ci: real-Plane CE round-trip job (PFB-28)

[hstern]

Summary

• Adds an e2e-real-plane CI job that brings up a minimum Plane CE v1.3.1 stack (api+worker+postgres+redis+rabbitmq+minio, no frontends, no persistent volumes), seeds an admin user / workspace / project / API token via direct Django ORM, and round-trips the bridge's plane.Client against real Plane over the REST API. Gates publish alongside lint and e2e-docker.
• Lives entirely under test/e2e-docker/plane-ce/ — compose file, seed script, runner shell script, README. No changes to existing e2e harness.
• Integration test is build-tagged (//go:build integration) so default go test ./... is unchanged. Local run: bash test/e2e-docker/plane-ce/run.sh up && go test -tags=integration ./internal/plane.

Why

PFB-22, PFB-24, and PFB-25 were all the same class of bug: bridge testdata diverged from real Plane wire shape, the existing plane-stub happily agreed with the synthetic data, and the bug only surfaced when real Plane talked to the deployed bridge. We've whack-a-mole'd three of these in production. This is the structural fix — any future Plane wire-shape change fails CI on the next PR instead of failing production on the next deploy.

What the integration test pins

Every plane.Client method the bridge calls today: ListProjectStates, CreateProjectLabel, ListProjectLabels, ListWorkspaceMembers, CreateIssue, GetIssue, UpdateIssue, GetIssueByExternalRef, CreateComment, UpdateComment, DeleteComment. The PFB-25 failure mode (REST state field as a bare UUID, not the webhook's object form) is specifically asserted at every issue create/get/update point.

Why direct ORM (seed.py) instead of REST

Plane CE has no headless signup endpoint. The browser flow goes through Django session cookies + CSRF tokens + workspace onboarding, all of which are expensive to drive from a CI script and exist for human operators. seed.py runs inside the plane-api container and creates the rows directly via ORM — Instance (is_setup_done=True), User, InstanceAdmin, Workspace, Project, default State rows, APIToken. Every step is get_or_create; the seed is safe to re-run.

Cost

~90s of cold-cache time per CI run. The job is single-leg (not matrix) because Plane wire shape doesn't vary by forge flavor — running it once is enough. No persistent volumes; data dies with docker compose down.

Local verification (this PR)

bash test/e2e-docker/plane-ce/run.sh up
# Seed JSON on last stdout line; capture it:
eval "$(bash test/e2e-docker/plane-ce/run.sh seed 2>/dev/null | tail -n1 \
  | jq -r 'to_entries[] | "export PFB_PLANE_TEST_\(.key|ascii_upcase)=\(.value)"')"
export PFB_PLANE_TEST_BASE_URL=http://localhost:8765/api/v1
go test -tags=integration ./internal/plane -run TestIntegration -v
# PASS  TestIntegration_RoundTrip (1.06s)
bash test/e2e-docker/plane-ce/run.sh down

Trade-offs / footguns

• Pinned to v1.3.1. README documents the bump procedure (recapture testdata, verify ORM surface, verify management commands). Drifting these together avoids the wire-shape coverage going stale.
• Podman wart on rabbitmq: rootless podman runs the container as a UID that lacks read access to in-image /var/lib/rabbitmq/; compose pins user: "100:101" to work around it. Docker (CI) is unaffected.
• Seed reaches into Plane internals (plane.db.models, plane.license.models). If Plane refactors those module paths between versions, the seed breaks. The breakage is loud (ImportError) and the README points at the spots to inspect.

Test plan

• make race — all packages green
• make lint — 0 issues
• Local verification: full run.sh up → go test -tags=integration round-trip passes on this branch (Plane CE v1.3.1, fedora/podman)
• CI: confirm the e2e-real-plane job lands green on this PR (the real signal — first time it runs against ubuntu-latest/docker rather than my local podman)

🤖 Generated with Claude Code