@red-hat-developer-hub/e2e-test-utils 1.1.32 → 1.1.34

package/dist/playwright/global-setup.d.ts

@@ -2,5 +2,6 @@
  * Global setup for Playwright tests.
  * This file runs once before all tests.
  */
-export default function globalSetup(): Promise<void>;
+import { type FullConfig } from "@playwright/test";
+export default function globalSetup(config: FullConfig): Promise<void>;
 //# sourceMappingURL=global-setup.d.ts.map

package/dist/playwright/global-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"global-setup.d.ts","sourceRoot":"","sources":["../../src/playwright/global-setup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA2EH,wBAA8B,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAMzD"}
+{"version":3,"file":"global-setup.d.ts","sourceRoot":"","sources":["../../src/playwright/global-setup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AA6EnD,wBAA8B,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ3E"}

package/dist/playwright/global-setup.js

@@ -2,10 +2,13 @@
  * Global setup for Playwright tests.
  * This file runs once before all tests.
  */
+import dotenv from "dotenv";
+import { resolve } from "path";
 import { KubernetesClientHelper } from "../utils/kubernetes-client.js";
 import { $ } from "../utils/bash.js";
 import { KeycloakHelper } from "../deployment/keycloak/index.js";
 import { DEFAULT_KEYCLOAK_CONFIG, DEFAULT_RHDH_CLIENT, DEFAULT_USERS, } from "../deployment/keycloak/constants.js";
+import { loadLocalVaultSecrets } from "../utils/vault.js";
 const REQUIRED_BINARIES = ["oc", "kubectl", "helm"];
 async function checkRequiredBinaries() {
     const missingBinaries = [];
@@ -58,10 +61,27 @@ async function deployKeycloak() {
         testPassword: DEFAULT_USERS[0].password,
     });
 }
-export default async function globalSetup() {
+export default async function globalSetup(config) {
     console.log("Running global setup...");
     await checkRequiredBinaries();
+    await loadLocalVaultSecrets();
+    loadDotenvFromProjects(config);
     await setClusterRouterBaseEnv();
     await deployKeycloak();
     console.log("Global setup completed successfully");
 }
+/**
+ * Loads .env files from each project's e2e-tests directory.
+ * Uses `override: true` so local .env values take priority over Vault secrets.
+ */
+function loadDotenvFromProjects(config) {
+    const seen = new Set();
+    for (const project of config.projects) {
+        // testDir points to e2e-tests/tests, go up one level to e2e-tests/
+        const e2eRoot = resolve(project.testDir, "..");
+        if (seen.has(e2eRoot))
+            continue;
+        seen.add(e2eRoot);
+        dotenv.config({ path: resolve(e2eRoot, ".env"), override: true });
+    }
+}

package/dist/playwright/teardown-reporter.d.ts

@@ -10,7 +10,8 @@ import type { Reporter, Suite, TestCase, TestResult } from "@playwright/test/rep
  * Falls back in onEnd() to clean up any projects that didn't complete naturally
  * (e.g., interrupted runs, maxFailures).
  *
- * Only active when process.env.CI === "true".
+ * Diagnostic log collection runs always (CI and local).
+ * Namespace deletion only runs when process.env.CI === "true".
  *
  * By default, deletes the namespace matching the project name.
  * For custom namespaces, consumers can register them via registerTeardownNamespace().
@@ -18,6 +19,7 @@ import type { Reporter, Suite, TestCase, TestResult } from "@playwright/test/rep
 export default class TeardownReporter implements Reporter {
     private _projectTestCounts;
     private _projectCompleted;
+    private _projectsWithFailures;
     private _pendingDeletions;
     onBegin(_config: unknown, suite: Suite): void;
     onTestEnd(test: TestCase, result: TestResult): void;

package/dist/playwright/teardown-reporter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"teardown-reporter.d.ts","sourceRoot":"","sources":["../../src/playwright/teardown-reporter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,QAAQ,EACR,KAAK,EACL,QAAQ,EACR,UAAU,EACX,MAAM,2BAA2B,CAAC;AAInC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,YAAW,QAAQ;IACvD,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,iBAAiB,CAA6B;IACtD,OAAO,CAAC,iBAAiB,CAAoC;IAE7D,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI;IAa7C,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI;IA0B7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAed,wBAAwB;CAuBvC"}
+{"version":3,"file":"teardown-reporter.d.ts","sourceRoot":"","sources":["../../src/playwright/teardown-reporter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,QAAQ,EACR,KAAK,EACL,QAAQ,EACR,UAAU,EACX,MAAM,2BAA2B,CAAC;AAKnC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,YAAW,QAAQ;IACvD,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,iBAAiB,CAA6B;IACtD,OAAO,CAAC,qBAAqB,CAAqB;IAClD,OAAO,CAAC,iBAAiB,CAAoC;IAE7D,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI;IAa7C,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI;IA6B7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAcd,wBAAwB;CAwCvC"}

package/dist/playwright/teardown-reporter.js

@@ -1,3 +1,4 @@
+import path from "path";
 import { KubernetesClientHelper } from "../utils/kubernetes-client.js";
 import { getTeardownNamespaces } from "./teardown-namespaces.js";
 /**
@@ -11,7 +12,8 @@ import { getTeardownNamespaces } from "./teardown-namespaces.js";
  * Falls back in onEnd() to clean up any projects that didn't complete naturally
  * (e.g., interrupted runs, maxFailures).
  *
- * Only active when process.env.CI === "true".
+ * Diagnostic log collection runs always (CI and local).
+ * Namespace deletion only runs when process.env.CI === "true".
  *
  * By default, deletes the namespace matching the project name.
  * For custom namespaces, consumers can register them via registerTeardownNamespace().
@@ -19,6 +21,7 @@ import { getTeardownNamespaces } from "./teardown-namespaces.js";
 export default class TeardownReporter {
     _projectTestCounts = new Map();
     _projectCompleted = new Map();
+    _projectsWithFailures = new Set();
     _pendingDeletions = new Map();
     onBegin(_config, suite) {
         for (const test of suite.allTests()) {
@@ -30,8 +33,6 @@ export default class TeardownReporter {
         }
     }
     onTestEnd(test, result) {
-        if (process.env.CI !== "true")
-            return;
         const project = test.parent.project();
         if (!project)
             return;
@@ -41,23 +42,25 @@ export default class TeardownReporter {
         if (!isDone)
             return;
         const name = project.name;
+        if (result.status !== "passed" && result.status !== "skipped") {
+            this._projectsWithFailures.add(name);
+        }
         const completed = (this._projectCompleted.get(name) ?? 0) + 1;
         this._projectCompleted.set(name, completed);
-        // Start deletion immediately (fire-and-forget here, awaited in onEnd)
+        // Start cleanup immediately (fire-and-forget here, awaited in onEnd)
         if (completed === this._projectTestCounts.get(name) &&
             !this._pendingDeletions.has(name)) {
             this._pendingDeletions.set(name, this._deleteProjectNamespaces(name));
         }
     }
     async onEnd() {
-        if (process.env.CI !== "true")
-            return;
-        // Await all in-flight deletions started from onTestEnd
+        // Await all in-flight cleanups started from onTestEnd
         await Promise.all(this._pendingDeletions.values());
         // Fallback: clean up projects that didn't complete naturally
-        // (e.g., interrupted run, maxFailures hit)
+        // (e.g., interrupted run, maxFailures hit) — always collect diagnostics
         for (const [project] of this._projectTestCounts) {
             if (!this._pendingDeletions.has(project)) {
+                this._projectsWithFailures.add(project);
                 await this._deleteProjectNamespaces(project);
             }
         }
@@ -68,14 +71,24 @@ export default class TeardownReporter {
             k8sClient = new KubernetesClientHelper();
         }
         catch (error) {
-            console.error(`[TeardownReporter] Cannot connect to cluster, skipping teardown:`, error);
+            console.error(`[TeardownReporter] Cannot connect to cluster, skipping cleanup:`, error);
             return;
         }
         const customNamespaces = getTeardownNamespaces(projectName);
         const namespaces = customNamespaces.length > 0 ? customNamespaces : [projectName];
-        for (const ns of namespaces) {
-            console.log(`[TeardownReporter] Deleting namespace "${ns}" (project: ${projectName})`);
-            await k8sClient.deleteNamespace(ns);
+        // Collect diagnostic logs on failure (always, regardless of CI)
+        if (this._projectsWithFailures.has(projectName)) {
+            for (const ns of namespaces) {
+                const outputDir = path.join("node_modules", ".cache", "e2e-test-results", "logs", projectName);
+                await k8sClient.collectDiagnosticLogs(ns, outputDir);
+            }
+        }
+        // Delete namespaces only in CI
+        if (process.env.CI === "true") {
+            for (const ns of namespaces) {
+                console.log(`[TeardownReporter] Deleting namespace "${ns}" (project: ${projectName})`);
+                await k8sClient.deleteNamespace(ns);
+            }
         }
     }
 }

package/dist/utils/kubernetes-client.d.ts

@@ -88,6 +88,15 @@ declare class KubernetesClientHelper {
      * @param pollIntervalMs - How often to check pod status (default: 5000)
      */
     waitForPodsWithFailureDetection(namespace: string, labelSelector: string, timeoutSeconds?: number, pollIntervalMs?: number): Promise<void>;
+    /**
+     * Collects diagnostic logs for all resources in a namespace and saves them as files.
+     * Uses kubectl for cross-platform compatibility (works on OpenShift, EKS, GKE, etc.).
+     * OpenShift-specific resources (routes) are collected on a best-effort basis.
+     *
+     * @param namespace - Namespace to collect diagnostics from
+     * @param outputDir - Directory to write log files to (defaults to playwright-report/logs/<namespace>)
+     */
+    collectDiagnosticLogs(namespace: string, outputDir?: string): Promise<void>;
     /**
      * Check if a pod is in a failure state. Returns failure info or null if healthy.
      */

package/dist/utils/kubernetes-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubernetes-client.d.ts","sourceRoot":"","sources":["../../src/utils/kubernetes-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAO/C;;GAEG;AACH,cAAM,sBAAsB;IAC1B,OAAO,CAAC,GAAG,CAAiB;IAC5B,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,iBAAiB,CAAuB;;IAqChD;;OAEG;IACG,uBAAuB,CAC3B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IA8C3B;;OAEG;IACG,0BAA0B,CAC9B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IA+B3B;;UAEM;IAmBN;;OAEG;IAsBH;;OAEG;YACW,YAAY;IA8B1B;;OAEG;IACG,wBAAwB,CAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IA0ChB;;OAEG;IACG,qBAAqB,CACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,EAC7C,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAqChB;;OAEG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,eAAe,GAAE,OAAc,EAC/B,cAAc,GAAE,MAAY,GAC3B,OAAO,CAAC,IAAI,CAAC;IAyBhB;;OAEG;YACW,yBAAyB;IAsCvC;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IA2BxB;;OAEG;IACG,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAc3E;;OAEG;IACG,uBAAuB,CAC3B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,MAAY,EAC5B,cAAc,GAAE,MAAa,GAC5B,OAAO,CAAC,OAAO,CAAC;IAiBnB;;;OAGG;IACG,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC;IAuBhD;;;;;;OAMG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBxE;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAmBxB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAQnC;IAEH;;;;;;;;OAQG;IACG,+BAA+B,CACnC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,cAAc,GAAE,MAAY,EAC5B,cAAc,GAAE,MAAa,GAC5B,OAAO,CAAC,IAAI,CAAC;IA2FhB;;OAEG;IACH,OAAO,CAAC,gBAAgB;CA8BzB;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}
+{"version":3,"file":"kubernetes-client.d.ts","sourceRoot":"","sources":["../../src/utils/kubernetes-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAO/C;;GAEG;AACH,cAAM,sBAAsB;IAC1B,OAAO,CAAC,GAAG,CAAiB;IAC5B,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,iBAAiB,CAAuB;;IAqChD;;OAEG;IACG,uBAAuB,CAC3B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IA8C3B;;OAEG;IACG,0BAA0B,CAC9B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IA+B3B;;UAEM;IAmBN;;OAEG;IAsBH;;OAEG;YACW,YAAY;IA8B1B;;OAEG;IACG,wBAAwB,CAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IA0ChB;;OAEG;IACG,qBAAqB,CACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,EAC7C,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAqChB;;OAEG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,eAAe,GAAE,OAAc,EAC/B,cAAc,GAAE,MAAY,GAC3B,OAAO,CAAC,IAAI,CAAC;IAyBhB;;OAEG;YACW,yBAAyB;IAsCvC;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IA2BxB;;OAEG;IACG,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAc3E;;OAEG;IACG,uBAAuB,CAC3B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,MAAY,EAC5B,cAAc,GAAE,MAAa,GAC5B,OAAO,CAAC,OAAO,CAAC;IAiBnB;;;OAGG;IACG,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC;IAuBhD;;;;;;OAMG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBxE;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAmBxB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAQnC;IAEH;;;;;;;;OAQG;IACG,+BAA+B,CACnC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,cAAc,GAAE,MAAY,EAC5B,cAAc,GAAE,MAAa,GAC5B,OAAO,CAAC,IAAI,CAAC;IAwFhB;;;;;;;OAOG;IACG,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,MAMV,GACA,OAAO,CAAC,IAAI,CAAC;IAiGhB;;OAEG;IACH,OAAO,CAAC,gBAAgB;CA8BzB;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}

package/dist/utils/kubernetes-client.js

@@ -509,13 +509,11 @@ class KubernetesClientHelper {
             }
             await new Promise((r) => setTimeout(r, pollIntervalMs));
         }
-        // Timeout reached - collect diagnostic info before throwing
+        // Timeout reached - print diagnostics to stdio before throwing
         console.log(`\n[K8sHelper] ═══ Pod Diagnostics (timeout reached) ═══`);
         try {
             console.log(`\n[K8sHelper] ─── Pod Status ───`);
             await $ `oc get pods -n ${namespace} -l ${labelSelector} -o wide`;
-            console.log(`\n[K8sHelper] ─── Namespace Events ───`);
-            await $ `oc get events -n ${namespace} --sort-by='.lastTimestamp'`;
             console.log(`\n[K8sHelper] ─── Pod Logs ───`);
             await $ `oc logs -n ${namespace} -l ${labelSelector} --all-containers --tail=100 2>&1 || true`;
         }
@@ -525,6 +523,75 @@ class KubernetesClientHelper {
         console.log(`\n[K8sHelper] ═══ End Pod Diagnostics ═══\n`);
         throw new Error(`Timeout waiting for pods (${labelSelector}) after ${timeoutSeconds}s`);
     }
+    /**
+     * Collects diagnostic logs for all resources in a namespace and saves them as files.
+     * Uses kubectl for cross-platform compatibility (works on OpenShift, EKS, GKE, etc.).
+     * OpenShift-specific resources (routes) are collected on a best-effort basis.
+     *
+     * @param namespace - Namespace to collect diagnostics from
+     * @param outputDir - Directory to write log files to (defaults to playwright-report/logs/<namespace>)
+     */
+    async collectDiagnosticLogs(namespace, outputDir = path.join("node_modules", ".cache", "e2e-test-results", "logs", namespace)) {
+        fs.mkdirSync(outputDir, { recursive: true });
+        console.log(`[K8sHelper] Collecting diagnostic logs for "${namespace}" → ${outputDir}`);
+        const quiet = $({
+            stdio: ["pipe", "pipe", "pipe"],
+            timeout: "20s",
+        });
+        const save = async (filePath, cmd) => {
+            try {
+                const result = await cmd;
+                fs.mkdirSync(path.dirname(filePath), { recursive: true });
+                fs.writeFileSync(filePath, result.stdout);
+            }
+            catch {
+                // ignore — resource type may not exist on this cluster
+            }
+        };
+        await Promise.allSettled([
+            save(path.join(outputDir, "events.txt"), quiet `kubectl get events -n ${namespace} --sort-by='.lastTimestamp'`),
+            save(path.join(outputDir, "pods.txt"), quiet `kubectl get pods -n ${namespace} -o wide`),
+            save(path.join(outputDir, "describe-pods.txt"), quiet `kubectl describe pods -n ${namespace}`),
+            save(path.join(outputDir, "deployments.txt"), quiet `kubectl get deployments -n ${namespace} -o wide`),
+            save(path.join(outputDir, "describe-deployments.txt"), quiet `kubectl describe deployments -n ${namespace}`),
+            save(path.join(outputDir, "statefulsets.txt"), quiet `kubectl get statefulsets -n ${namespace} -o wide`),
+            save(path.join(outputDir, "routes.txt"), quiet `kubectl get routes -n ${namespace} -o wide`),
+        ]);
+        try {
+            const pods = (await this._k8sApi.listNamespacedPod({ namespace })).items;
+            const saveLogs = async (filePath, cmd) => {
+                try {
+                    const result = await cmd;
+                    if (result.stdout.trim()) {
+                        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+                        fs.writeFileSync(filePath, result.stdout);
+                    }
+                }
+                catch {
+                    // ignore — container may not have started or no previous logs
+                }
+            };
+            await Promise.allSettled(pods
+                .filter((pod) => pod.metadata?.name)
+                .flatMap((pod) => {
+                const podName = pod.metadata.name;
+                const podDir = path.join(outputDir, "pods", podName);
+                const containers = [
+                    ...(pod.spec?.initContainers ?? []),
+                    ...(pod.spec?.containers ?? []),
+                ];
+                return containers
+                    .filter((c) => c.name)
+                    .flatMap((c) => [
+                    saveLogs(path.join(podDir, `${c.name}.log`), quiet `kubectl logs ${podName} -n ${namespace} -c ${c.name}`),
+                    saveLogs(path.join(podDir, `${c.name}.previous.log`), quiet `kubectl logs ${podName} -n ${namespace} -c ${c.name} --previous`),
+                ]);
+            }));
+        }
+        catch {
+            // ignore
+        }
+    }
     /**
      * Check if a pod is in a failure state. Returns failure info or null if healthy.
      */

package/dist/utils/vault.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Loads secrets from HashiCorp Vault into process.env.
+ * Only runs when `VAULT=1` or `VAULT=true` is set. Handles OIDC login automatically.
+ *
+ * Fetches secrets from:
+ * - Global path: `<basePath>/global`
+ * - Per-workspace paths: `<basePath>/workspaces/<name>`
+ *
+ * Configure via env vars:
+ * - `VAULT_ADDR` — Vault server URL (default: https://vault.ci.openshift.org)
+ * - `VAULT_BASE_PATH` — Base path in Vault (default: selfservice/rhdh-plugin-export-overlays)
+ *
+ * Security: Only key names are logged, never secret values.
+ */
+export declare function loadLocalVaultSecrets(): Promise<void>;
+//# sourceMappingURL=vault.d.ts.map

package/dist/utils/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/utils/vault.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAiE3D"}

package/dist/utils/vault.js

@@ -0,0 +1,94 @@
+import { $ } from "./bash.js";
+const VAULT_ADDR_DEFAULT = "https://vault.ci.openshift.org";
+const VAULT_BASE_PATH_DEFAULT = "selfservice/rhdh-plugin-export-overlays";
+/**
+ * Loads secrets from HashiCorp Vault into process.env.
+ * Only runs when `VAULT=1` or `VAULT=true` is set. Handles OIDC login automatically.
+ *
+ * Fetches secrets from:
+ * - Global path: `<basePath>/global`
+ * - Per-workspace paths: `<basePath>/workspaces/<name>`
+ *
+ * Configure via env vars:
+ * - `VAULT_ADDR` — Vault server URL (default: https://vault.ci.openshift.org)
+ * - `VAULT_BASE_PATH` — Base path in Vault (default: selfservice/rhdh-plugin-export-overlays)
+ *
+ * Security: Only key names are logged, never secret values.
+ */
+export async function loadLocalVaultSecrets() {
+    if (process.env.VAULT !== "1" && process.env.VAULT !== "true")
+        return;
+    const vaultAddr = process.env.VAULT_ADDR || VAULT_ADDR_DEFAULT;
+    const basePath = process.env.VAULT_BASE_PATH || VAULT_BASE_PATH_DEFAULT;
+    process.env.VAULT_ADDR = vaultAddr;
+    // Check vault CLI is installed
+    const whichResult = await vaultCmd `command -v vault`;
+    if (whichResult.exitCode !== 0) {
+        throw new Error("vault CLI not found. Install from https://developer.hashicorp.com/vault/downloads");
+    }
+    // Check if already logged in
+    const tokenCheck = await vaultCmd `vault token lookup`;
+    if (tokenCheck.exitCode !== 0) {
+        console.log("Vault: not logged in, starting OIDC login...");
+        // vault login needs inherited stdio for browser-based OIDC flow
+        await $ `vault login -no-print -method=oidc`;
+        const retryCheck = await vaultCmd `vault token lookup`;
+        if (retryCheck.exitCode !== 0) {
+            throw new Error("Vault login failed. Run manually:\n  export VAULT_ADDR='" +
+                vaultAddr +
+                "'\n  vault login -method=oidc");
+        }
+    }
+    // Check access by fetching global secrets first
+    const globalResult = await vaultCmd `vault kv get -format=json -mount=kv ${basePath}/global`;
+    if (globalResult.stderr.includes("permission denied")) {
+        console.log("Vault: permission denied. Request access in Slack: #rhdh-e2e-tests");
+        return;
+    }
+    console.log("Loading secrets from vault...");
+    // Load global secrets
+    loadSecretsFromResult(globalResult, "global");
+    // List and fetch per-workspace secrets
+    const listResult = await vaultCmd `vault kv list -format=json -mount=kv ${basePath}/workspaces`;
+    if (listResult.exitCode === 0) {
+        const workspaces = JSON.parse(listResult.stdout);
+        await Promise.all(workspaces.map((ws) => {
+            const name = ws.replace(/\/$/, "");
+            return exportSecretsFromPath(`${basePath}/workspaces/${name}`, name);
+        }));
+    }
+    else {
+        console.log("  No workspace-specific secrets found");
+    }
+    console.log("Vault secrets loaded successfully.");
+}
+/** Runs a shell command with piped stdio and nothrow, for capturing vault CLI output. */
+const vaultCmd = $({
+    stdio: ["pipe", "pipe", "pipe"],
+    nothrow: true,
+});
+async function exportSecretsFromPath(vaultPath, label) {
+    const result = await vaultCmd `vault kv get -format=json -mount=kv ${vaultPath}`;
+    loadSecretsFromResult(result, label);
+}
+function loadSecretsFromResult(result, label) {
+    if (result.exitCode !== 0) {
+        console.log(`  No secrets at: ${label}`);
+        return;
+    }
+    const json = JSON.parse(result.stdout);
+    const secrets = json?.data?.data;
+    if (!secrets) {
+        console.log(`  No secrets at: ${label}`);
+        return;
+    }
+    console.log(`  From: ${label}`);
+    for (const [key, value] of Object.entries(secrets)) {
+        if (key.startsWith("secretsync/"))
+            continue;
+        if (!key.startsWith("VAULT_"))
+            continue;
+        const safeKey = key.replace(/[.\-/]/g, "_");
+        process.env[safeKey] = value;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@red-hat-developer-hub/e2e-test-utils",
-  "version": "1.1.32",
+  "version": "1.1.34",
   "description": "Test utilities for RHDH E2E tests",
   "license": "Apache-2.0",
   "repository": {
@@ -107,6 +107,7 @@
     "@eslint/js": "10.0.1",
     "@keycloak/keycloak-admin-client": "26.5.6",
     "@kubernetes/client-node": "1.4.0",
+    "dotenv": "17.4.2",
     "eslint": "10.2.0",
     "eslint-plugin-check-file": "3.3.1",
     "eslint-plugin-playwright": "2.10.1",