ci: add scheduled public API e2e tests (CM-968)

[skwowet]

Summary

Adds a scheduled Public API e2e suite against the dedicated api-e2e stack (crowd_api_e2e), so we can catch contract regressions on main without hand-running against shared staging.

Changes

• Add .github/scripts/public-api-e2e-tests.sh (HTTP seed + resource suites)
• Add .github/workflows/api-e2e-tests.yml (deploy api-e2e from main, then run the suite)
• Register api-e2e in scripts/builders/backend.env
• Document architecture and suite design in ADR-0012 / ADR-0013

[Copilot]

Pull request overview

Adds scheduled Public API end-to-end regression testing against the isolated api-e2e deployment.

Changes:

• Adds the scheduled deployment and test workflow.
• Adds HTTP-based fixture seeding and resource suites.
• Registers and documents the new e2e architecture.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
.github/scripts/public-api-e2e-tests.sh	Implements the Public API test suite.
.github/workflows/api-e2e-tests.yml	Deploys and tests api-e2e nightly.
scripts/builders/backend.env	Maps api-e2e to the backend image.
docs/adr/0011-api-e2e-test-architecture.md	Documents runtime and isolation decisions.
docs/adr/0012-api-e2e-test-suite-design.md	Documents suite organization.
docs/adr/README.md	Indexes the new ADRs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

.github/scripts/public-api-e2e-tests.sh:113

• The Auth0 request is also unbounded, so a stalled token endpoint can consume the entire 90-minute job timeout before any test runs. Give this curl call a short connect and total timeout as well.

  response="$(curl -sS -X POST "${AUTH0_STAGING_ISSUER}/oauth/token" \

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

.github/workflows/api-e2e-tests.yml:78

• A job-level timeout cancels the whole e2e-tests job, so this later step is never reached when the 90-minute limit is hit. That leaves a hung build/deploy/test without the Slack alert promised by the ADR. Move notification into a separate job that needs: e2e-tests and runs when always() && needs.e2e-tests.result != 'success', so failures and timeouts are both reported.

        if: failure()

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (4)

.github/scripts/public-api-e2e-tests.sh:290

• This extraction can abort the script after the preceding soft check records a failure: with set -e, invalid or empty response JSON makes the assignment return nonzero. Keep extraction non-fatal so later identity cases still run and the final failure count is reported.

  identity_id="$(jq -r '.id' <<<"$BODY")"

.github/scripts/public-api-e2e-tests.sh:341

• A non-JSON failure response here bypasses the suite’s soft-check behavior because this jq assignment exits nonzero under set -e. Make the ID extraction tolerant; subsequent requests will then be counted as failures instead of terminating the run.

  acme_we="$(jq -r '.id' <<<"$BODY")"

.github/scripts/public-api-e2e-tests.sh:354

• This unguarded ID extraction can terminate the suite after a soft check failure when the response body is empty or not JSON. Guard jq so the remaining work-experience cases and final summary still execute.

  globex_we="$(jq -r '.id' <<<"$BODY")"

.github/scripts/public-api-e2e-tests.sh:431

• Because the preceding status assertion is soft, a malformed failure body should not make this jq assignment abort the whole script under set -e. Use tolerant extraction so the DELETE/GET cases record failures and the run prints its aggregate result.

  doomed_we="$(jq -r '.id' <<<"$BODY")"

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.