_PROJECT }}
          GOOGLE_VERTEX_REGION: ${{ secrets.E2E_GOOGLE_VERTEX_REGION }}
          GOOGLE_VERTEX_MODEL: ${{ secrets.E2E_GOOGLE_VERTEX_MODEL }}
        run: go test -tags e2e -timeout 40m -v ./e2e/...
