QVAC-23575 chore[bc]: move SDK e2e onto the in-repo @qvac/test-suite

[Victor-Rodzko]

🎯 What problem does this solve?

Part 2 of 2 for QVAC-23575. #4082 added @qvac/test-suite to the monorepo but left it unconsumed. This PR migrates packages/sdk/e2e onto it and adds the CI switch that lets an SDK change be tested against an unreleased framework change without publishing.

Stacked on #4082. Base is feature-test-suite-fold, so the diff here shows only this half. GitHub retargets this to main once #4082 merges.

📝 How is it solved?

Consumer migration. packages/sdk/e2e switches from the published @qvac/qvac-test-suite to the in-repo package, and the import specifier is renamed across the e2e suite — 114 files, a single mechanical token change per file.

New test-suite-source selector on test-sdk.yml (manifest | branch | npm) plus test-suite-version, mirroring the existing inference-source. A prepare-test-suite job resolves the framework once per run; .github/actions/sdk-e2e-prepare-test-suite applies it before each consumer install. packages/test-suite and the new action are added to all five sparse-checkout blocks across the three platform workflows. PRs touching packages/test-suite run their e2e suite in branch mode automatically.

Report provenance. sdk-e2e-report-start / -finalize gain a test-suite-provenance input, so run summaries state which framework build was used alongside the inference build.

🧪 How was this verified?

• packages/sdk/e2e typecheck + build clean — this is what proves the 114-file rename is complete; a single missed import fails the compile.
• The framework loads the real consumer config and all 505 test definitions across 40 categories from its new location.
• Resolver exercised in every mode: manifest with a registry spec (no-op), manifest with a local link (builds and packs, reports branch), branch (packs and rewrites to the tarball, leaves @qvac/sdk untouched), npm (fails closed with a clear 404 — the new name is not published yet).
• A real tarball installed via file:// + --install-links into a clean consumer, qvac-test --version works from it — the crux of branch mode.
• actionlint structural gate clean; 97/97 CI policy tests pass.

Not verified locally: a full e2e run (needs model downloads) and the Electron/Snap/mobile consumer builds. Those are covered by a follow-up task that runs each family via workflow_dispatch.

💥 Breaking Changes

No new breaking change beyond the rename already declared in #4082 — this PR is what actually moves a consumer onto the new name, so the consumer-visible shape of that rename is shown here.

Import specifier:

BEFORE:

import type { TestDefinition } from '@qvac/qvac-test-suite'
import { createExecutor, SkipExecutor } from '@qvac/qvac-test-suite/mobile'

AFTER:

import type { TestDefinition } from '@qvac/test-suite'
import { createExecutor, SkipExecutor } from '@qvac/test-suite/mobile'

Dependency (end state, once 0.11.0 is published — see Migration Notes):

BEFORE:

{ "dependencies": { "@qvac/qvac-test-suite": "^0.10.3" } }

AFTER:

{ "dependencies": { "@qvac/test-suite": "^0.11.0" } }

Metro resolution for React Native consumers changes with it:

BEFORE:

if (moduleName === '@qvac/qvac-test-suite') {
  return context.resolveRequest(context, '@qvac/qvac-test-suite/mobile', platform)
}

AFTER:

if (moduleName === '@qvac/test-suite') {
  return context.resolveRequest(context, '@qvac/test-suite/mobile', platform)
}

The old package stays installable and will be deprecated, not unpublished, so anything pinned to a released 0.10.x keeps resolving. The framework also still recognises all four names at runtime, so a mixed setup during migration resolves correctly.

📦 Package Surface Changes

Two composite actions gain an optional test-suite-provenance input (sdk-e2e-report-start, sdk-e2e-report-finalize). .github/actions/sdk-e2e-prepare-test-suite/ is new — a deliberate sibling of sdk-e2e-prepare-inference rather than a refactor of it, because the inference path is release-critical and gets no edits here.

🚀 Workflow / Publish Changes

test-sdk.yml, test-node-sdk.yml, test-android-sdk.yml, test-ios-sdk.yml, on-pr-test-sdk.yml.

coload-smoke-mobile.yml calls test-android-sdk.yml directly and does not pass the new inputs. That path lands on manifest with a local link, so the apply action builds the linked package in place instead of expecting an artifact — verified by simulating that caller.

🔄 Migration Notes

The dependency is file:../../test-suite for now, because @qvac/test-suite is not on npm under the new name yet. Sequence:

1. QVAC-23575 chore[bc]: add @qvac/test-suite as a monorepo package #4082 merges
2. npm Trusted Publisher registered, release-test-suite-0.11.0 cut and published
3. Before this PR merges: the dependency is swapped for "@qvac/test-suite": "^0.11.0" and the interim manifest-link handling (isLocalFileSpec / buildInPlace) is removed from the prepare action, leaving manifest = published release and branch = in-repo build, exactly like @qvac/inference

⚠️ Do not apply test-e2e-smoke / test-e2e-full to this PR. on-pr-test-sdk.yml runs under pull_request_target and loads workflow definitions from main, which has no prepare-test-suite job and no packages/test-suite in its sparse-checkout, so the e2e install would fail on the file link. Use a workflow_dispatch of QVAC Tests (sdk) from this branch with test-suite-source: branch instead. This self-heals once merged.

📚 Docs Changes

packages/sdk/TESTING.md, packages/sdk/e2e/README.md, packages/bare-sdk/test/bare/README.md, .cursor/skills/qv-sdk-e2e-create/SKILL.md, and the CI section of .cursor/rules/sdk/test-suite/main.mdc (which #4082 deliberately leaves describing only the publish pipeline).

[github-actions]

License compliance — findings detected (warn-only)

Critical: 0 · High: 1 · Medium: 0

Dependency	License	Scope	Severity	Outcome
@qvac/test-suite@file:../../test-suite	(none detected)	runtime	High	blocks

How to resolve a blocking finding:

• Remove or replace the disallowed dependency, or
• If the license is genuinely acceptable, run the compliance SKILL and record the decision in .github/license-allowlist.yml (CODEOWNERS-reviewed), or
• For a one-off, a maintainer can apply the license-override label (High findings only; Critical cannot be overridden).

Warn-only (shadow) mode — this check does not block merges yet.

Updated automatically by the canonical license compliance workflow.

NOTICE presence (advisory)

Missing NOTICE (advisory, does not block):

• ./.github/actions/release-merge-guard
• ./docs/website
• ./packages/ggml-coload-smoke
• ./packages/fabric/test/integration
• ./packages/inference-addon-cpp/mobile
• ./packages/sdk/e2e
• ./packages/llm-llamacpp/benchmarks/performance
• ./packages/llm-llamacpp/benchmarks/server
• ./packages/vla-ggml/sim/server
• ./packages/embed-llamacpp/benchmarks/performance
• ./packages/embed-llamacpp/benchmarks/server
• ./packages/asr-ggml/benchmarks/server

[github-actions]

Workflow security (shadow mode)

zizmor found 1074 finding(s) in .github/ (highest severity: high). This check is warn-only and does not block the merge.

Findings are annotated inline on the changed files and listed in the job summary.

Reproduce locally:

pipx run zizmor==1.27.0 --offline .github/

[Victor-Rodzko]

Only for e2e test run via CI - should be changed after publishing the framework version (0.11.0)