ci: require run-e2e label for automatic GitLab E2E

.github/workflows/e2e-request.yml

@@ -14,9 +14,7 @@ permissions: {}
 
 jobs:
   request:
-    if: >-
-      github.event.label.name == 'run-e2e' &&
-      github.event.pull_request.head.repo.full_name != github.repository
+    if: github.event.label.name == 'run-e2e'
     runs-on: ubuntu-latest
     timeout-minutes: 1
     steps:

.github/workflows/gitlab-e2e.yml

@@ -1,15 +1,9 @@
 name: GitLab E2E
 
 on:
-  push:
-    branches: [main]
-    tags: ["v*"]
-  pull_request:
-    branches: [main]
   workflow_run:
     workflows: [GitLab E2E request]
     types: [completed]
-  merge_group:
   workflow_dispatch:
     inputs:
       setup_ref:
@@ -34,11 +28,11 @@ jobs:
   gitlab-e2e:
     name: GitLab E2E
     if: >-
-      github.event_name != 'workflow_run' ||
-      (github.event.workflow_run.event == 'pull_request' &&
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'workflow_run' &&
+       github.event.workflow_run.event == 'pull_request' &&
        github.event.workflow_run.conclusion == 'success' &&
-       github.event.workflow_run.path == '.github/workflows/e2e-request.yml' &&
-       github.event.workflow_run.head_repository.full_name != github.repository)
+       github.event.workflow_run.path == '.github/workflows/e2e-request.yml')
     runs-on: ubuntu-latest
     timeout-minutes: 35
     outputs:
@@ -53,39 +47,32 @@ jobs:
         id: parameters
         env:
           EVENT_NAME: ${{ github.event_name }}
-          EVENT_REF: ${{ github.ref }}
-          EVENT_REF_NAME: ${{ github.ref_name }}
           REQUEST_EVENT: ${{ github.event.workflow_run.event }}
           REQUEST_CONCLUSION: ${{ github.event.workflow_run.conclusion }}
           REQUEST_PATH: ${{ github.event.workflow_run.path }}
           REQUEST_TITLE: ${{ github.event.workflow_run.display_title }}
           REQUEST_ACTOR: ${{ github.event.workflow_run.actor.login }}
           REQUEST_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
           REQUEST_HEAD_REPOSITORY: ${{ github.event.workflow_run.head_repository.full_name }}
-          PR_HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
-          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
           MANUAL_SETUP_REF: ${{ inputs.setup_ref }}
           MANUAL_SUITE: ${{ inputs.suite }}
           MANUAL_VITE_PLUS_VERSION: ${{ inputs.vite_plus_version }}
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
 
-          should_run=true
-          setup_vp_ref="$GITHUB_SHA"
-          suite=required
+          should_run=false
+          setup_vp_ref=""
+          suite=full
           vite_plus_version=latest
           report_pr_number=""
-          skip_reason=""
+          skip_reason='GitLab E2E requires a successful run-e2e label request for a PR or a manual workflow_dispatch run.'
 
-          resolve_fork_request() {
-            should_run=false
-            skip_reason='Only a successful run-e2e label request for a fork PR can approve a GitLab E2E run.'
+          resolve_pr_request() {
             local request_pattern='^PR #([1-9][0-9]*): labeled run-e2e at ([0-9a-f]{40})$'
-            if [ "$REQUEST_EVENT" != "pull_request" ] || [ "$REQUEST_CONCLUSION" != "success" ] ||
+            if [ "$EVENT_NAME" != "workflow_run" ] || [ "$REQUEST_EVENT" != "pull_request" ] ||
+              [ "$REQUEST_CONCLUSION" != "success" ] ||
               [ "$REQUEST_PATH" != ".github/workflows/e2e-request.yml" ] ||
-              [ "$REQUEST_HEAD_REPOSITORY" = "$GITHUB_REPOSITORY" ] ||
               ! [[ "$REQUEST_TITLE" =~ $request_pattern ]]; then
               return
             fi
@@ -114,7 +101,7 @@ jobs:
             trusted_blob="$(gh api "${workflow_url}?ref=${GITHUB_SHA}" --jq '.sha')"
             if ! request_blob="$(gh api "${workflow_url}?ref=${REQUEST_HEAD_SHA}" --jq '.sha')" ||
               [ "$request_blob" != "$trusted_blob" ]; then
-              echo "::error::The fork must include e2e-request.yml unchanged from main. Update the branch, then remove and re-add run-e2e."
+              echo "::error::The PR must include e2e-request.yml unchanged from main. Update the branch, then remove and re-add run-e2e."
               exit 1
             fi
 
@@ -132,39 +119,16 @@ jobs:
 
             should_run=true
             setup_vp_ref="$REQUEST_HEAD_SHA"
-            suite=full
             report_pr_number="$pr_number"
           }
 
-          if [ "$EVENT_NAME" = "pull_request" ]; then
-            if [ "$PR_HEAD_REPOSITORY" != "$GITHUB_REPOSITORY" ]; then
-              should_run=false
-              skip_reason='A maintainer with write access can review this fork PR and add the run-e2e label to test its current commit. New commits require removing and re-adding the label. The merge queue also tests the reviewed merge commit.'
-            else
-              setup_vp_ref="$PR_HEAD_SHA"
-              report_pr_number="$PR_NUMBER"
-              while IFS= read -r changed_path; do
-                case "$changed_path" in
-                  gitlab/* | src/gitlab/* | src/ci/* | dist/gitlab/* | .github/workflows/gitlab-e2e.yml | vite.config.ts | package.json | pnpm-lock.yaml | pnpm-workspace.yaml)
-                    suite=full
-                    break
-                    ;;
-                esac
-              done < <(gh api --paginate "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/files" --jq '.[].filename')
-            fi
-          elif [ "$EVENT_NAME" = "workflow_run" ]; then
-            resolve_fork_request
-          elif [ "$EVENT_NAME" = "merge_group" ]; then
-            suite=full
-          elif [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            should_run=true
             setup_vp_ref="${MANUAL_SETUP_REF:-$GITHUB_SHA}"
             suite="${MANUAL_SUITE:-full}"
             vite_plus_version="${MANUAL_VITE_PLUS_VERSION:-latest}"
-          elif [ "$EVENT_NAME" = "push" ] && [[ "$EVENT_REF" == refs/tags/* ]]; then
-            setup_vp_ref="$EVENT_REF_NAME"
-            suite=full
-          elif [ "$EVENT_NAME" = "push" ]; then
-            suite=full
+          else
+            resolve_pr_request
           fi
 
           {

CONTRIBUTING.md

@@ -52,14 +52,18 @@ Use the shared primitives under [`src/ci/`](src/ci/) for portable runtime behavi
 
 ## GitLab End-to-End Tests
 
-Use the dedicated [GitLab test project](https://gitlab.com/fengmk2/setup-vp-gitlab-test) to test the remote integration. The [GitLab E2E workflow](.github/workflows/gitlab-e2e.yml) covers same-repository pull requests, approved fork pull requests, merge queue commits, merges, and releases. The pipeline loads the template, bootstrap script, and compiled runtime from the exact setup-vp commit or release tag under test.
+Use the dedicated [GitLab test project](https://gitlab.com/fengmk2/setup-vp-gitlab-test) to test the remote integration. GitLab CI has limited capacity, so the [GitLab E2E workflow](.github/workflows/gitlab-e2e.yml) runs only for pull requests approved with the `run-e2e` label or manual `workflow_dispatch` requests. The pipeline loads the template, bootstrap script, and compiled runtime from the exact approved PR commit or the manually selected commit or release tag.
 
-### Fork Pull Requests
+### Request a Run
 
-After reviewing the commit, a maintainer with write access can add `run-e2e` to run the full GitLab suite. Approve the Actions run if prompted.
+After reviewing the commit, a maintainer with write access can add `run-e2e` to run the full GitLab suite. This applies to both same-repository and fork PRs. Approve the Actions run if prompted.
 
 For each new commit, review the changes and remove and re-add `run-e2e`. Read the PR result comment for the status and GitLab pipeline link after each run.
 
+Pushes, merge queue commits, merges, and release tags do not automatically start GitLab pipelines.
+
+For a manual run, use `workflow_dispatch`. Set `setup_ref` to an exact commit SHA or release tag, or leave it empty to test the selected workflow commit. Select `suite` (`full` by default) and `vite_plus_version` (`latest` by default).
+
 ## Dependency Updates
 
 Renovate opens a PR when SocketDev publishes a new `sfw-free` release. See the custom managers in [`.github/renovate.json`](.github/renovate.json) for the pinned `SFW_VERSION` values in the GitHub and portable runtimes.
@@ -85,7 +89,7 @@ Publish releases as Git tags, not as an npm package. Keep `package.json.version`
    git status --short   # must be empty
    ```
 
-3. Confirm that the release commit on `main` passes the full GitLab E2E workflow.
+3. Confirm that the release commit on `main` passes the full GitLab E2E workflow. Use `workflow_dispatch` with the exact commit SHA and `suite: full`.
 
 4. Create the new annotated version tag and push it. For example: