feat(run): CLI-proxy integration for Terragrunt, plus an e2e tier and two credential fixes

.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
       - run: ruff format --check .
       - run: ruff check .
       - run: pylint tunstrap/
-      - run: vulture tunstrap/ vulture_whitelist.py
+      - run: vulture tunstrap/
       - run: mypy --strict tunstrap
       - name: combined unit + integration coverage gate
         run: |

.github/workflows/test.yml

@@ -32,7 +32,7 @@ jobs:
         run: pylint tunstrap/
       - name: vulture
         if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.13'
-        run: vulture tunstrap/ vulture_whitelist.py
+        run: vulture tunstrap/
       - name: mypy --strict
         run: mypy --strict tunstrap
       - name: pytest (unit)
@@ -84,6 +84,126 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
+  e2e:
+    # Real kind cluster + real OpenTofu providers through a real tunnel.
+    #
+    # A separate job, not part of `integration`: the integration marker's
+    # contract is "docker compose alone", while this needs kind, tofu, kubectl,
+    # a 1.45 GB node image and an external Docker network. Folding it in would
+    # break that contract and make every integration run pay ~90s of cluster
+    # setup.
+    #
+    # It produces NO coverage artifact and is deliberately absent from the
+    # `coverage` job's combine: that gate downloads exactly two artifacts and
+    # enforces --fail-under=80, and a third, slowest, most environment-sensitive
+    # input would let a cluster flake take the coverage gate down with it.
+    #
+    # If this proves flaky, demote it with `continue-on-error: true` here rather
+    # than by weakening any assertion in tests/e2e/.
+    runs-on: ubuntu-latest
+    # Bounds a hung `kind create`, a stuck image pull, or a wedged provider
+    # download. Realistic runtime is a few minutes (cluster create + provider
+    # downloads dominate; per-init registry version-resolution is the slowest
+    # step); this has carried a stale local number twice, so it is intentionally
+    # qualitative. 20 min is a comfortable multiple of that peak and well under
+    # the 360m Actions default a true hang would otherwise ride.
+    timeout-minutes: 20
+    needs: unit
+    env:
+      # Turns every "tool missing" skip in tests/e2e/rig.py::skip_or_fail into a
+      # failure. Without it a runner that lost `kind` between the install step
+      # and the test step would report a green job with most of the tier
+      # skipped - a cluster tier that silently stops running is worse than none.
+      TUNSTRAP_E2E_REQUIRE_ALL: "1"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[dev]"
+      - name: install kind
+        run: |
+          curl -fsSL -o ./kind https://kind.sigs.k8s.io/dl/v0.30.0/kind-linux-amd64
+          chmod +x ./kind
+          sudo mv ./kind /usr/local/bin/kind
+          kind version
+      - name: install kubectl
+        # Matched to kindest/node:v1.34.0, which tests/e2e/rig.py pins.
+        run: |
+          curl -fsSL -o ./kubectl https://dl.k8s.io/release/v1.34.0/bin/linux/amd64/kubectl
+          chmod +x ./kubectl
+          sudo mv ./kubectl /usr/local/bin/kubectl
+          kubectl version --client
+      - name: install terragrunt
+        # tests/e2e/test_recipe_terragrunt.py drives real `terragrunt hcl validate`
+        # and `terragrunt render` against the HCL pinned in docs/recipe_terragrunt.md.
+        # Pinned to 1.1.1 - the version the recipe's "Measured Terragrunt facts"
+        # section is measured against; the recipe's CLI vocabulary is
+        # version-specific (hcl validate / render / run --all).
+        run: |
+          curl -fsSL -o ./terragrunt https://github.com/gruntwork-io/terragrunt/releases/download/v1.1.1/terragrunt_linux_amd64
+          chmod +x ./terragrunt
+          sudo mv ./terragrunt /usr/local/bin/terragrunt
+          terragrunt --version
+      - uses: opentofu/setup-opentofu@v1
+        with:
+          tofu_version: 1.12.5
+          # MANDATORY. The action's default wrapper replaces `tofu` on PATH with
+          # a script that adds GitHub annotations to real tofu's output, and this
+          # tier asserts on that output. The real-tofu path lives in
+          # test_tofu_providers.py (init/plan/apply/destroy call `tofu` directly,
+          # or a recorder that execs it); test_shim.py is unaffected because it
+          # puts a fake `tofu` first on PATH, which shadows any wrapper.
+          tofu_wrapper: false
+      - run: docker compose version
+      - name: pytest (e2e)
+        run: pytest tests/e2e -m e2e -v --junitxml=e2e-results.xml
+      - name: require the whole tier to have run
+        # Second, independent guard. TUNSTRAP_E2E_REQUIRE_ALL covers a missing
+        # tool; this covers everything else that can quietly shrink the tier -
+        # a stray @pytest.mark.skip, a collection error swallowed by -k, a
+        # deleted module. stdlib only, exact numbers, no log scraping.
+        if: always()
+        run: |
+          python - <<'PY'
+          import xml.etree.ElementTree as ET
+
+          # pytest writes <testsuites><testsuite .../></testsuites>; accept both
+          # shapes so a pytest change cannot make this silently read zeros.
+          root = ET.parse("e2e-results.xml").getroot()
+          suite = root if root.tag == "testsuite" else root.find("testsuite")
+          assert suite is not None, "no <testsuite> element in the JUnit report"
+          counts = {k: int(suite.get(k, 0)) for k in ("tests", "skipped", "failures", "errors")}
+          print(counts)
+          assert counts["skipped"] == 0, "the e2e tier must never skip in CI"
+          assert counts["failures"] == 0 and counts["errors"] == 0
+          # Floor, not equality: adding tests must not require a CI edit, but
+          # losing them must fail. Kept as a hand-set literal deliberately: a
+          # number derived by collecting the suite would be computed from the
+          # same files pytest runs, so a deleted module shrinks the collected
+          # count and the JUnit `tests` count in lockstep and the guard would
+          # stay GREEN for exactly the deletion it exists to catch (proven
+          # tautological). Only an independent literal anchors against deletion;
+          # at 31 == the current tier it catches the loss of any one test. Bump
+          # to the new total whenever the tier grows. (Was 32; lowered to 31 by
+          # the tunstrap_tofu migration: retired 4 shell-shim-text/drift tests
+          # that the in-package proxy makes obsolete, added 3 proxy/install/gap-
+          # fix replacements, net -1. test_terragrunt_apply's pollution sub-check
+          # retired too - the proxy runs run in-process so the tunstrap-wrapper
+          # negative control no longer reaches the stream; purity is now proven
+          # by the byte-equality test. Raised back to 33 by the run_cmd follow-up:
+          # +1 test pinning the load-bearing `--terragrunt-quiet` run_cmd marker
+          # (proves the parse breaks with the marker removed) and +1 pinning the
+          # labelled shell-shim-alt alternative fence (sh -n + bypass smoke).)
+          # Raised to 34 by the inheritance follow-up: +1 test proving a unit that
+          # forgets `include "root"` is caught (apply fails at 127.0.0.1:0) AND
+          # distinguished from a forgotten-commands entry (TUNSTRAP_INPUT present
+          # vs absent) - after the rig stopped concatenating root+unit into one file.
+          assert counts["tests"] >= 34, f"expected at least 34 e2e tests, ran {counts['tests']}"
+          print("e2e tier ran in full")
+          PY
+
   coverage:
     runs-on: ubuntu-latest
     needs: integration

.gitignore

@@ -41,4 +41,12 @@ Thumbs.db
 # Integration test SSH keypair (generated per session)
 tests/integration/_keys/
 
+# E2E rig: own SSH keypair and the extracted in-node kubeconfig.
+# Both are generated per session by tests/e2e/conftest.py. The e2e tier
+# deliberately does not share tests/integration/_keys/, which is generated by
+# a fixture pytest never loads for tests/e2e and would be absent in a clean
+# checkout.
+tests/e2e/_keys/
+tests/e2e/_kube/
+
 /docs/artifacts/