internal/ci: support running e2e tests on pushes to ci/test

Currently, the e2e tests only run in CI on commits to master. The
alternative is to setup a local environment with secrets etc. This is
expensive, painful, and a security risk.

Instead allow trusted people to push to ci/test and have that branch
also be a valid condition for triggering the e2e tests. We continue to
do this only in the main repository, because the secrets are not
available elsewhere (intentionally so).

There is no increased risk of relaxing this condition to allow
triggering these tests from ci/test, because pushing to that branch is
already an action that is privileged.

Signed-off-by: Roger Peppe <rogpeppe@gmail.com>
Change-Id: I035ed4f8d398f8dfe70a5f3db988697f9aaaadc1
Reviewed-on: https://review.gerrithub.io/c/cue-lang/cue/+/1193330
Reviewed-by: Daniel Martí <mvdan@mvdan.cc>
TryBot-Result: CUEcueckoo <cueckoo@cuelang.org>
Unity-Result: CUE porcuepine <cue.porcuepine@gmail.com>

.github/workflows/trybot.yml

@@ -167,19 +167,19 @@ jobs:
       - name: gcloud auth for end-to-end tests
         id: auth
         if: |-
-          github.repository == 'cue-lang/cue' && ((github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/release-branch.')) && (! (contains(github.event.head_commit.message, '
-          Dispatch-Trailer: {"type":"')))) && (matrix.go-version == '1.22.x' && matrix.runner == 'ubuntu-22.04')
+          github.repository == 'cue-lang/cue' && (((github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/release-branch.')) && (! (contains(github.event.head_commit.message, '
+          Dispatch-Trailer: {"type":"')))) || (github.ref == 'refs/heads/ci/test')) && (matrix.go-version == '1.22.x' && matrix.runner == 'ubuntu-22.04')
         uses: google-github-actions/auth@v2
         with:
           credentials_json: ${{ secrets.E2E_GCLOUD_KEY }}
       - if: |-
-          github.repository == 'cue-lang/cue' && ((github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/release-branch.')) && (! (contains(github.event.head_commit.message, '
-          Dispatch-Trailer: {"type":"')))) && (matrix.go-version == '1.22.x' && matrix.runner == 'ubuntu-22.04')
+          github.repository == 'cue-lang/cue' && (((github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/release-branch.')) && (! (contains(github.event.head_commit.message, '
+          Dispatch-Trailer: {"type":"')))) || (github.ref == 'refs/heads/ci/test')) && (matrix.go-version == '1.22.x' && matrix.runner == 'ubuntu-22.04')
         name: gcloud setup for end-to-end tests
         uses: google-github-actions/setup-gcloud@v2
       - if: |-
-          github.repository == 'cue-lang/cue' && ((github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/release-branch.')) && (! (contains(github.event.head_commit.message, '
-          Dispatch-Trailer: {"type":"')))) && (matrix.go-version == '1.22.x' && matrix.runner == 'ubuntu-22.04')
+          github.repository == 'cue-lang/cue' && (((github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/release-branch.')) && (! (contains(github.event.head_commit.message, '
+          Dispatch-Trailer: {"type":"')))) || (github.ref == 'refs/heads/ci/test')) && (matrix.go-version == '1.22.x' && matrix.runner == 'ubuntu-22.04')
         name: End-to-end test
         env:
           CUE_TEST_LOGINS: ${{ secrets.E2E_CUE_LOGINS }}

internal/ci/github/trybot.cue

@@ -116,7 +116,7 @@ workflows: trybot: _repo.bashWorkflow & {
 		// The end-to-end tests require a github token secret and are a bit slow,
 		// so we only run them on pushes to protected branches and on one
 		// environment in the source repo.
-		if: "github.repository == '\(_repo.githubRepositoryPath)' && \(_repo.isProtectedBranch) && \(_isLatestLinux)"
+		if: "github.repository == '\(_repo.githubRepositoryPath)' && (\(_repo.isProtectedBranch) || \(_repo.isTestDefaultBranch)) && \(_isLatestLinux)"
 	}] & [
 		// Two setup steps per the upstream docs:
 		// https://github.com/google-github-actions/setup-gcloud#service-account-key-json