From facdf5ec5051cdbc987ea9ade1aeae3e1483e5a7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 7 Jun 2026 21:50:53 -0700
Subject: [PATCH 1/9] Bump actions/upload-artifact from 4 to 7 (#392)

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/package.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index 2aea8b0b..2472dcb1 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -98,7 +98,7 @@ jobs:
 
 
     - name: Upload build artifact for ${{ matrix.TARGET }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: tabcmd-${{ matrix.TARGET }}
         path: ./dist/${{ matrix.TARGET }}/${{ matrix.UPLOAD_FILE_NAME }}

From ed69d21125664a337b4ef9b4103efcd458e371e0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 25 Jun 2026 19:21:37 -0700
Subject: [PATCH 2/9] Bump actions/checkout from 6 to 7 (#394)

Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/check-coverage.yml    | 2 +-
 .github/workflows/codeql-analysis.yml   | 2 +-
 .github/workflows/generate-metadata.yml | 2 +-
 .github/workflows/package.yml           | 2 +-
 .github/workflows/publish-pypi.yml      | 2 +-
 .github/workflows/run-e2-tests.yml      | 2 +-
 .github/workflows/run-tests.yml         | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/check-coverage.yml b/.github/workflows/check-coverage.yml
index e55838ed..e910a675 100644
--- a/.github/workflows/check-coverage.yml
+++ b/.github/workflows/check-coverage.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }}
       uses: actions/setup-python@v6
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 5a337908..669a3240 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -38,7 +38,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/generate-metadata.yml b/.github/workflows/generate-metadata.yml
index 8b47b312..4bf2d6bf 100644
--- a/.github/workflows/generate-metadata.yml
+++ b/.github/workflows/generate-metadata.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Set up Python
       uses: actions/setup-python@v6
diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index 2472dcb1..ba6c9fcc 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -61,7 +61,7 @@ jobs:
             UPLOAD_FILE_NAME: tabcmd
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - uses: actions/setup-python@v6
       with:
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 5f5d84bd..2c5b95c1 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -15,7 +15,7 @@ jobs:
     name: Build dist files for PyPi
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - uses: actions/setup-python@v6
diff --git a/.github/workflows/run-e2-tests.yml b/.github/workflows/run-e2-tests.yml
index e16e58fa..893232c2 100644
--- a/.github/workflows/run-e2-tests.yml
+++ b/.github/workflows/run-e2-tests.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }}
       uses: actions/setup-python@v6
diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index 68434d9a..31b205df 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }}
       uses: actions/setup-python@v6

From 2b233572c9c6ac198d8bf9bf819240300cd39971 Mon Sep 17 00:00:00 2001
From: Jac Fitzgerald <jac.fitzgerald@salesforce.com>
Date: Thu, 2 Jul 2026 10:12:35 -0700
Subject: [PATCH 3/9] ci: automate release pipeline

- release-on-merge.yml: on push to main, auto-computes next patch
  version, pushes the git tag (which triggers package.yml to build
  binaries), and creates a draft GitHub release with auto-generated
  notes for human review before publishing
- publish-pypi.yml: add release:published trigger so clicking
  "Publish release" in GitHub UI automatically uploads to PyPI;
  fix is_draft conditionals to work when triggered without inputs
- run-e2-tests.yml: add workflow_call interface (inputs + secrets)
  so the e2e suite can be called from other workflows; move
  credentials to env vars to avoid shell injection
- online_tests.py: set site_admin=False to match actual account
  permissions; add skip guard on test_delete_extract (requires
  extract encryption, not available on this site)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/publish-pypi.yml     |  6 ++-
 .github/workflows/release-on-merge.yml | 60 ++++++++++++++++++++++++++
 .github/workflows/run-e2-tests.yml     | 23 +++++++++-
 tests/e2e/online_tests.py              |  4 +-
 4 files changed, 88 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/release-on-merge.yml

diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 5f5d84bd..44bd3e7b 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -9,6 +9,8 @@ on:
         type: boolean
   push:
     tags: 'pypi'
+  release:
+    types: [published]
 
 jobs:
   build-n-publish:
@@ -32,13 +34,13 @@ jobs:
           python -m build
           
       - name: Publish distribution 📦 to Test PyPI
-        if: ${{ inputs.is_draft }}
+        if: ${{ inputs.is_draft == true }}
         uses: pypa/gh-action-pypi-publish@release/v1  # license BSD-2
         with:
           password: ${{ secrets.TEST_PYPI_API_TOKEN }}
           repository_url: https://test.pypi.org/legacy/
       - name: Publish distribution 📦 to PyPI
-        if: ${{ !inputs.is_draft }}
+        if: ${{ inputs.is_draft != true }}
         uses: pypa/gh-action-pypi-publish@release/v1  # license BSD-2
         with:
           password: ${{ secrets.PYPI_API_TOKEN }}
diff --git a/.github/workflows/release-on-merge.yml b/.github/workflows/release-on-merge.yml
new file mode 100644
index 00000000..aaf9c17a
--- /dev/null
+++ b/.github/workflows/release-on-merge.yml
@@ -0,0 +1,60 @@
+name: Draft release on merge to main
+
+# Triggers when a PR is merged into main (push to main covers all merge strategies).
+# Creates a draft GitHub release with auto-generated notes and pushes the version tag.
+# The tag push triggers package.yml to build and attach binaries.
+# When you publish the draft release, publish-pypi.yml uploads to PyPI automatically.
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+
+jobs:
+  draft-release:
+    name: Create draft release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Compute next patch version
+        id: version
+        run: |
+          LAST_TAG=$(git tag --list 'v*.*.*' --sort=-version:refname | head -1)
+          if [ -z "$LAST_TAG" ]; then
+            NEXT="v2.0.1"
+          else
+            BASE="${LAST_TAG#v}"
+            MAJOR=$(echo "$BASE" | cut -d. -f1)
+            MINOR=$(echo "$BASE" | cut -d. -f2)
+            PATCH=$(echo "$BASE" | cut -d. -f3)
+            NEXT="v${MAJOR}.${MINOR}.$((PATCH + 1))"
+          fi
+          echo "tag=$NEXT" >> "$GITHUB_OUTPUT"
+          echo "last_tag=$LAST_TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Push version tag
+        env:
+          TAG: ${{ steps.version.outputs.tag }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag "$TAG"
+          git push origin "$TAG"
+
+      - name: Create draft release with auto-generated notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ steps.version.outputs.tag }}
+          LAST_TAG: ${{ steps.version.outputs.last_tag }}
+        run: |
+          gh release create "$TAG" \
+            --draft \
+            --title "$TAG" \
+            --generate-notes \
+            --notes-start-tag "$LAST_TAG"
diff --git a/.github/workflows/run-e2-tests.yml b/.github/workflows/run-e2-tests.yml
index e16e58fa..1bc63ace 100644
--- a/.github/workflows/run-e2-tests.yml
+++ b/.github/workflows/run-e2-tests.yml
@@ -11,6 +11,20 @@ on:
         required: true
       pat:
         required: true
+  workflow_call:
+    inputs:
+      server:
+        required: true
+        type: string
+      site:
+        required: true
+        type: string
+      patname:
+        required: true
+        type: string
+    secrets:
+      pat:
+        required: true
 
 jobs:
   build:
@@ -42,6 +56,11 @@ jobs:
         pip install .[test]
 
     - name: Run e2e tests
-      run: | 
-        python -m tabcmd login --server "${{ github.event.inputs.server }}" --site "${{ github.event.inputs.site }}" --token-name "${{ github.event.inputs.patname }}" --token-value "${{ github.event.inputs.pat }}"
+      env:
+        E2E_SERVER: ${{ inputs.server }}
+        E2E_SITE: ${{ inputs.site }}
+        E2E_PATNAME: ${{ inputs.patname }}
+        E2E_PAT: ${{ secrets.pat || inputs.pat }}
+      run: |
+        python -m tabcmd login --server "$E2E_SERVER" --site "$E2E_SITE" --token-name "$E2E_PATNAME" --token-value "$E2E_PAT"
         pytest -q tests/e2e/online_tests.py -r pfE
diff --git a/tests/e2e/online_tests.py b/tests/e2e/online_tests.py
index 226fbf72..a0d48e18 100644
--- a/tests/e2e/online_tests.py
+++ b/tests/e2e/online_tests.py
@@ -26,7 +26,7 @@
 indexing_sleep_time = 1  # wait 1 second to confirm server has indexed updates
 # Flags to let us skip tests if we know we don't have the required access
 server_admin = False
-site_admin = True
+site_admin = False
 project_admin = False
 extract_encryption_enabled = False
 use_tabcmd_classic = False  # toggle between testing using tabcmd 2 or tabcmd classic
@@ -486,6 +486,8 @@ def test_refresh_ds_extract(self):
 
     @pytest.mark.order(14)
     def test_delete_extract(self):
+        if not extract_encryption_enabled:
+            pytest.skip("delete-extract requires extract encryption to be enabled on the site")
         name_on_server = TestAssets.get_publishable_name(TestAssets.TDSX_FILE_WITH_EXTRACT)
         TabcmdCall._delete_extract(name_on_server, "-d")
 

From ba5346ff23065a1e3184cd9f479906c916ef1075 Mon Sep 17 00:00:00 2001
From: Jac Fitzgerald <jac.fitzgerald@salesforce.com>
Date: Thu, 2 Jul 2026 11:38:14 -0700
Subject: [PATCH 4/9] ci: remove promote:true from package.yml to preserve
 draft state

Binaries are now uploaded to the draft release created by
release-on-merge.yml without auto-publishing it. Release stays draft
until manually published, which then triggers PyPI upload.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/package.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index 2aea8b0b..b7a6dca5 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -112,4 +112,3 @@ jobs:
         file: ./dist/${{ matrix.TARGET }}/${{ matrix.UPLOAD_FILE_NAME }}
         tag: ${{ github.ref_name }}
         overwrite: true
-        promote: true

From 9ffd5b743e851d15175b6760d5ce6566ce78adf7 Mon Sep 17 00:00:00 2001
From: Jac Fitzgerald <jac.fitzgerald@salesforce.com>
Date: Thu, 2 Jul 2026 13:18:10 -0700
Subject: [PATCH 5/9] ci: address OSS security review findings

- publish-pypi.yml: remove dead `push: tags: 'pypi'` trigger (secret
  publish path bypassing the draft-release gate); make publish
  conditionals explicit using github.event_name so the trigger surface
  is unambiguous rather than relying on null coercion
- release-on-merge.yml: filter tags to strict semver regex before
  sorting (prevents arithmetic failure on malformed tags); fail loudly
  if no prior tag exists instead of silently defaulting to v2.0.1;
  align checkout to actions/checkout@v7
- online_tests.py: suppress argv printing when login args (including
  PAT token) are present, preventing credential leak in CI logs

Tracking: #417 (PyPI trusted publishing / OIDC)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/publish-pypi.yml     |  6 ++----
 .github/workflows/release-on-merge.yml | 18 +++++++++---------
 tests/e2e/online_tests.py              |  4 +++-
 3 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 10c61555..5f06e8aa 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -7,8 +7,6 @@ on:
         description: 'Test PyPi'
         required: true
         type: boolean
-  push:
-    tags: 'pypi'
   release:
     types: [published]
 
@@ -34,13 +32,13 @@ jobs:
           python -m build
           
       - name: Publish distribution 📦 to Test PyPI
-        if: ${{ inputs.is_draft == true }}
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.is_draft == true }}
         uses: pypa/gh-action-pypi-publish@release/v1  # license BSD-2
         with:
           password: ${{ secrets.TEST_PYPI_API_TOKEN }}
           repository_url: https://test.pypi.org/legacy/
       - name: Publish distribution 📦 to PyPI
-        if: ${{ inputs.is_draft != true }}
+        if: ${{ github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.is_draft != true) }}
         uses: pypa/gh-action-pypi-publish@release/v1  # license BSD-2
         with:
           password: ${{ secrets.PYPI_API_TOKEN }}
diff --git a/.github/workflows/release-on-merge.yml b/.github/workflows/release-on-merge.yml
index aaf9c17a..28c3dff1 100644
--- a/.github/workflows/release-on-merge.yml
+++ b/.github/workflows/release-on-merge.yml
@@ -18,23 +18,23 @@ jobs:
     name: Create draft release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Compute next patch version
         id: version
         run: |
-          LAST_TAG=$(git tag --list 'v*.*.*' --sort=-version:refname | head -1)
+          LAST_TAG=$(git tag --list | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -1)
           if [ -z "$LAST_TAG" ]; then
-            NEXT="v2.0.1"
-          else
-            BASE="${LAST_TAG#v}"
-            MAJOR=$(echo "$BASE" | cut -d. -f1)
-            MINOR=$(echo "$BASE" | cut -d. -f2)
-            PATCH=$(echo "$BASE" | cut -d. -f3)
-            NEXT="v${MAJOR}.${MINOR}.$((PATCH + 1))"
+            echo "No prior semver tag found; cannot auto-increment version." >&2
+            exit 1
           fi
+          BASE="${LAST_TAG#v}"
+          MAJOR=$(echo "$BASE" | cut -d. -f1)
+          MINOR=$(echo "$BASE" | cut -d. -f2)
+          PATCH=$(echo "$BASE" | cut -d. -f3)
+          NEXT="v${MAJOR}.${MINOR}.$((PATCH + 1))"
           echo "tag=$NEXT" >> "$GITHUB_OUTPUT"
           echo "last_tag=$LAST_TAG" >> "$GITHUB_OUTPUT"
 
diff --git a/tests/e2e/online_tests.py b/tests/e2e/online_tests.py
index a0d48e18..5794ed1d 100644
--- a/tests/e2e/online_tests.py
+++ b/tests/e2e/online_tests.py
@@ -86,7 +86,9 @@ def _test_command(test_args: list[str]):
             + test_args
             + ["--no-certcheck"]
         )
-    if database_password not in calling_args:
+    login_args = setup_e2e.get_login_args()
+    safe_to_print = not any(v in calling_args for v in login_args if v not in ("--server", "--site", "--token-name"))
+    if safe_to_print:
         print(calling_args)
     return subprocess.check_call(calling_args)
 

From 1029f247015337f37543bc641c46659f2b270c7a Mon Sep 17 00:00:00 2001
From: Jac Fitzgerald <jac.fitzgerald@salesforce.com>
Date: Thu, 2 Jul 2026 13:21:46 -0700
Subject: [PATCH 6/9] ci: allow coverage comment step to fail on fork PRs

MishaKav/pytest-coverage-comment@main updated and now fails with
permission denied on fork PRs (GITHUB_TOKEN is read-only for pull_request
events from forks). Coverage is still collected and reported; only the
PR comment step fails. Mark it continue-on-error so CI stays green.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/check-coverage.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/check-coverage.yml b/.github/workflows/check-coverage.yml
index e910a675..efd2f6e6 100644
--- a/.github/workflows/check-coverage.yml
+++ b/.github/workflows/check-coverage.yml
@@ -46,6 +46,7 @@ jobs:
 
     - name: Comment on pull request with coverage
       uses: MishaKav/pytest-coverage-comment@main
+      continue-on-error: true
       with:
         pytest-coverage-path: ./pytest-coverage.txt
         # TODO: check if this has been fixed

From e4de12c91d91b07c2b775b9efbb8e55d5aeff4d0 Mon Sep 17 00:00:00 2001
From: Jac Fitzgerald <jac.fitzgerald@salesforce.com>
Date: Thu, 2 Jul 2026 13:27:16 -0700
Subject: [PATCH 7/9] ci: make e2e permission flags configurable via workflow
 inputs

Previously server_admin/site_admin/project_admin/extract_encryption_enabled
were hardcoded in online_tests.py. Now they are read from env vars
(E2E_SITE_ADMIN, E2E_SERVER_ADMIN, E2E_PROJECT_ADMIN, E2E_EXTRACT_ENCRYPTION)
so callers can enable the relevant test groups for their account permissions.

workflow_dispatch: adds optional boolean choice inputs for each flag
workflow_call: adds optional boolean inputs (default false)
online_tests.py: reads flags from env via _env_bool(), defaults unchanged

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/run-e2-tests.yml | 44 ++++++++++++++++++++++++++++++
 tests/e2e/online_tests.py          | 17 ++++++++----
 2 files changed, 56 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/run-e2-tests.yml b/.github/workflows/run-e2-tests.yml
index f98b97b2..01a863c7 100644
--- a/.github/workflows/run-e2-tests.yml
+++ b/.github/workflows/run-e2-tests.yml
@@ -11,6 +11,30 @@ on:
         required: true
       pat:
         required: true
+      server_admin:
+        description: 'Account has server admin role'
+        required: false
+        default: 'false'
+        type: choice
+        options: ['false', 'true']
+      site_admin:
+        description: 'Account has site admin role'
+        required: false
+        default: 'false'
+        type: choice
+        options: ['false', 'true']
+      project_admin:
+        description: 'Account has project admin role'
+        required: false
+        default: 'false'
+        type: choice
+        options: ['false', 'true']
+      extract_encryption_enabled:
+        description: 'Site has extract encryption enabled'
+        required: false
+        default: 'false'
+        type: choice
+        options: ['false', 'true']
   workflow_call:
     inputs:
       server:
@@ -22,6 +46,22 @@ on:
       patname:
         required: true
         type: string
+      server_admin:
+        required: false
+        type: boolean
+        default: false
+      site_admin:
+        required: false
+        type: boolean
+        default: false
+      project_admin:
+        required: false
+        type: boolean
+        default: false
+      extract_encryption_enabled:
+        required: false
+        type: boolean
+        default: false
     secrets:
       pat:
         required: true
@@ -61,6 +101,10 @@ jobs:
         E2E_SITE: ${{ inputs.site }}
         E2E_PATNAME: ${{ inputs.patname }}
         E2E_PAT: ${{ secrets.pat || inputs.pat }}
+        E2E_SERVER_ADMIN: ${{ inputs.server_admin || 'false' }}
+        E2E_SITE_ADMIN: ${{ inputs.site_admin || 'false' }}
+        E2E_PROJECT_ADMIN: ${{ inputs.project_admin || 'false' }}
+        E2E_EXTRACT_ENCRYPTION: ${{ inputs.extract_encryption_enabled || 'false' }}
       run: |
         python -m tabcmd login --server "$E2E_SERVER" --site "$E2E_SITE" --token-name "$E2E_PATNAME" --token-value "$E2E_PAT"
         pytest -q tests/e2e/online_tests.py -r pfE
diff --git a/tests/e2e/online_tests.py b/tests/e2e/online_tests.py
index 5794ed1d..7e918d4c 100644
--- a/tests/e2e/online_tests.py
+++ b/tests/e2e/online_tests.py
@@ -24,11 +24,18 @@
 # config variables for test run
 debug_log = "--logging-level=DEBUG"
 indexing_sleep_time = 1  # wait 1 second to confirm server has indexed updates
-# Flags to let us skip tests if we know we don't have the required access
-server_admin = False
-site_admin = False
-project_admin = False
-extract_encryption_enabled = False
+
+
+def _env_bool(name: str, default: bool = False) -> bool:
+    return os.environ.get(name, str(default)).lower() == "true"
+
+
+# Flags to let us skip tests if we know we don't have the required access.
+# Override by setting env vars (e.g. E2E_SITE_ADMIN=true) or via workflow inputs.
+server_admin = _env_bool("E2E_SERVER_ADMIN")
+site_admin = _env_bool("E2E_SITE_ADMIN")
+project_admin = _env_bool("E2E_PROJECT_ADMIN")
+extract_encryption_enabled = _env_bool("E2E_EXTRACT_ENCRYPTION")
 use_tabcmd_classic = False  # toggle between testing using tabcmd 2 or tabcmd classic
 
 

From bdbda2b122d1f629889f44120bc7f87e04c987c8 Mon Sep 17 00:00:00 2001
From: Jac Fitzgerald <jac.fitzgerald@salesforce.com>
Date: Thu, 2 Jul 2026 14:15:30 -0700
Subject: [PATCH 8/9] test: skip e2e tests gracefully when credentials.py is
 absent

Previously get_login_args() raised AttributeError when credentials.py
was not present (ImportError silently set credentials = {}). Now returns
None and _test_command skips with a clear message instead of crashing.
Also removes redundant second call to get_login_args() in _test_command.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 tests/e2e/online_tests.py | 6 ++++--
 tests/e2e/setup_e2e.py    | 4 ++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/tests/e2e/online_tests.py b/tests/e2e/online_tests.py
index 7e918d4c..03369531 100644
--- a/tests/e2e/online_tests.py
+++ b/tests/e2e/online_tests.py
@@ -80,10 +80,13 @@ def get_publishable_name(file_value: str) -> str:
 def _test_command(test_args: list[str]):
     # this will raise an exception if it gets a non-zero return code
     # that will bubble up and fail the test
+    login_args = setup_e2e.get_login_args()
+    if login_args is None:
+        pytest.skip("No credentials available (credentials.py not found)")
 
     # default: run tests using tabcmd 2
     calling_args = (
-        ["python", "-m", "tabcmd"] + test_args + setup_e2e.get_login_args() + [debug_log] + ["--no-certcheck"]
+        ["python", "-m", "tabcmd"] + test_args + login_args + [debug_log] + ["--no-certcheck"]
     )
 
     # call the executable directly: lets us drop in classic tabcmd
@@ -93,7 +96,6 @@ def _test_command(test_args: list[str]):
             + test_args
             + ["--no-certcheck"]
         )
-    login_args = setup_e2e.get_login_args()
     safe_to_print = not any(v in calling_args for v in login_args if v not in ("--server", "--site", "--token-name"))
     if safe_to_print:
         print(calling_args)
diff --git a/tests/e2e/setup_e2e.py b/tests/e2e/setup_e2e.py
index eda6f791..d911ffd0 100644
--- a/tests/e2e/setup_e2e.py
+++ b/tests/e2e/setup_e2e.py
@@ -3,8 +3,10 @@
 
 try:
     from tests.e2e import credentials  # type: ignore
+    _has_credentials = True
 except ImportError:
     credentials = {}  # type: ignore
+    _has_credentials = False
 
 our_program = "tabcmd.exe"
 launch_path = os.path.join("dist", "tabcmd")
@@ -46,6 +48,8 @@ def get_executable():
 
 
 def get_login_args():
+    if not _has_credentials:
+        return None
     return [
         "--server",
         credentials.server,

From 072e6e147949dba8b9c043dec6dda94ddfd68b1d Mon Sep 17 00:00:00 2001
From: Jac Fitzgerald <jac.fitzgerald@salesforce.com>
Date: Thu, 2 Jul 2026 17:34:42 -0700
Subject: [PATCH 9/9] style: black formatting for e2e test files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 tests/e2e/online_tests.py | 4 +---
 tests/e2e/setup_e2e.py    | 1 +
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/tests/e2e/online_tests.py b/tests/e2e/online_tests.py
index 03369531..8f1d50d6 100644
--- a/tests/e2e/online_tests.py
+++ b/tests/e2e/online_tests.py
@@ -85,9 +85,7 @@ def _test_command(test_args: list[str]):
         pytest.skip("No credentials available (credentials.py not found)")
 
     # default: run tests using tabcmd 2
-    calling_args = (
-        ["python", "-m", "tabcmd"] + test_args + login_args + [debug_log] + ["--no-certcheck"]
-    )
+    calling_args = ["python", "-m", "tabcmd"] + test_args + login_args + [debug_log] + ["--no-certcheck"]
 
     # call the executable directly: lets us drop in classic tabcmd
     if use_tabcmd_classic:
diff --git a/tests/e2e/setup_e2e.py b/tests/e2e/setup_e2e.py
index d911ffd0..e4d7427c 100644
--- a/tests/e2e/setup_e2e.py
+++ b/tests/e2e/setup_e2e.py
@@ -3,6 +3,7 @@
 
 try:
     from tests.e2e import credentials  # type: ignore
+
     _has_credentials = True
 except ImportError:
     credentials = {}  # type: ignore