From ecec4627e14c0b7c8240d4f3eb03eaafd0270c90 Mon Sep 17 00:00:00 2001
From: Naveen Konda <naveen.konda@hyland.com>
Date: Sat, 17 Oct 2026 21:41:58 +0530
Subject: [PATCH] ELEMENTS-2115: Remove unused Sauce Labs wiring from the CI
 workflows

Dead plumbing left over from the Karma to Web Test Runner migration. Nothing in this repo
consumes Sauce Labs: `npm run test` is `web-test-runner` against a Puppeteer-bundled
Chromium, as `test.yaml` already documents in a comment on the step itself. There is no
`sauce*` package in `package.json` or `package-lock.json`.

- `test.yaml` - remove the `SAUCE_ACCESS_KEY` entry from `workflow_call.secrets`. It was
  declared `required: true` but never referenced by any step, which is also a latent trap:
  any new caller of `test.yaml` that omits the key fails at startup for a reason unrelated
  to the change being made.
- `main.yaml`, `develop.yaml` - stop passing the secret into `test.yaml`.
- `cross-repo.yaml` - stop sending `sauce_labs` in the `nuxeo-web-ui` dispatch inputs.

`develop.yaml` is not listed in the ticket - it passes the same dead secret into `test.yaml`
and so has to change in the same commit, otherwise the reusable-workflow call fails on an
undeclared secret.

Must merge before WEBUI-2369, which removes the `sauce_labs` input from the Web UI
`cross-repo.yaml`. A `workflow_dispatch` carrying an input the target workflow no longer
declares is rejected, so if the Web UI side lands first this repo's cross-repo check breaks.
Removing the line here first is safe in either order: an input that is declared but not sent
is simply unused.

No repository secret is deleted by this change. Scope item B is deliberately left open -
`GKE_SA_KEY`, `GKE_PROJECT` and `SAUCE_ACCESS_KEY` are retained by team decision.

(cherry picked from commit d456f1ef9be462e718d162425ab7fe0c83dd4fab)
---
 .github/workflows/cross-repo.yaml | 1 -
 .github/workflows/develop.yaml    | 1 -
 .github/workflows/main.yaml       | 1 -
 .github/workflows/test.yaml       | 3 ---
 4 files changed, 6 deletions(-)

diff --git a/.github/workflows/cross-repo.yaml b/.github/workflows/cross-repo.yaml
index c69c29c8b2..3072c2360f 100644
--- a/.github/workflows/cross-repo.yaml
+++ b/.github/workflows/cross-repo.yaml
@@ -45,7 +45,6 @@ jobs:
           branch-name: ${{ github.base_ref }}
           inputs: |
             branch_name: ${{ env.BRANCH_NAME }}
-            sauce_labs: false
             skip_ftests: false
             skip_a11y: false
             skip_unit_tests: false
diff --git a/.github/workflows/develop.yaml b/.github/workflows/develop.yaml
index 1948881a76..df41480dcc 100644
--- a/.github/workflows/develop.yaml
+++ b/.github/workflows/develop.yaml
@@ -31,7 +31,6 @@ jobs:
       contents: read
     secrets:
       NPM_PACKAGES_TOKEN: ${{ secrets.NPM_PACKAGES_TOKEN }}
-      SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
 
   # Builds Storybook but never deploys it: the deploy step requires a non-pull_request event
   # AND a release branch name, and this runs on a dev branch.
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index 26ff67dd8b..85f563765e 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -26,7 +26,6 @@ jobs:
       contents: read
     secrets:
       NPM_PACKAGES_TOKEN: ${{ secrets.NPM_PACKAGES_TOKEN }}
-      SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
     with:
       branch: maintenance-3.1.x
 
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 0e60343b63..14be95884a 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -15,9 +15,6 @@ on:
       NPM_PACKAGES_TOKEN:
         description: 'NPM_PACKAGES_TOKEN'
         required: true
-      SAUCE_ACCESS_KEY:
-        description: 'SAUCE_ACCESS_KEY'
-        required: true
         
 permissions:
   contents: read