From 3ff2703ebb5d6b95bb1055571330f5943050c2cb Mon Sep 17 00:00:00 2001
From: mlsmaycon <mlsmaycon@gmail.com>
Date: Mon, 29 Jun 2026 15:02:58 +0200
Subject: [PATCH] [ci] Add manual workflow for the agent-network e2e suite

The e2e suite (build tag `e2e`) stands up the combined server + proxy +
client in Docker and drives live chat-completions, so it is slow and needs
provider credentials. Gate it out of normal CI (it already is, via the
build tag) and run it on demand via workflow_dispatch. Provider scenarios
skip when their secret is unset, so it degrades gracefully.
---
 .github/workflows/agent-network-e2e.yml | 47 +++++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 .github/workflows/agent-network-e2e.yml

diff --git a/.github/workflows/agent-network-e2e.yml b/.github/workflows/agent-network-e2e.yml
new file mode 100644
index 000000000..eadf6d2f1
--- /dev/null
+++ b/.github/workflows/agent-network-e2e.yml
@@ -0,0 +1,47 @@
+name: Agent Network E2E
+
+# Container-based agent-network end-to-end suite (build tag `e2e`). It stands up
+# the combined server + proxy + a NetBird client in Docker and drives live
+# chat-completions through the gateway, so it is slow, needs Docker, and needs
+# provider credentials. It is therefore NOT part of the normal CI; run it
+# manually via the Actions tab. Provider scenarios skip when their secret is
+# absent, so the suite still runs (management-side scenarios) without keys.
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  e2e:
+    name: Agent Network E2E
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: "go.mod"
+
+      - name: Run agent-network e2e
+        env:
+          # Provider credentials. Each provider scenario skips if its
+          # token (and URL, for gateways) is unset, so partial coverage is fine.
+          OPENAI_TOKEN: ${{ secrets.E2E_OPENAI_TOKEN }}
+          ANTHROPIC_TOKEN: ${{ secrets.E2E_ANTHROPIC_TOKEN }}
+          VERCEL_URL: ${{ secrets.E2E_VERCEL_URL }}
+          VERCEL_TOKEN: ${{ secrets.E2E_VERCEL_TOKEN }}
+          OPENROUTER_URL: ${{ secrets.E2E_OPENROUTER_URL }}
+          OPENROUTER_TOKEN: ${{ secrets.E2E_OPENROUTER_TOKEN }}
+          CLOUDFLARE_URL: ${{ secrets.E2E_CLOUDFLARE_URL }}
+          CLOUDFLARE_TOKEN: ${{ secrets.E2E_CLOUDFLARE_TOKEN }}
+          AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.E2E_AWS_BEARER_TOKEN_BEDROCK }}
+          AWS_REGION: ${{ secrets.E2E_AWS_REGION }}
+        run: go test -tags e2e -timeout 40m -v ./e2e/...