refactor: harden tests

.github/workflows/app-e2e.yml

@@ -8,6 +8,19 @@ on:
         required: false
         default: true
         type: boolean
+    secrets:
+      TAURI_WEBDRIVER_TOKEN:
+        description: Read-only token for the test-driver repository
+        required: false
+      WAYFERN_TEST_TOKEN:
+        description: Token used by the full Wayfern integration suite
+        required: false
+      RESIDENTIAL_PROXY_URL_ONE_SOCKS:
+        description: SOCKS5 residential proxy used by the network suite
+        required: false
+      RESIDENTIAL_PROXY_URL_ONE_HTTP:
+        description: HTTP residential proxy used by the network suite
+        required: false
   workflow_dispatch:
     inputs:
       suite:
@@ -20,6 +33,7 @@ on:
           - smoke
           - ui
           - entities
+          - network
           - integrations
           - sync
           - browser
@@ -51,13 +65,15 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           path: donutbrowser
+          persist-credentials: false
 
-      - name: Checkout private cross-platform WebDriver
+      - name: Checkout test driver
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          repository: ${{ vars.TAURI_WEBDRIVER_REPOSITORY || 'zhom/tauri-cross-platform-webdriver' }}
+          repository: ${{ vars.TAURI_WEBDRIVER_REPOSITORY }}
           token: ${{ secrets.TAURI_WEBDRIVER_TOKEN || github.token }}
           path: tauri-cross-platform-webdriver
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
@@ -81,6 +97,7 @@ jobs:
         with:
           workspaces: |
             donutbrowser/src-tauri -> target
+            donutbrowser/e2e/app -> target
             tauri-cross-platform-webdriver -> target
 
       - name: Install Tauri dependencies
@@ -95,8 +112,6 @@ jobs:
 
       - name: Run isolated smoke suite
         working-directory: donutbrowser
-        env:
-          DONUT_E2E_KEEP_ARTIFACTS: "1"
         shell: bash
         run: |
           if [[ "${RUNNER_OS}" == "Linux" ]]; then
@@ -106,17 +121,17 @@ jobs:
           fi
 
       - name: Upload E2E diagnostics
-        if: always()
-        uses: actions/upload-artifact@v7
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: app-e2e-smoke-${{ matrix.os }}
-          path: ${{ runner.temp }}/donut-e2e-*
+          path: ${{ runner.temp }}/donut-e2e-*/diagnostics/**
           if-no-files-found: ignore
           retention-days: 7
 
   full:
     name: Full UI, sync, encryption, and Wayfern
-    if: ${{ inputs.smoke_only != true }}
+    if: ${{ inputs.smoke_only != true && inputs.suite != 'network' }}
     runs-on: macos-latest
     timeout-minutes: 40
 
@@ -125,13 +140,15 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           path: donutbrowser
+          persist-credentials: false
 
-      - name: Checkout private cross-platform WebDriver
+      - name: Checkout test driver
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          repository: ${{ vars.TAURI_WEBDRIVER_REPOSITORY || 'zhom/tauri-cross-platform-webdriver' }}
+          repository: ${{ vars.TAURI_WEBDRIVER_REPOSITORY }}
           token: ${{ secrets.TAURI_WEBDRIVER_TOKEN || github.token }}
           path: tauri-cross-platform-webdriver
+          persist-credentials: false
 
       - name: Install pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
@@ -155,6 +172,7 @@ jobs:
         with:
           workspaces: |
             donutbrowser/src-tauri -> target
+            donutbrowser/e2e/app -> target
             tauri-cross-platform-webdriver -> target
 
       - name: Install app dependencies
@@ -164,16 +182,88 @@ jobs:
       - name: Run full isolated app suite
         working-directory: donutbrowser
         env:
-          DONUT_E2E_KEEP_ARTIFACTS: "1"
           DONUT_E2E_SUITE: ${{ inputs.suite || 'full' }}
+          DONUT_E2E_SKIP_NETWORK_TEST: "1"
           WAYFERN_TEST_TOKEN: ${{ secrets.WAYFERN_TEST_TOKEN }}
-        run: node e2e/run.mjs --suite=${DONUT_E2E_SUITE}
+        run: node e2e/run.mjs "--suite=${DONUT_E2E_SUITE}"
 
       - name: Upload E2E diagnostics
-        if: always()
-        uses: actions/upload-artifact@v7
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: app-e2e-full-macos
-          path: ${{ runner.temp }}/donut-e2e-*
+          path: ${{ runner.temp }}/donut-e2e-*/diagnostics/**
+          if-no-files-found: ignore
+          retention-days: 7
+
+  network:
+    name: Real proxy and local WireGuard browser traffic
+    if: ${{ inputs.smoke_only != true && (inputs.suite == '' || inputs.suite == 'full' || inputs.suite == 'network') }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout Donut Browser
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          path: donutbrowser
+          persist-credentials: false
+
+      - name: Checkout test driver
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: ${{ vars.TAURI_WEBDRIVER_REPOSITORY }}
+          token: ${{ secrets.TAURI_WEBDRIVER_TOKEN || github.token }}
+          path: tauri-cross-platform-webdriver
+          persist-credentials: false
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          run_install: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: donutbrowser/.node-version
+          cache: pnpm
+          cache-dependency-path: donutbrowser/pnpm-lock.yaml
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
+        with:
+          toolchain: stable
+
+      - name: Cache Rust dependencies
+        uses: swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          workspaces: |
+            donutbrowser/src-tauri -> target
+            donutbrowser/e2e/app -> target
+            tauri-cross-platform-webdriver -> target
+
+      - name: Install Tauri dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf libxdo-dev xvfb openvpn
+
+      - name: Install app dependencies
+        working-directory: donutbrowser
+        run: pnpm install --frozen-lockfile
+
+      - name: Run isolated real-network suite
+        working-directory: donutbrowser
+        env:
+          WAYFERN_TEST_TOKEN: ${{ secrets.WAYFERN_TEST_TOKEN }}
+          RESIDENTIAL_PROXY_URL_ONE_SOCKS: ${{ secrets.RESIDENTIAL_PROXY_URL_ONE_SOCKS }}
+          RESIDENTIAL_PROXY_URL_ONE_HTTP: ${{ secrets.RESIDENTIAL_PROXY_URL_ONE_HTTP }}
+        run: xvfb-run -a pnpm e2e:network
+
+      - name: Upload E2E diagnostics
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: app-e2e-network-linux
+          path: ${{ runner.temp }}/donut-e2e-*/diagnostics/**
           if-no-files-found: ignore
           retention-days: 7