Run release UI e2e against a selected local-ydb version

[astandrik]

GitHub-only stage of #2383: run the existing UI e2e suite against a published local-ydb release selected by tag.

The workflow resolves local-ydb tag → YDB SHA → embedded UI version → UI SHA. Frontend sources, tests, snapshots and lockfile all come from that UI SHA. Playwright starts the frontend with npm start; the selected local-ydb image supplies the backend.

Manual GitHub runs require only ydb_tag; ydb_sha is optional and validates the expected YDB commit when supplied. Keep eight shards, Chromium and WebKit, zero retries, image digest/revision checks, isolated execution, HTML/JSON reports, failure diagnostics and container cleanup.

Implementation: #4363 and #4372 merged on 2026-09-18; #4376 merged on 2026-09-22 at c8ff028effe29c796bd1a29e926b4b994129d8b3.

Acceptance audit — 2026-09-23

• Merge fix(ci): run release ui from sources against local-ydb #4376.
• Run release-e2e.yml from main with only ydb_tag=26.2.1.14. The resolver log has YDB_TAG=26.2.1.14 and an empty YDB_SHA.
• Confirm UI 15.6.0-hotfix.1, UI/test SHA 85e1e1d44e7df6b0f69b4a81e92d2336fb809941, and frontend_mode: npm-start. Recorded backend image digest: sha256:9e46fd45875551a75bcf34d0bb9ca0baa1d8763a4ccf2070af45f4467c4b7402; image verification succeeded in all eight shards.
• Account for all 672 tests: 336 Chromium + 336 Safari/WebKit cases across all eight executed shards. Every shard command used --retries=0.
• Verify complete HTML/JSON reports and failure attachments. HTML and JSON totals agree; all four failures have an existing screenshot, video, context and trace in the merged HTML report (16/16 attachment files).
• Verify failure handling: the exact controller's report validator marks the actual run failed, a successful complete control passed, and missing shards/reports/provenance, unstarted jobs, failed merge/sanitization, zero executions and outside-test errors incomplete.
• Record run results and classify scenario failures/skips separately, below.
• Confirm actual cleanup of action-created Docker resources, including after failed shards: verified in run 35839092981.

Run results

Run	Release	Passed	Failed	Skipped	Result
35725732960	26.2.1.14	667	2	3	failure
35729238809	26.2.1.14	665	4	3	failure

The second run is the detailed acceptance evidence. Its release-e2e-report artifact contains both reports and attachments. There are no outside-test errors and no retry attempts. A later 26.3.1.16 run also failed; it is not used as acceptance evidence for the required 26.2.1.14 run.

Scenario follow-ups do not block infrastructure acceptance:

• test: stabilize release WebKit readiness checks #4394 — timing-sensitive Bridge/Storage usage readiness checks. The failing set differs between the two runs; the second run's post-timeout snapshots contain the expected UI. The underlying async cause is not yet proven. Historical chore: flapping test #4003/chore: stabilize storage usage e2e #4007 and current-main waits are references, not proof that the selected release tests are fixed.
• test: port hotkeys checks to release-compatible e2e #4395 — the historical Ctrl+K-only WebKit test fails in both runs; current main already has a broader shortcut helper. Verify and port compatible test coverage rather than claiming a current UI regression.

All three skips are explicit historical Safari exclusions with the annotation Clipboard API not fully supported in Safari: the query-table share-link case, CopyResult clipboard case, and query-editor copy-result case. They are not missing shards or silently unstarted tests. They remain visible in the totals.

Historical cleanup evidence gap — resolved

cleanup: true was passed and all eight Post Start release local-ydb steps returned success. Playwright containers use docker run --rm. However, the pinned setup action ignores removal failures, its post handler catches errors, and the logs contain no post-deletion resource readback.

A local isolated check of the exact bundled post action used a fake Docker executable (no real Docker resources): whether all three removal commands returned 0 or all returned 1, the post process returned 0 without output. This demonstrates an observability/verification gap, not an observed leak in the CI run.

This gap is resolved by the merged action and the post-merge acceptance evidence below. The earlier successful post-step alone was not treated as proof of resource removal.

#4390's optional separate test revision is a follow-up extension, not a prerequisite for this infrastructure acceptance. Arcadia release integration remains the next separate sub-issue; this task does not change Arcadia or release acceptance dependencies.

Cleanup implementation — 2026-09-23

• astandrik/setup-local-ydb#6 is merged at ba59d49d74fdab2f308132e72da6d4e111b7200d. It verifies exact resource removal, preserves errors while continuing cleanup, validates the full auth-directory path, and reports results in post-step logs and Job Summary.
• Action CI passed 42 tests and all four root/tenant × auth Docker smoke configurations, including bundled-post cleanup, idempotency, busy-volume failure and recovery. The merged tree equals the tested head.
• UI integration is in fix(ci): verify local-ydb cleanup in release e2e #4396: pinned action SHA plus report contracts for failed/cancelled post-cleanup jobs; the aggregator implementation is unchanged. Required CI checks, embedded/package builds and the report Docker smoke passed. All PR checks passed, including all eight Playwright shards and Greptile. The standard PR suite reported 1234 passed, 2 flaky and 0 failed; fix(ci): verify local-ydb cleanup in release e2e #4396 is now merged.
• fix(ci): verify local-ydb cleanup in release e2e #4396 merged at 092108eba90990d58ea0ee6211eb91088dbe03de. The new tag-only acceptance run below supplies the required cleanup evidence; historical runs were not reused as proof.

Final GitHub-only acceptance — passed, 2026-09-23

Release run 35839092981 executed from merged main (092108eba90990d58ea0ee6211eb91088dbe03de) with only ydb_tag=26.2.1.14; ydb_sha was empty. The workflow pins the verified action commit ba59d49d74fdab2f308132e72da6d4e111b7200d (also tagged v1.1.1).

• Provenance matches UI 15.6.0-hotfix.1, UI/test SHA 85e1e1d44e7df6b0f69b4a81e92d2336fb809941, npm-start, YDB SHA 1bd0f9c372384549fe4ff21c29f44609a20f5450, and the previously recorded image digest.
• All 672 unique cases are accounted for: 665 passed, 4 failed, 3 skipped, 0 flaky, with 336 Chromium and 336 Safari/WebKit cases and no retries. The three skips retain their explicit historical Clipboard API annotations.
• HTML and JSON totals agree, there are no outside-test errors, and all 16 failure attachments exist (screenshot, video, error context and trace for each failed case). All eight shards ran; report preparation/collection/merge/upload completed. The report's only failed step is the result summary, correctly preserving the four scenario failures.
• Cleanup verified in 8/8 shards, including failed-test shards 2, 5 and 8: every exact static container, network and volume is recorded as removed (24 Docker resources), and each auth directory is removed or already absent. All eight post-cleanup steps succeeded; acceptance used the per-resource readback rows, not only their exit status.

The workflow remains failure because scenario assertions failed. Those are tracked separately: #4394 (Bridge readiness; Storage scenarios passed in this run), #4395 (Ctrl+K), #4398 (Access owner-card timeout with empty main content), and #4399 (mocked streaming status observation missing Running). The last two passed in both prior same-revision runs; their precise causes are not claimed proven.

The GitHub-only runner/reporting/cleanup scope is accepted and this issue can be closed. Scenario fixes, #4390 and Arcadia integration remain separate.

[astandrik]

Post-merge acceptance of #4401 completed on main 71b800f1d788ce7cbb339984ee3541999026ea18: run 35860159544, dispatched with only ydb_tag=26.2.1.14.

• Release identity is unchanged: UI/tests 15.6.0-hotfix.1 at 85e1e1d44e7df6b0f69b4a81e92d2336fb809941, YDB 1bd0f9c372384549fe4ff21c29f44609a20f5450, the same image digest, npm-start, and Playwright 1.58.0.
• The inventory exactly matches the previous acceptance run: 672 unique cases, 336 Chromium + 336 Safari/WebKit. Results: 662 passed, 5 flaky, 2 failed, 3 skipped. The three historical Clipboard API skips are unchanged.
• All eight shard commands use --retries=2. Five cases recovered after one or two retries. Ctrl+K and Storage usage expanded state both exhausted all three attempts and remain failed; the aggregate correctly remains failure.
• HTML and JSON totals agree; there are no outside-test errors. All 52 attachment references resolve to nonempty files (43 distinct files after report deduplication): screenshot, video, error context and trace for each of the 13 failed attempts, including attempts of recovered tests.
• Cleanup readback confirms all 24 exact Docker resources removed and all eight auth directories absent. This includes failed-test shards 5 and 6. Report collection, merge, sanitization and upload succeeded; only the final result assertion fails, as intended.

Shard	Cleanup evidence in post-step log / Job Summary
1	Verified
2	Verified
3	Verified
4	Verified
5	Verified
6	Verified
7	Verified
8	Verified

The retry/report/cleanup infrastructure acceptance is complete; the release suite is not green. Remaining final failures belong to #4395 (Ctrl+K) and #4394 (Storage usage). Bridge and Access passed on the first attempt in this run; streaming status recovered on retry, which does not establish a fix for #4399. Two Chromium resource-pool settings cases also recovered and remain visible as flaky.

The earlier zero-retry acceptance remains historical evidence. This follow-up records the explicitly requested retry policy from #4401. #4390 (optional separate test revision) and Arcadia integration remain separate work; this issue remains closed for its accepted GitHub infrastructure scope.