cd: store sensitive logs on the server to be able to read them if we got an error during deploy or e2e tests run and use self-hosted runners to be able to access the logs, remove --suppress-diff flag to show helm diff in deploy logs (not in action logs)

.github/workflows/.reusable-e2e-tests-against-prod.yml

@@ -5,7 +5,9 @@ on:
 
 jobs:
   e2e-test-against-prod:
-    runs-on: ubuntu-24.04
+    # need to run on our own runners that we have access to the logs later on our servers
+    # otherwise, if we use shared runners they store log files in their VMs which we cannot access
+    runs-on: self-hosted
     steps:
     - uses: actions/checkout@v4
 
@@ -21,9 +23,11 @@ jobs:
 
     - name: Run E2E Tests Against Local Env
       run: |
-        # Learn more about '> /dev/null 2>&1': https://stackoverflow.com/a/42919998
+        # Redirecting logs to a file on the server
+        # Example of a filename: "/var/log/inner-circle/e2e/2026-07-22-inner-circle-time-api-run-27459153975-job-81169369662.log"
+        # Learn more about '2>&1': https://stackoverflow.com/a/42919998
         # In essence it merges output and error streams and doesn't show errors in the terminal to avoid leakage of secrets in the pipeline
-        java -jar karate.jar . > /dev/null 2>&1
+        java -jar karate.jar . > "/var/log/inner-circle/e2e/$(date +%F)-${{ github.event.repository.name }}-run-${{ github.run_id }}-job-${{ job.check_run_id }}.log" 2>&1
       env:
         "AUTH_FIRST_TENANT_LOGIN_WITH_ALL_PERMISSIONS": ${{ secrets.INNER_CIRCLE_PROD_AUTH_FIRST_TENANT_LOGIN_WITH_ALL_PERMISSIONS }}
         "AUTH_FIRST_TENANT_PASSWORD_WITH_ALL_PERMISSIONS": ${{ secrets.INNER_CIRCLE_PROD_AUTH_FIRST_TENANT_PASSWORD_WITH_ALL_PERMISSIONS }}

.github/workflows/deploy-to-prod-from-default.yml

@@ -21,7 +21,7 @@ jobs:
         # then they will break other vars
         # Also we use quotes because without them some vars (DB Connection) break down
         run: |
-            helmfile cache cleanup && helmfile apply --suppress-diff --namespace "${{ secrets.INNER_CIRCLE_PROD_NAMESPACE }}" -f Api/ci/helmfile.yaml \
+            helmfile cache cleanup && helmfile apply --namespace "${{ secrets.INNER_CIRCLE_PROD_NAMESPACE }}" -f Api/ci/helmfile.yaml \
             --state-values-set image.tag="sha-${{ github.sha }}" \
             --state-values-set ingress.hostname="${{ secrets.INNER_CIRCLE_PROD_HOSTNAME }}" \
             --state-values-set extraSecretEnvVars.ConnectionStrings__DefaultConnection="${{ secrets.INNER_CIRCLE_PROD_AUTH_DB_CONNECTION_STRING }}" \
@@ -30,7 +30,8 @@ jobs:
             --state-values-set extraSecretEnvVars.InnerCircleServiceUrls__MailServiceUrl="${{ secrets.INNER_CIRCLE_PROD_MAIL_SERVICE_URL }}" \
             --state-values-set extraSecretEnvVars.InnerCircleServiceUrls__EmployeesServiceUrl="${{ secrets.INNER_CIRCLE_PROD_EMPLOYEES_SERVICE_URL }}" \
             --state-values-set extraSecretEnvVars.AuthenticationOptions__PublicSigningKey="${{ secrets.INNER_CIRCLE_PROD_PUBLIC_SIGNING_KEY }}" \
-            --state-values-set extraSecretEnvVars.AuthenticationOptions__PrivateSigningKey="${{ secrets.INNER_CIRCLE_PROD_PRIVATE_SIGNING_KEY }}" > /dev/null 2>&1
+            --state-values-set extraSecretEnvVars.AuthenticationOptions__PrivateSigningKey="${{ secrets.INNER_CIRCLE_PROD_PRIVATE_SIGNING_KEY }}" > "/var/log/inner-circle/deploy/$(date +%F)-${{ github.event.repository.name }}-run-${{ github.run_id }}-job-${{ job.check_run_id }}.log" 2>&1
+            # on the last line where we redirect output we don't add a line break for convenience because it is easy to make it wrong having an extra space after \ symbol which leads to exposure of logs to the public pipeline logs instead of the needed private file on a runner
 
   run-e2e-tests:
     uses: ./.github/workflows/.reusable-e2e-tests-against-prod.yml