refactor(ci): replace ArgoCD e2e with direct helm smoke-test script

The ArgoCD app-of-apps chain (bootstrap → clusters → platform → openbao)
takes 10-15 min and is hard to debug in CI. Replace with a standalone
scripts/smoke-test.sh that installs OpenBao + ESO + openbao-init directly
via helm, then runs the full destroy/recreate canary assertion (SC-001).

The script is also runnable locally: SCW_ACCESS_KEY=... bash scripts/smoke-test.sh

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KoJ6zVHxYtUKtSNXinmct7

Author: 2 people

.github/workflows/ci.yml

@@ -55,10 +55,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: dev
     env:
-      ARGOCD_VERSION: "v2.13.0"
       BAO_VERSION: "2.5.5"
-      REPO_URL: https://github.com/${{ github.repository }}
-      BRANCH: ${{ github.head_ref || github.ref_name }}
 
     steps:
       - uses: actions/checkout@v4
@@ -68,6 +65,13 @@ jobs:
         with:
           version: "latest"
 
+      - name: Install yq
+        run: |
+          sudo wget -qO /usr/local/bin/yq \
+            https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
+          sudo chmod +x /usr/local/bin/yq
+          yq --version
+
       - name: Install bao CLI
         run: |
           curl -sSfL \
@@ -76,205 +80,16 @@ jobs:
           sudo dpkg -i openbao.deb
           bao version
 
-      - name: Install ArgoCD CLI
-        run: |
-          curl -sSfL \
-            "https://github.com/argoproj/argo-cd/releases/download/${ARGOCD_VERSION}/argocd-linux-amd64" \
-            -o argocd
-          sudo install -m 755 argocd /usr/local/bin/argocd
-          argocd version --client
-
       - name: Start minikube
         uses: medyagh/setup-minikube@latest
 
-      - name: Install ArgoCD
-        run: |
-          kubectl create namespace argocd
-          kubectl apply --server-side -n argocd \
-            -f "https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml"
-          kubectl rollout status deployment/argocd-server -n argocd --timeout=180s
-
-      - name: Expose ArgoCD + login
-        id: argocd-login
-        run: |
-          kubectl port-forward svc/argocd-server -n argocd 8080:443 &
-          sleep 8
-          PASS=$(kubectl -n argocd get secret argocd-initial-admin-secret \
-            -o jsonpath="{.data.password}" | base64 -d)
-          argocd login localhost:8080 --username admin --password "${PASS}" --insecure
-          # Allow ArgoCD to pull from this (possibly private) repo via GITHUB_TOKEN
-          argocd repo add "${REPO_URL}" \
-            --username x-access-token \
-            --password "${{ secrets.GITHUB_TOKEN }}" \
-            --insecure-skip-server-verification || true
-
-      - name: Inject S3 credentials Secret (pre-sync)
-        run: |
-          kubectl create namespace openbao --dry-run=client -o yaml | kubectl apply -f -
-          kubectl create secret generic scaleway-s3-credentials \
-            --namespace openbao \
-            --from-literal=access_key="${{ secrets.SCW_ACCESS_KEY }}" \
-            --from-literal=secret_key="${{ secrets.SCW_SECRET_KEY }}" \
-            --from-literal=bucket="${{ vars.SCW_S3_BUCKET }}"
-
-      - name: Apply bootstrap Application
-        run: |
-          argocd app create bootstrap \
-            --repo "${REPO_URL}" \
-            --path bootstrap \
-            --dest-server https://kubernetes.default.svc \
-            --dest-namespace argocd \
-            --helm-set env=local \
-            --helm-set "revision=${BRANCH}" \
-            --helm-set "repoURL=${REPO_URL}" \
-            --sync-policy automated \
-            --upsert
-
-      - name: Wait for OpenBao to unseal
-        id: wait-unseal
-        run: |
-          # Poll health endpoint until initialized + unsealed (HTTP 200)
-          BAO_ADDR="http://$(kubectl get svc openbao -n openbao \
-            -o jsonpath='{.spec.clusterIP}' 2>/dev/null || echo 'pending'):8200"
-          echo "BAO_ADDR=${BAO_ADDR}" >> "${GITHUB_ENV}"
-
-          for i in $(seq 1 72); do
-            # Refresh ClusterIP in case the svc wasn't ready yet
-            CIP=$(kubectl get svc openbao -n openbao -o jsonpath='{.spec.clusterIP}' 2>/dev/null || true)
-            if [ -n "${CIP}" ]; then
-              BAO_ADDR="http://${CIP}:8200"
-              echo "BAO_ADDR=${BAO_ADDR}" >> "${GITHUB_ENV}"
-            fi
-
-            STATUS=$(curl -sf -o /dev/null -w "%{http_code}" \
-              "${BAO_ADDR}/v1/sys/health" 2>/dev/null || echo "000")
-            echo "Attempt ${i}/72 — OpenBao status: ${STATUS}"
-
-            if [ "${STATUS}" = "200" ] || [ "${STATUS}" = "429" ]; then
-              echo "OpenBao is unsealed."
-              break
-            fi
-            sleep 5
-          done
-
-          if [ "${STATUS}" != "200" ] && [ "${STATUS}" != "429" ]; then
-            echo "ERROR: OpenBao did not unseal within 6 minutes"
-            kubectl get events -n openbao --sort-by='.lastTimestamp' | tail -20 || true
-            kubectl logs -l 'app.kubernetes.io/name=openbao' -n openbao --tail=50 || true
-            exit 1
-          fi
-
-      - name: Write canary secret
-        run: |
-          CANARY_VALUE="survive-${{ github.run_id }}"
-          echo "CANARY_VALUE=${CANARY_VALUE}" >> "${GITHUB_ENV}"
-
-          # Authenticate via Kubernetes auth using the external-secrets SA token
-          SA_JWT=$(kubectl create token external-secrets -n external-secrets --duration=5m)
-          BAO_TOKEN=$(curl -sf "${BAO_ADDR}/v1/auth/kubernetes/login" \
-            -d "{\"role\":\"external-secrets\",\"jwt\":\"${SA_JWT}\"}" \
-            | jq -r '.auth.client_token')
-
-          curl -sf "${BAO_ADDR}/v1/kv/data/apps/test/canary" \
-            -H "X-Vault-Token: ${BAO_TOKEN}" \
-            -d "{\"data\":{\"value\":\"${CANARY_VALUE}\"}}"
-
-          echo "Canary written: ${CANARY_VALUE}"
-
-      # ── Cluster destroy & recreate ─────────────────────────────────────────
-
-      - name: Destroy minikube
-        run: minikube delete
-
-      - name: Recreate minikube
-        uses: medyagh/setup-minikube@latest
-
-      - name: Re-install ArgoCD
-        run: |
-          kubectl create namespace argocd
-          kubectl apply --server-side -n argocd \
-            -f "https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml"
-          kubectl rollout status deployment/argocd-server -n argocd --timeout=180s
-
-      - name: Re-expose ArgoCD + login
-        run: |
-          kubectl port-forward svc/argocd-server -n argocd 8080:443 &
-          sleep 8
-          PASS=$(kubectl -n argocd get secret argocd-initial-admin-secret \
-            -o jsonpath="{.data.password}" | base64 -d)
-          argocd login localhost:8080 --username admin --password "${PASS}" --insecure
-          argocd repo add "${REPO_URL}" \
-            --username x-access-token \
-            --password "${{ secrets.GITHUB_TOKEN }}" \
-            --insecure-skip-server-verification || true
-
-      - name: Re-inject S3 credentials Secret
-        run: |
-          kubectl create namespace openbao --dry-run=client -o yaml | kubectl apply -f -
-          kubectl create secret generic scaleway-s3-credentials \
-            --namespace openbao \
-            --from-literal=access_key="${{ secrets.SCW_ACCESS_KEY }}" \
-            --from-literal=secret_key="${{ secrets.SCW_SECRET_KEY }}" \
-            --from-literal=bucket="${{ vars.SCW_S3_BUCKET }}"
-
-      - name: Re-apply bootstrap Application
-        run: |
-          argocd app create bootstrap \
-            --repo "${REPO_URL}" \
-            --path bootstrap \
-            --dest-server https://kubernetes.default.svc \
-            --dest-namespace argocd \
-            --helm-set env=local \
-            --helm-set "revision=${BRANCH}" \
-            --helm-set "repoURL=${REPO_URL}" \
-            --sync-policy automated \
-            --upsert
-
-      - name: Wait for OpenBao to unseal after recreate
-        id: wait-unseal-2
-        run: |
-          for i in $(seq 1 72); do
-            CIP=$(kubectl get svc openbao -n openbao -o jsonpath='{.spec.clusterIP}' 2>/dev/null || true)
-            if [ -n "${CIP}" ]; then BAO_ADDR="http://${CIP}:8200"; fi
-
-            STATUS=$(curl -sf -o /dev/null -w "%{http_code}" \
-              "${BAO_ADDR}/v1/sys/health" 2>/dev/null || echo "000")
-            echo "Attempt ${i}/72 — OpenBao status: ${STATUS}"
-
-            if [ "${STATUS}" = "200" ] || [ "${STATUS}" = "429" ]; then
-              echo "OpenBao is unsealed after recreate."
-              break
-            fi
-            sleep 5
-          done
-
-          if [ "${STATUS}" != "200" ] && [ "${STATUS}" != "429" ]; then
-            echo "ERROR: OpenBao did not unseal after cluster recreate"
-            kubectl get events -n openbao --sort-by='.lastTimestamp' | tail -20 || true
-            exit 1
-          fi
-
-          echo "BAO_ADDR=${BAO_ADDR}" >> "${GITHUB_ENV}"
-
-      - name: Assert canary secret restored (SC-001)
-        run: |
-          SA_JWT=$(kubectl create token external-secrets -n external-secrets --duration=5m)
-          BAO_TOKEN=$(curl -sf "${BAO_ADDR}/v1/auth/kubernetes/login" \
-            -d "{\"role\":\"external-secrets\",\"jwt\":\"${SA_JWT}\"}" \
-            | jq -r '.auth.client_token')
-
-          RESTORED=$(curl -sf "${BAO_ADDR}/v1/kv/data/apps/test/canary" \
-            -H "X-Vault-Token: ${BAO_TOKEN}" \
-            | jq -r '.data.data.value')
-
-          echo "Expected : ${CANARY_VALUE}"
-          echo "Restored : ${RESTORED}"
-
-          if [ "${RESTORED}" != "${CANARY_VALUE}" ]; then
-            echo "ERROR: Canary mismatch — secret not restored after destroy/recreate"
-            exit 1
-          fi
-          echo "OK: SC-001 verified — secrets survive cluster destroy/recreate"
+      - name: Run smoke test (SC-001)
+        env:
+          SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }}
+          SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }}
+          SCW_S3_BUCKET: ${{ vars.SCW_S3_BUCKET }}
+          CANARY_VALUE: survive-${{ github.run_id }}
+        run: bash scripts/smoke-test.sh
 
       - name: Assert no Infisical pods (SC-003)
         run: |

scripts/smoke-test.sh

@@ -0,0 +1,144 @@
+#!/usr/bin/env bash
+# Smoke test: OpenBao S3-backed init + destroy/recreate canary assertion (SC-001).
+#
+# Requires: kubectl, helm, bao, yq, minikube already running
+# Env vars: SCW_ACCESS_KEY, SCW_SECRET_KEY, SCW_S3_BUCKET
+set -euo pipefail
+
+CANARY_VALUE="${CANARY_VALUE:-smoke-test-$(date +%s)}"
+OPENBAO_VERSION="0.28.4"
+ESO_VERSION="2.6.0"
+BAO_ADDR="http://127.0.0.1:8200"
+
+log() { echo "[$(date +%H:%M:%S)] $*"; }
+
+# ── Helpers ────────────────────────────────────────────────────────────────────
+
+add_repos() {
+  helm repo add openbao   https://openbao.github.io/openbao-helm   --force-update
+  helm repo add external-secrets https://charts.external-secrets.io --force-update
+  helm repo update
+}
+
+inject_secret() {
+  kubectl create namespace openbao --dry-run=client -o yaml | kubectl apply -f -
+  kubectl create namespace external-secrets --dry-run=client -o yaml | kubectl apply -f -
+  kubectl create secret generic scaleway-s3-credentials \
+    --namespace openbao \
+    --from-literal=access_key="${SCW_ACCESS_KEY}" \
+    --from-literal=secret_key="${SCW_SECRET_KEY}" \
+    --from-literal=bucket="${SCW_S3_BUCKET}" \
+    --dry-run=client -o yaml | kubectl apply -f -
+}
+
+install_openbao() {
+  log "Installing OpenBao ${OPENBAO_VERSION}..."
+  # Extract inline Helm values from the ArgoCD Application manifest
+  yq '.spec.source.helm.values' platform/local/openbao.yml > /tmp/openbao-values.yaml
+  helm upgrade --install openbao openbao/openbao \
+    --version "${OPENBAO_VERSION}" \
+    --namespace openbao \
+    --values /tmp/openbao-values.yaml \
+    --wait --timeout 5m
+}
+
+install_eso() {
+  log "Installing External Secrets Operator ${ESO_VERSION}..."
+  helm upgrade --install external-secrets external-secrets/external-secrets \
+    --version "${ESO_VERSION}" \
+    --namespace external-secrets \
+    --wait --timeout 5m
+}
+
+install_openbao_init() {
+  log "Installing openbao-init chart..."
+  helm upgrade --install openbao-init apps/openbao-init/ \
+    --namespace openbao \
+    --values apps/openbao-init/values-local.yaml \
+    --wait --timeout 5m
+}
+
+wait_unsealed() {
+  log "Waiting for OpenBao to be initialized and unsealed..."
+  kubectl port-forward svc/openbao -n openbao 8200:8200 &
+  PF_PID=$!
+  # shellcheck disable=SC2064
+  trap "kill ${PF_PID} 2>/dev/null || true" EXIT
+
+  for i in $(seq 1 120); do
+    STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${BAO_ADDR}/v1/sys/health" 2>/dev/null || echo "000")
+    log "Attempt ${i}/120 — health status: ${STATUS}"
+    if [ "${STATUS}" = "200" ] || [ "${STATUS}" = "429" ]; then
+      log "OpenBao is unsealed."
+      return 0
+    fi
+    sleep 5
+  done
+
+  log "ERROR: OpenBao did not unseal within 10 minutes"
+  kubectl logs -l 'app.kubernetes.io/name=openbao' -n openbao --tail=30 || true
+  kubectl get jobs -n openbao || true
+  kill "${PF_PID}" 2>/dev/null || true
+  exit 1
+}
+
+bao_token() {
+  SA_JWT=$(kubectl create token external-secrets -n external-secrets --duration=5m)
+  curl -sf "${BAO_ADDR}/v1/auth/kubernetes/login" \
+    -d "{\"role\":\"external-secrets\",\"jwt\":\"${SA_JWT}\"}" \
+    | jq -r '.auth.client_token'
+}
+
+# ── Phase 1: first boot ────────────────────────────────────────────────────────
+
+log "=== Phase 1: first boot ==="
+add_repos
+inject_secret
+install_openbao
+install_eso
+install_openbao_init
+wait_unsealed
+
+log "Writing canary secret (value: ${CANARY_VALUE})..."
+TOKEN=$(bao_token)
+curl -sf "${BAO_ADDR}/v1/kv/data/apps/test/canary" \
+  -H "X-Vault-Token: ${TOKEN}" \
+  -d "{\"data\":{\"value\":\"${CANARY_VALUE}\"}}"
+log "Canary written."
+
+# Kill port-forward from wait_unsealed
+kill "${PF_PID}" 2>/dev/null || true
+trap - EXIT
+
+# ── Phase 2: destroy + recreate ───────────────────────────────────────────────
+
+log "=== Phase 2: destroy cluster ==="
+minikube delete
+
+log "=== Phase 2: recreate cluster ==="
+minikube start
+
+add_repos
+inject_secret
+install_openbao
+install_eso
+install_openbao_init
+wait_unsealed
+
+# ── Phase 3: assert canary restored ───────────────────────────────────────────
+
+log "=== Phase 3: assert SC-001 ==="
+TOKEN=$(bao_token)
+RESTORED=$(curl -sf "${BAO_ADDR}/v1/kv/data/apps/test/canary" \
+  -H "X-Vault-Token: ${TOKEN}" \
+  | jq -r '.data.data.value')
+
+log "Expected : ${CANARY_VALUE}"
+log "Restored : ${RESTORED}"
+
+if [ "${RESTORED}" != "${CANARY_VALUE}" ]; then
+  log "FAIL: secret not restored after destroy/recreate (SC-001)"
+  exit 1
+fi
+
+log "OK: SC-001 verified — secrets survive cluster destroy/recreate"