test: run platform HTTP smoke through one local and CI command

python-smoke:

  stage: test

  script:

    - python3 -m py_compile ansible/roles/oop-platform/files/fm_partners.py ansible/tests/r2_e2e/*.py

    - python3 -m py_compile ansible/roles/oop-platform/files/fm_partners.py ansible/tests/r2_e2e/*.py ci/*.py

platform-smoke-checks:

  stage: test

  image: python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1

  cache: []

  variables:

    TMPDIR: "$CI_PROJECT_DIR/.cache/smoke-tests"

    PYTHONDONTWRITEBYTECODE: "1"

  script:

    - mkdir -p "$TMPDIR"

    - pip install -r ci/requirements-smoke.txt

    - python -m pytest --confcutdir=ansible/tests/unit -q -p no:cacheprovider ansible/tests/unit --basetemp="$TMPDIR/pytest"

# Read-only opt-in check of an already deployed platform, through its public URLs.

platform-smoke:

  stage: test

  image: python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1

  cache: []

  timeout: 10 minutes

  variables:

    TMPDIR: "$CI_PROJECT_DIR/.cache/smoke-install"

    PYTHONDONTWRITEBYTECODE: "1"

  rules:

    - if: '$RUN_PLATFORM_SMOKE == "1" && $CI_COMMIT_REF_PROTECTED == "true"'

    - when: never

  script:

    - mkdir -p "$TMPDIR"

    - pip install -r ci/requirements-smoke.txt

    - python ci/platform_smoke.py --inventory "$OOP_SMOKE_INVENTORY"

  artifacts:

    when: always

    paths:

      - .cache/platform-smoke/result.json

    reports:

      junit: .cache/platform-smoke/junit.xml

    expire_in: 1 week

---

# HTTP-only view of an already deployed platform. Copy to r2-smoke.local.yml.

# Public URLs must be reachable from the machine/container running the command.

# No SSH credentials, kubeconfig or application image is needed for this scenario.

all:

  children:

    oop_platform_operators:

      hosts:

        local_lab:

          oop_platform_public_host: 127.0.0.1

          oop_platform_scheme: http

          oop_platform_oeg_node_port: 32263

          oop_platform_fm_node_port: 30989

the mark. The last run on the three test operators gave 22 passed and 1 xfailed. Pass

pytest arguments with `-e e2e_pytest_args='-k federation'`.

### First scenario: public HTTP health

For the first check of an already installed platform, use the same command

locally and in GitLab:

```bash

# Run from the repository root in a Python 3.12 virtual environment.

python -m pip install -r ci/requirements-smoke.txt

cp ansible/inventory/r2-smoke.example.yml ansible/inventory/r2-smoke.local.yml

# Edit the public address and ports for the selected lab.

python ci/platform_smoke.py --inventory ansible/inventory/r2-smoke.local.yml

```

This invokes the existing `e2e.yml` and selects only

`test_platform.py::test_oeg_and_fm_answer`. Each operator's OEG

`/platform/healthz` and FM `/healthz` must return 200. The test refuses an empty

operator list. It proves public HTTP access and liveness; authentication,

dependency readiness and application deployment are separate scenarios.

The command reads public addresses from the inventory and runs its tooling on

the controller, even if that inventory normally uses SSH. It needs no SSH,

Kubernetes credentials, Helm, Keycloak client or SDK artifact. The local k3d

example uses loopback addresses; a remote CI container needs a lab address it

can actually reach. The command does not create or expose a cluster.

Results are `.cache/platform-smoke/junit.xml` and `result.json`. A nonzero

Ansible exit, missing report, failure, skip or a result other than one selected

passing test makes the command fail. A fresh run removes stale reports and

cleans temporary settings/fact files from its workspace directory. Use

`--report-dir PATH` for a different report location.

The ordinary `platform-smoke-checks` CI job exercises this command against

local HTTP fixtures, including failures at either endpoint. To request the

live `platform-smoke` job on a protected ref, supply `RUN_PLATFORM_SMOKE=1` and

a protected **File** variable `OOP_SMOKE_INVENTORY` containing the chosen lab

inventory. The job runs the same command and retains the JUnit/result files.

It uses the normal untagged project runner pool; runner-to-lab reachability

must be verified. Live execution is disabled by default. The default R2 suite

and its existing selection remain available through `e2e.yml`.

The playbook also accepts `e2e_pytest_argv` as a structured argument list, so

report paths with spaces remain intact. Existing `e2e_pytest_args` callers keep

their previous behavior.

## Inventory reference

Start from `inventory/r2.example.yml`. Per operator (host in `oop_platform_operators`):

        - name: Make a file for it on the controller

          ansible.builtin.tempfile:

            path: "{{ e2e_temp_dir | default(omit) }}"

            suffix: .kubeconfig

          register: e2e_kubeconfig_file

          delegate_to: localhost

  tasks:

    - name: Write the settings for the tests

      ansible.builtin.tempfile:

        path: "{{ e2e_temp_dir | default(omit) }}"

        suffix: .json

      register: e2e_settings_file

      ansible.builtin.command:

        argv: >-

          {{ [ansible_playbook_python, '-m', 'pytest', playbook_dir ~ '/../../../tests/r2_e2e', '-v', '-rsxX']

             + (e2e_pytest_args | split if e2e_pytest_args | length > 0 else []) }}

             + (e2e_pytest_argv if e2e_pytest_argv is defined

                else (e2e_pytest_args | split if e2e_pytest_args | length > 0 else [])) }}

      environment:

        OOP_E2E_SETTINGS: "{{ e2e_settings_file.path }}"

      register: e2e_result

def test_oeg_and_fm_answer(operators):

    assert operators, "Configure at least one operator for the public health check"

    for op in operators:

        for url in (f"{op.oeg_url}/platform/healthz", f"{op.fm_url}/healthz"):

            assert http("GET", url).status_code == 200, url