feat(e2e): real-ddev e2e suite with golden-image cache + ddev-as-user security inventory

.github/workflows/e2e-ddev.yml

@@ -0,0 +1,66 @@
+name: e2e-ddev
+
+# Real-ddev e2e suite (tests/e2e/run-ddev.sh, docs/design/ddev-e2e-test.md).
+# MANUAL-ONLY for now: the maintainer validates runtime + duration on a real
+# runner first; a weekly schedule is the planned phase-3 follow-up (the
+# golden-image cache is a local-workspace concept — CI rebuilds warm every
+# run, see design doc §6 R6).
+#
+# Not part of the PR merge gate (e2e.yml keeps that job): this suite
+# downloads GBs of images and runs a real ddev project lifecycle.
+on:
+  workflow_dispatch:
+    inputs:
+      site_tier:
+        description: 'Also run the real-site tier (camino fixture, DD10-DD12)'
+        required: false
+        default: false
+        type: boolean
+      ddev_version:
+        description: 'Pin a ddev version (e.g. v1.25.3); empty = latest release'
+        required: false
+        default: ''
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: e2e-ddev-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  e2e-ddev:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v7
+      - name: Resolve opencode version
+        id: version
+        run: |
+          echo "OC_VERSION=$(curl -fsSL --retry 5 --retry-delay 10 --retry-all-errors --max-time 30 https://api.github.com/repos/anomalyco/opencode/releases/latest | sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p')" >> "$GITHUB_OUTPUT"
+      - name: Cache opencode binaries + installer (per version, shared with the other e2e jobs)
+        uses: actions/cache@v6
+        with:
+          path: tests/e2e/cache
+          key: opencode-e2e-latest${{ steps.version.outputs.OC_VERSION }}
+          restore-keys: |
+            opencode-e2e-latest-
+      - name: Run real-ddev E2E test
+        env:
+          E2E_DDEV_SITE: ${{ inputs.site_tier == true && 'camino' || '' }}
+          DDEV_VERSION: ${{ inputs.ddev_version }}
+        run: |
+          chmod +x ./tests/e2e/run.sh ./tests/e2e/run-docker-rootless.sh ./tests/e2e/run-ddev.sh ./tests/e2e/lib.sh ./tests/check-host.sh ./tests/test-wrapper-validation.sh ./tests/test-jsonc-parser.sh ./tests/test-git-config.sh ./tests/test-container-backend.sh ./tests/test-bypass-guard.sh ./tests/test-ddev-as-opencode.sh ./tests/test-ddev-migrate.sh ./tests/test-ddev-hosts.sh ./tests/test-mkcert-reuse.sh ./tests/test-wsl-exposure.sh ./tests/test-ui.sh ./tests/test-docs.sh ./tests/test-kit-cli.sh ./tests/test-project-paths.sh ./tests/test-workflows.sh ./tests/test-install-args.sh ./tests/test-kit-files.sh ./tests/test-uninstall.sh ./tests/test-status.sh ./tests/test-update-flags.sh ./tests/test-fs-baseline.sh \
+            ./files/config.sh ./files/update.sh ./files/install.sh ./files/uninstall.sh ./files/status.sh \
+            ./files/opencode-permissions-kit-lib/wrapper ./files/opencode-permissions-kit-lib/kit ./files/opencode-permissions-kit-lib/log.sh ./files/opencode-permissions-kit-lib/ui.sh ./files/opencode-permissions-kit-lib/shell-warn.sh ./files/opencode-permissions-kit-lib/setup-container-backend.sh ./files/opencode-permissions-kit-lib/bin/socket-check.sh ./files/opencode-permissions-kit-lib/ddev-as-opencode.sh ./files/opencode-permissions-kit-lib/ddev-handover.sh ./files/opencode-permissions-kit-lib/ddev-migrate.sh ./files/opencode-permissions-kit-lib/ddev-hosts.sh ./files/opencode-permissions-kit-lib/fs-baseline.sh ./files/opencode-permissions-kit-lib/bin/ddev-as-opencode
+          ./tests/e2e/run-ddev.sh
+      - name: Summary
+        if: always()
+        env:
+          E2E_DDEV_SITE: ${{ inputs.site_tier == true && 'camino' || '' }}
+          DDEV_VERSION: ${{ inputs.ddev_version }}
+        run: |
+          echo "### ddev-e2e (run-ddev.sh)" >> "$GITHUB_STEP_SUMMARY"
+          echo "- site tier: ${E2E_DDEV_SITE:-none}" >> "$GITHUB_STEP_SUMMARY"
+          echo "- ddev: ${DDEV_VERSION:-latest}" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/e2e.yml

@@ -54,7 +54,7 @@ jobs:
             opencode-e2e-old${{ steps.old.outputs.OLD_VERSION }}-
       - name: Run E2E test
         run: |
-          chmod +x ./tests/e2e/run.sh ./tests/e2e/run-docker-rootless.sh ./tests/e2e/lib.sh ./tests/check-host.sh ./tests/test-wrapper-validation.sh ./tests/test-jsonc-parser.sh ./tests/test-git-config.sh ./tests/test-container-backend.sh ./tests/test-bypass-guard.sh ./tests/test-ddev-as-opencode.sh ./tests/test-ddev-migrate.sh ./tests/test-ddev-hosts.sh ./tests/test-mkcert-reuse.sh ./tests/test-wsl-exposure.sh ./tests/test-ui.sh ./tests/test-docs.sh ./tests/test-kit-cli.sh ./tests/test-project-paths.sh ./tests/test-workflows.sh ./tests/test-install-args.sh ./tests/test-kit-files.sh ./tests/test-uninstall.sh ./tests/test-status.sh ./tests/test-update-flags.sh ./tests/test-fs-baseline.sh \
+          chmod +x ./tests/e2e/run.sh ./tests/e2e/run-docker-rootless.sh ./tests/e2e/run-ddev.sh ./tests/e2e/lib.sh ./tests/check-host.sh ./tests/test-wrapper-validation.sh ./tests/test-jsonc-parser.sh ./tests/test-git-config.sh ./tests/test-container-backend.sh ./tests/test-bypass-guard.sh ./tests/test-ddev-as-opencode.sh ./tests/test-ddev-migrate.sh ./tests/test-ddev-hosts.sh ./tests/test-mkcert-reuse.sh ./tests/test-wsl-exposure.sh ./tests/test-ui.sh ./tests/test-docs.sh ./tests/test-kit-cli.sh ./tests/test-project-paths.sh ./tests/test-workflows.sh ./tests/test-install-args.sh ./tests/test-kit-files.sh ./tests/test-uninstall.sh ./tests/test-status.sh ./tests/test-update-flags.sh ./tests/test-fs-baseline.sh \
             ./files/config.sh ./files/update.sh ./files/install.sh ./files/uninstall.sh ./files/status.sh \
             ./files/opencode-permissions-kit-lib/wrapper ./files/opencode-permissions-kit-lib/kit ./files/opencode-permissions-kit-lib/log.sh ./files/opencode-permissions-kit-lib/ui.sh ./files/opencode-permissions-kit-lib/shell-warn.sh ./files/opencode-permissions-kit-lib/setup-container-backend.sh ./files/opencode-permissions-kit-lib/bin/socket-check.sh ./files/opencode-permissions-kit-lib/ddev-as-opencode.sh ./files/opencode-permissions-kit-lib/ddev-handover.sh ./files/opencode-permissions-kit-lib/ddev-migrate.sh ./files/opencode-permissions-kit-lib/ddev-hosts.sh ./files/opencode-permissions-kit-lib/fs-baseline.sh ./files/opencode-permissions-kit-lib/bin/ddev-as-opencode
           ./tests/e2e/run.sh
@@ -83,7 +83,7 @@ jobs:
             opencode-e2e-old${{ steps.old.outputs.OLD_VERSION }}-
       - name: Run docker-rootless E2E test
         run: |
-          chmod +x ./tests/e2e/run.sh ./tests/e2e/run-docker-rootless.sh ./tests/e2e/lib.sh ./tests/check-host.sh ./tests/test-update-flags.sh \
+          chmod +x ./tests/e2e/run.sh ./tests/e2e/run-docker-rootless.sh ./tests/e2e/run-ddev.sh ./tests/e2e/lib.sh ./tests/check-host.sh ./tests/test-update-flags.sh \
             ./tests/test-wrapper-validation.sh ./tests/test-jsonc-parser.sh ./tests/test-git-config.sh ./tests/test-container-backend.sh ./tests/test-bypass-guard.sh ./tests/test-ddev-as-opencode.sh ./tests/test-ddev-migrate.sh ./tests/test-ddev-hosts.sh ./tests/test-mkcert-reuse.sh ./tests/test-wsl-exposure.sh ./tests/test-ui.sh ./tests/test-docs.sh ./tests/test-kit-cli.sh ./tests/test-project-paths.sh ./tests/test-workflows.sh ./tests/test-install-args.sh ./tests/test-kit-files.sh ./tests/test-uninstall.sh ./tests/test-status.sh ./tests/test-fs-baseline.sh \
             ./files/config.sh ./files/update.sh ./files/install.sh ./files/uninstall.sh ./files/status.sh \
             ./files/opencode-permissions-kit-lib/wrapper ./files/opencode-permissions-kit-lib/kit ./files/opencode-permissions-kit-lib/log.sh ./files/opencode-permissions-kit-lib/ui.sh ./files/opencode-permissions-kit-lib/shell-warn.sh ./files/opencode-permissions-kit-lib/setup-container-backend.sh ./files/opencode-permissions-kit-lib/bin/socket-check.sh ./files/opencode-permissions-kit-lib/ddev-as-opencode.sh ./files/opencode-permissions-kit-lib/ddev-handover.sh ./files/opencode-permissions-kit-lib/ddev-migrate.sh ./files/opencode-permissions-kit-lib/ddev-hosts.sh ./files/opencode-permissions-kit-lib/fs-baseline.sh ./files/opencode-permissions-kit-lib/bin/ddev-as-opencode

.github/workflows/test.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Check version consistency
         run: make check-version
       - name: Make scripts executable
-        run: chmod +x ./tests/test-ui.sh ./tests/test-wrapper-validation.sh ./tests/test-jsonc-parser.sh ./tests/test-git-config.sh ./tests/test-container-backend.sh ./tests/test-bypass-guard.sh ./tests/test-ddev-as-opencode.sh ./tests/test-ddev-migrate.sh ./tests/test-ddev-hosts.sh ./tests/test-mkcert-reuse.sh ./tests/test-wsl-exposure.sh ./tests/test-docs.sh ./tests/test-kit-cli.sh ./tests/test-project-paths.sh ./tests/test-workflows.sh ./tests/test-install-args.sh ./tests/test-kit-files.sh ./tests/test-uninstall.sh ./tests/test-status.sh ./tests/test-update-flags.sh ./tests/test-fs-baseline.sh ./tests/check-host.sh ./tests/e2e/run.sh ./tests/e2e/run-docker-rootless.sh ./tests/e2e/lib.sh ./files/config.sh ./files/update.sh ./files/install.sh ./files/uninstall.sh ./files/status.sh ./files/opencode-permissions-kit-lib/wrapper ./files/opencode-permissions-kit-lib/kit ./files/opencode-permissions-kit-lib/log.sh ./files/opencode-permissions-kit-lib/ui.sh ./files/opencode-permissions-kit-lib/shell-warn.sh ./files/opencode-permissions-kit-lib/setup-container-backend.sh ./files/opencode-permissions-kit-lib/bin/socket-check.sh ./files/opencode-permissions-kit-lib/ddev-as-opencode.sh ./files/opencode-permissions-kit-lib/ddev-handover.sh ./files/opencode-permissions-kit-lib/ddev-migrate.sh ./files/opencode-permissions-kit-lib/ddev-hosts.sh ./files/opencode-permissions-kit-lib/fs-baseline.sh ./files/opencode-permissions-kit-lib/bin/ddev-as-opencode
+        run: chmod +x ./tests/test-ui.sh ./tests/test-wrapper-validation.sh ./tests/test-jsonc-parser.sh ./tests/test-git-config.sh ./tests/test-container-backend.sh ./tests/test-bypass-guard.sh ./tests/test-ddev-as-opencode.sh ./tests/test-ddev-migrate.sh ./tests/test-ddev-hosts.sh ./tests/test-mkcert-reuse.sh ./tests/test-wsl-exposure.sh ./tests/test-docs.sh ./tests/test-kit-cli.sh ./tests/test-project-paths.sh ./tests/test-workflows.sh ./tests/test-install-args.sh ./tests/test-kit-files.sh ./tests/test-uninstall.sh ./tests/test-status.sh ./tests/test-update-flags.sh ./tests/test-fs-baseline.sh ./tests/check-host.sh ./tests/e2e/run.sh ./tests/e2e/run-docker-rootless.sh ./tests/e2e/run-ddev.sh ./tests/e2e/lib.sh ./files/config.sh ./files/update.sh ./files/install.sh ./files/uninstall.sh ./files/status.sh ./files/opencode-permissions-kit-lib/wrapper ./files/opencode-permissions-kit-lib/kit ./files/opencode-permissions-kit-lib/log.sh ./files/opencode-permissions-kit-lib/ui.sh ./files/opencode-permissions-kit-lib/shell-warn.sh ./files/opencode-permissions-kit-lib/setup-container-backend.sh ./files/opencode-permissions-kit-lib/bin/socket-check.sh ./files/opencode-permissions-kit-lib/ddev-as-opencode.sh ./files/opencode-permissions-kit-lib/ddev-handover.sh ./files/opencode-permissions-kit-lib/ddev-migrate.sh ./files/opencode-permissions-kit-lib/ddev-hosts.sh ./files/opencode-permissions-kit-lib/fs-baseline.sh ./files/opencode-permissions-kit-lib/bin/ddev-as-opencode
       - name: Install shellcheck
         run: sudo apt-get update -qq && sudo apt-get install -y shellcheck
       - name: Check contributor host tools

Makefile

@@ -1,4 +1,4 @@
-.PHONY: help test lint check-host test-wrapper test-fs-baseline test-parser test-git-config test-container-backend test-bypass-guard test-ddev-as-opencode test-ddev-migrate test-ddev-hosts test-mkcert-reuse test-wsl-exposure test-ui test-kit-cli test-project-paths test-workflows test-docs test-install-args test-kit-files test-uninstall test-status test-update-flags e2e e2e-rootless e2e-all install-dev clean version check-version
+.PHONY: help test lint check-host test-wrapper test-fs-baseline test-parser test-git-config test-container-backend test-bypass-guard test-ddev-as-opencode test-ddev-migrate test-ddev-hosts test-mkcert-reuse test-wsl-exposure test-ui test-kit-cli test-project-paths test-workflows test-docs test-install-args test-kit-files test-uninstall test-status test-update-flags e2e e2e-rootless e2e-ddev e2e-ddev-fresh e2e-all install-dev clean version check-version
 
 # Scripts checked by `make lint` (everything shipped in files/).
 SHELLCHECK_FILES = files/install.sh files/config.sh files/update.sh files/status.sh files/uninstall.sh files/umask.sh \
@@ -49,6 +49,9 @@ help:
 	@echo "  make e2e           Run end-to-end test (Docker required)"
 	@echo "  make e2e-rootless   Run docker-rootless daemon end-to-end test (Docker + systemd-in-container required; skips if unavailable)"
 	@echo "  make e2e-rootless ARGS=--debug   Same, keep the container on failure + dump daemon logs"
+	@echo "  make e2e-ddev       Run the real-ddev e2e suite (golden-image cache; first run builds it, see docs/design/ddev-e2e-test.md)"
+	@echo "  make e2e-ddev ARGS='--fresh'     Force a golden-image rebuild (new ddev version, recipe bump)"
+	@echo "  make e2e-ddev-fresh Same as e2e-ddev ARGS=--fresh"
 	@echo "  make e2e-all        Run both e2e suites"
 	@echo "  make install-dev   Quick dev install (skip prompts)"
 	@echo "  make clean         Uninstall"
@@ -130,6 +133,12 @@ e2e:
 e2e-rootless:
 	@sh ./tests/e2e/run-docker-rootless.sh $(if $(ARGS),$(ARGS))
 
+e2e-ddev:
+	@sh ./tests/e2e/run-ddev.sh $(if $(ARGS),$(ARGS))
+
+e2e-ddev-fresh:
+	@sh ./tests/e2e/run-ddev.sh --fresh
+
 e2e-all: e2e e2e-rootless
 
 install-dev: