From 4100b7e8ac05b9a654780458a49dbffff364a889 Mon Sep 17 00:00:00 2001
From: Daniel Zyto <daniel.zyto@handsontable.com>
Date: Thu, 20 Aug 2026 12:14:13 +0200
Subject: [PATCH] =?UTF-8?q?ci:=20two=20specs=20existed=20in=20no=20tier=20?=
 =?UTF-8?q?=E2=80=94=20wire=20them=20(DEV-2203=20final=20sweep)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The sign-off audit found preview-scheme.spec.ts (DEV-2561's live proof)
gated behind E2E_LIVE but absent from every e2e-live step list, and
session-abandoned-create.spec.ts (DEV-2567's leak regression) skipping
forever for want of an API base — the orphaned-gate anti-pattern
TESTING.md names, recurring days after it was written down. The scheme
spec joins the sandpack step; the leak spec joins the token-gated step
(its /api/admin reads need auth on prod) with E2E_API_BASE wired.
---
 .github/workflows/e2e-live.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/e2e-live.yml b/.github/workflows/e2e-live.yml
index b3833bd45..2272983f8 100644
--- a/.github/workflows/e2e-live.yml
+++ b/.github/workflows/e2e-live.yml
@@ -136,6 +136,7 @@ jobs:
           e2e/version-pinning.spec.ts
           e2e/share-view.spec.ts
           e2e/style-panel.spec.ts
+          e2e/preview-scheme.spec.ts
 
       # Container suites, one worker: each Tier-2 case holds a live-preview
       # container, prod caps those at 5 *globally* (Sandbox max_instances), and
@@ -174,10 +175,14 @@ jobs:
         if: ${{ !inputs.smoke && env.BASE_URL != '' }}
         env:
           E2E_BASE_URL: ${{ env.BASE_URL }}
+          # The session-leak spec (DEV-2567) drives the API directly and reads
+          # the auth-gated /api/admin/sessions listing, so it rides this
+          # token-gated step rather than the anonymous suites.
+          E2E_API_BASE: ${{ env.BASE_URL }}
           E2E_BROKER_TOKEN: ${{ secrets.E2E_BROKER_TOKEN }}
         run: |
           if [ -z "$E2E_BROKER_TOKEN" ]; then
-            echo "::notice::E2E_BROKER_TOKEN is not set — the authed share round-trip was skipped."
+            echo "::notice::E2E_BROKER_TOKEN is not set — the authed share round-trip and the session-leak spec were skipped."
             exit 0
           fi
           code=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $E2E_BROKER_TOKEN" \
@@ -192,7 +197,7 @@ jobs:
           # and this repo is public. No traces, no retries, and every artifact
           # of this step is scrubbed before the on-failure upload can see it.
           status=0
-          pnpm e2e e2e/share-create-live.spec.ts --workers=1 --retries=0 --trace off || status=$?
+          pnpm e2e e2e/share-create-live.spec.ts e2e/session-abandoned-create.spec.ts --workers=1 --retries=0 --trace off || status=$?
           rm -rf test-results playwright-report
           exit $status