test: stabilize live e2e auth retries

[yxzhaao]

Summary

Stabilize live CLI E2E execution against transient Lark API failures and OAuth rate limits. The shared harness now retries server-declared retryable errors, handles eventually consistent cleanup, runs only affected E2E domains, and reuses one tenant access token across all CLI subprocesses in a live test job.

Changes

• Make RunCmd automatically retry error envelopes that declare retryable: true, using bounded exponential backoff.
• Add bounded polling for eventually consistent cleanup checks and keep successful destructive cleanup from failing solely on delayed visibility.
• Resolve changed paths to affected CLI E2E domain packages, while falling back to the full suite for shared runtime or unmapped changes.
• Add a tested scripts/fetch_e2e_tat.js helper that retries the OAuth exchange, including aborted and incomplete HTTP responses, masks the resulting token, and writes it to a private temporary file.
• Pass only the temporary file path between CI steps, load the TAT inside the live E2E shell, and delete the file immediately after reading it.
• Run one lark-cli whoami --as bot preflight before the live suite to verify that the shared TAT resolves to a ready bot identity.
• Keep the app secret and TAT scoped to the CI steps that require them; expose UAT to the harness as TEST_USER_ACCESS_TOKEN and inject it only into requests with DefaultAs: "user".
• Let bot-backed live tests skip locally when TAT is absent without spawning a repeated whoami process at every test entry.
• Add workflow, retry, cleanup, domain-selection, token-fetch, interrupted-response, identity-isolation, and authentication-gate coverage.

Test Plan

• make script-test (110 tests)
• make quality-gate
• go test ./tests/cli_e2e/... -run '^$' -count=1
• Focused E2E harness tests for retry, identity isolation, and tenant-token readiness
• Real OAuth success-path verification with the shared E2E test account

Related Issues

• None

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Live E2E CI now provisions a shared Feishu tenant access token and exports CLI identity variables. A shared test helper verifies tenant authentication, while tenant-dependent workflows skip when credentials are unavailable.

Changes

Live E2E tenant authentication

Layer / File(s)	Summary
Shared live tenant token provisioning .github/workflows/ci.yml, scripts/ci-workflow.test.sh	The e2e-live job exports CLI identity values, retrieves and masks a tenant token with retries, writes it to GITHUB_ENV, and validates the workflow structure.
Tenant token verification helper tests/cli_e2e/core.go, tests/cli_e2e/core_test.go	SkipWithoutTenantAccessToken skips tests without a token and verifies bot authentication when a token exists; helper tests cover both paths.
Live E2E entry-point guards tests/cli_e2e/base/*, tests/cli_e2e/calendar/*, tests/cli_e2e/contact/*, tests/cli_e2e/docs/*, tests/cli_e2e/drive/*, tests/cli_e2e/im/*, tests/cli_e2e/markdown/*, tests/cli_e2e/sheets/*, tests/cli_e2e/task/*, tests/cli_e2e/wiki/*	Tenant-dependent workflows invoke the shared authentication guard before setup or CLI execution.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant FeishuOAuth
  participant LarkCLI
  participant LiveE2ETests
  GitHubActions->>FeishuOAuth: Request tenant token
  FeishuOAuth-->>GitHubActions: Return token
  GitHubActions->>LarkCLI: Export token and CLI identity
  LiveE2ETests->>LarkCLI: Verify bot authentication
  LarkCLI-->>LiveE2ETests: Return verified status
  LiveE2ETests->>LiveE2ETests: Run or skip workflow

Loading

Possibly related PRs

• larksuite/cli#236: Introduces the shared CLI E2E harness extended by this tenant-token guard.
• larksuite/cli#401: Adds E2E workflows updated here to require tenant authentication.
• larksuite/cli#1888: Directly overlaps with the e2e-live credential preparation and workflow assertions.

Suggested reviewers: liangshuo-1

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 45.83% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title matches the main change: stabilizing live E2E auth retries.
Description check	✅ Passed	The description follows the required template and covers summary, changes, test plan, and related issues.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/ci-workflow.test.sh`:
- Around line 312-324: Strengthen the workflow assertions in the test section
around the “Prepare shared live E2E tenant token” step: require the exact
LARKSUITE_CLI_BRAND: feishu environment entry and verify that
LARKSUITE_CLI_TENANT_ACCESS_TOKEN is written to GITHUB_ENV, not merely
referenced. Preserve the existing step-condition and job-scope checks.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bde452c3-4683-4681-a59f-0bed8ea40de3

📥 Commits

Reviewing files that changed from the base of the PR and between 64caef1 and a9e21a3.

📒 Files selected for processing (41)

• .github/workflows/ci.yml
• internal/client/api_errors.go
• internal/client/api_errors_test.go
• scripts/ci-workflow.test.sh
• tests/cli_e2e/base/base_basic_workflow_test.go
• tests/cli_e2e/base/base_role_workflow_test.go
• tests/cli_e2e/calendar/calendar_create_event_test.go
• tests/cli_e2e/calendar/calendar_manage_calendar_test.go
• tests/cli_e2e/calendar/calendar_rsvp_workflow_test.go
• tests/cli_e2e/calendar/calendar_update_event_test.go
• tests/cli_e2e/contact/contact_lookup_workflow_test.go
• tests/cli_e2e/core.go
• tests/cli_e2e/core_test.go
• tests/cli_e2e/docs/docs_create_fetch_test.go
• tests/cli_e2e/docs/docs_update_test.go
• tests/cli_e2e/drive/drive_add_comment_workflow_test.go
• tests/cli_e2e/drive/drive_duplicate_sync_workflow_test.go
• tests/cli_e2e/drive/drive_files_workflow_test.go
• tests/cli_e2e/drive/drive_preview_workflow_test.go
• tests/cli_e2e/drive/drive_status_workflow_test.go
• tests/cli_e2e/drive/drive_sync_workflow_test.go
• tests/cli_e2e/drive/drive_upload_workflow_test.go
• tests/cli_e2e/drive/drive_version_workflow_test.go
• tests/cli_e2e/im/chat_workflow_test.go
• tests/cli_e2e/im/message_forward_workflow_test.go
• tests/cli_e2e/im/message_reply_workflow_test.go
• tests/cli_e2e/markdown/markdown_workflow_test.go
• tests/cli_e2e/sheets/sheets_crud_workflow_test.go
• tests/cli_e2e/sheets/sheets_filter_workflow_test.go
• tests/cli_e2e/sheets/sheets_gridline_workflow_test.go
• tests/cli_e2e/sheets/sheets_sheet_shortcuts_workflow_test.go
• tests/cli_e2e/sheets/sheets_table_get_workflow_test.go
• tests/cli_e2e/sheets/sheets_table_put_typed_workflow_test.go
• tests/cli_e2e/sheets/sheets_workbook_import_workflow_test.go
• tests/cli_e2e/task/task_comment_workflow_test.go
• tests/cli_e2e/task/task_reminder_workflow_test.go
• tests/cli_e2e/task/task_status_workflow_test.go
• tests/cli_e2e/task/tasklist_add_task_workflow_test.go
• tests/cli_e2e/task/tasklist_workflow_test.go
• tests/cli_e2e/wiki/wiki_shortcut_workflow_test.go
• tests/cli_e2e/wiki/wiki_workflow_test.go

[github-actions]

🚀 PR Preview Install Guide

🧰 CLI update

npm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@b3d24733e9a8982bb983a874d82d6c3681e503db

🧩 Skill update

npx skills add yxzhaao/cli#fix/e2e-invalid-response-retry -y -g