feat: add end-to-end test suite

Build and run the actual binary as a subprocess against mock GitHub meta
and doco-cd servers. Tests cover the full pipeline including config
loading from env vars, secret file support, HMAC forwarding, signal
handling, and rejection scenarios.

Uses a minimal isolated environment for subprocesses to prevent host
env vars from leaking into tests.

Also adds GITHUB_META_URL env var override (useful for GitHub Enterprise
or integration testing) and a dedicated E2E CI job.

Author: strayer

.github/workflows/ci.yaml

@@ -52,6 +52,14 @@ jobs:
       - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
       - run: golangci-lint run
 
+  e2e:
+    name: E2E
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+      - run: go test ./e2e/ -tags e2e -v -timeout 60s
+
   docker:
     name: Docker build
     runs-on: ubuntu-latest

cmd/proxy/main.go

@@ -15,7 +15,7 @@ import (
 	proxy "github.com/strayer/doco-cd-webhook-proxy/internal/proxy"
 )
 
-const githubMetaURL = "https://api.github.com/meta"
+const defaultGitHubMetaURL = "https://api.github.com/meta"
 
 func main() {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
@@ -27,13 +27,18 @@ func main() {
 		os.Exit(1)
 	}
 
+	metaURL := os.Getenv("GITHUB_META_URL")
+	if metaURL == "" {
+		metaURL = defaultGitHubMetaURL
+	}
+
 	ln, err := net.Listen("tcp", cfg.ListenAddr)
 	if err != nil {
 		slog.Error("failed to listen", "addr", cfg.ListenAddr, "error", err)
 		os.Exit(1)
 	}
 
-	if err := run(ctx, cfg, githubMetaURL, ln); err != nil {
+	if err := run(ctx, cfg, metaURL, ln); err != nil {
 		slog.Error("fatal", "error", err)
 		os.Exit(1)
 	}