redhat-developer · jrichter1 · Apr 22, 2026 · Apr 22, 2026 · Apr 22, 2026 · Apr 22, 2026
diff --git a/docs/.vitepress/config.ts b/docs/.vitepress/config.ts
@@ -33,7 +33,7 @@ export default defineConfig({
       { text: "Examples", link: "/examples/" },
       { text: "Overlay Testing", link: "/overlay/" },
       {
-        text: "v1.1.30",
+        text: "v1.1.33",
         items: [{ text: "Changelog", link: "/changelog" }],
       },
     ],

diff --git a/docs/changelog.md b/docs/changelog.md
@@ -2,7 +2,11 @@
 
 All notable changes to this project will be documented in this file.
 
-## [1.1.32] - Current
+## [1.1.33] - Current
+
+### Added
+
+- **Automatic Vault secret loading for local development**: Set `VAULT=1` or `VAULT=true` to automatically fetch secrets from HashiCorp Vault during global setup. Handles OIDC login, fetches global and per-workspace secrets, and injects them into `process.env`. Only secret key names are logged, never values. Configurable via `VAULT_ADDR` and `VAULT_BASE_PATH` env vars. Logs a Slack channel (`#rhdh-e2e-tests`) when permission is denied.
 
 ### Fixed
 

diff --git a/docs/examples/basic-test.md b/docs/examples/basic-test.md
@@ -8,9 +8,6 @@ Minimal working test example.
 
 ```typescript
 import { defineConfig } from "@red-hat-developer-hub/e2e-test-utils/playwright-config";
-import dotenv from "dotenv";
-
-dotenv.config({ path: `${import.meta.dirname}/.env` });
 
 export default defineConfig({
   projects: [

diff --git a/docs/guide/configuration/environment-variables.md b/docs/guide/configuration/environment-variables.md
@@ -123,13 +123,7 @@ GITHUB_TOKEN=ghp_xxxxx
 MY_API_KEY=secret-value
 ```
 
-Load with dotenv:
-
-```typescript
-// playwright.config.ts
-import dotenv from "dotenv";
-dotenv.config({ path: `${import.meta.dirname}/.env` });
-```
+The `.env` file is automatically loaded by global setup. Variables defined here take priority over Vault secrets.
 
 ### CI/CD
 

diff --git a/docs/guide/core-concepts/global-setup.md b/docs/guide/core-concepts/global-setup.md
@@ -4,7 +4,33 @@ The package includes a global setup function that runs once before all tests. Th
 
 ## What Global Setup Does
 
-### 1. Binary Validation
+### 1. Vault Secret Loading (Local Development)
+
+When `VAULT=1` or `VAULT=true` is set, global setup fetches secrets from HashiCorp Vault before anything else runs:
+
+- Checks that the `vault` CLI is installed
+- Logs in via OIDC if not already authenticated (opens browser)
+- Fetches global secrets and per-workspace secrets
+- Injects all `VAULT_*` keys into `process.env`
+- Only logs key names, never secret values
+
+```bash
+# From workspace
+VAULT=1 yarn test
+
+# From repo root
+VAULT=1 ./run-e2e.sh -w argocd
+```
+
+If you don't have Vault access, request it in Slack: `#rhdh-e2e-tests`.
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `VAULT` | Enable Vault secret loading (`1` or `true`) | - |
+| `VAULT_ADDR` | Vault server URL | `https://vault.ci.openshift.org` |
+| `VAULT_BASE_PATH` | Base path in Vault | `selfservice/rhdh-plugin-export-overlays` |
+
+### 2. Binary Validation
 
 Checks that required CLI tools are installed and available:
 
@@ -16,7 +42,7 @@ Checks that required CLI tools are installed and available:
 
 If any binary is missing, tests will fail with a clear error message.
 
-### 2. Cluster Router Base
+### 3. Cluster Router Base
 
 Fetches the OpenShift ingress domain and sets the `K8S_CLUSTER_ROUTER_BASE` environment variable:
 
@@ -27,7 +53,7 @@ K8S_CLUSTER_ROUTER_BASE=apps.cluster-abc123.example.com
 
 This is used to construct route URLs for deployed applications.
 
-### 3. Keycloak Deployment
+### 4. Keycloak Deployment
 
 Automatically deploys and configures Keycloak for OIDC authentication:
 

diff --git a/docs/guide/core-concepts/playwright-config.md b/docs/guide/core-concepts/playwright-config.md
@@ -146,21 +146,8 @@ export default playwrightDefineConfig({
 
 ## Loading Environment Variables
 
-Use `dotenv` to load environment variables from a `.env` file:
+Environment variables from `.env` files are automatically loaded by the global setup. Place a `.env` file in your `e2e-tests/` directory:
 
-```typescript
-import { defineConfig } from "@red-hat-developer-hub/e2e-test-utils/playwright-config";
-import dotenv from "dotenv";
-
-// Load .env file
-dotenv.config({ path: `${import.meta.dirname}/.env` });
-
-export default defineConfig({
-  projects: [{ name: "my-plugin" }],
-});
-```
-
-Create a `.env` file:
 
 ```bash
 RHDH_VERSION="1.5"
@@ -174,9 +161,6 @@ GITHUB_TOKEN=ghp_xxxxx
 ```typescript
 import { baseConfig } from "@red-hat-developer-hub/e2e-test-utils/playwright-config";
 import { defineConfig } from "@playwright/test";
-import dotenv from "dotenv";
-
-dotenv.config({ path: `${import.meta.dirname}/.env` });
 
 export default defineConfig({
   ...baseConfig,

diff --git a/docs/guide/quick-start.md b/docs/guide/quick-start.md
@@ -25,9 +25,6 @@ Create `playwright.config.ts`:
 
 ```typescript
 import { defineConfig } from "@red-hat-developer-hub/e2e-test-utils/playwright-config";
-import dotenv from "dotenv";
-
-dotenv.config({ path: `${import.meta.dirname}/.env` });
 
 export default defineConfig({
   projects: [

diff --git a/docs/overlay/examples/basic-plugin.md b/docs/overlay/examples/basic-plugin.md
@@ -49,6 +49,7 @@ workspaces/<plugin>/e2e-tests/
   "description": "E2E tests for <plugin>",
   "scripts": {
     "test": "playwright test",
+    "test:vault": "VAULT=1 playwright test",
     "report": "playwright show-report",
     "test:ui": "playwright test --ui",
     "test:headed": "playwright test --headed",
@@ -62,9 +63,8 @@ workspaces/<plugin>/e2e-tests/
   "devDependencies": {
     "@eslint/js": "10.0.1",
     "@playwright/test": "1.59.1",
-    "@red-hat-developer-hub/e2e-test-utils": "1.1.30",
+    "@red-hat-developer-hub/e2e-test-utils": "1.1.33",
     "@types/node": "25.5.2",
-    "dotenv": "17.4.1",
     "eslint": "10.2.0",
     "eslint-plugin-check-file": "3.3.1",
     "eslint-plugin-playwright": "2.10.1",
@@ -79,9 +79,6 @@ workspaces/<plugin>/e2e-tests/
 
 ```typescript
 import { defineConfig } from "@red-hat-developer-hub/e2e-test-utils/playwright-config";
-import dotenv from "dotenv";
-
-dotenv.config({ path: `${import.meta.dirname}/.env` });
 
 export default defineConfig({
   projects: [

diff --git a/docs/overlay/examples/tech-radar.md b/docs/overlay/examples/tech-radar.md
@@ -52,6 +52,7 @@ workspaces/tech-radar/e2e-tests/
   "description": "E2E tests for Tech Radar plugin",
   "scripts": {
     "test": "playwright test",
+    "test:vault": "VAULT=1 playwright test",
     "report": "playwright show-report",
     "test:ui": "playwright test --ui",
     "test:headed": "playwright test --headed",
@@ -65,9 +66,8 @@ workspaces/tech-radar/e2e-tests/
   "devDependencies": {
     "@eslint/js": "10.0.1",
     "@playwright/test": "1.59.1",
-    "@red-hat-developer-hub/e2e-test-utils": "1.1.30",
+    "@red-hat-developer-hub/e2e-test-utils": "1.1.33",
     "@types/node": "25.5.2",
-    "dotenv": "17.4.1",
     "eslint": "10.2.0",
     "eslint-plugin-check-file": "3.3.1",
     "eslint-plugin-playwright": "2.10.1",
@@ -82,9 +82,6 @@ workspaces/tech-radar/e2e-tests/
 
 ```typescript
 import { defineConfig } from "@red-hat-developer-hub/e2e-test-utils/playwright-config";
-import dotenv from "dotenv";
-
-dotenv.config({ path: `${import.meta.dirname}/.env` });
 
 /**
  * Tech Radar plugin e2e test configuration.

diff --git a/docs/overlay/getting-started.md b/docs/overlay/getting-started.md
@@ -13,9 +13,6 @@ Create `playwright.config.ts`:
 
 ```typescript
 import { defineConfig } from "@red-hat-developer-hub/e2e-test-utils/playwright-config";
-import dotenv from "dotenv";
-
-dotenv.config({ path: `${import.meta.dirname}/.env` });
 
 export default defineConfig({
   projects: [

diff --git a/docs/overlay/reference/environment-variables.md b/docs/overlay/reference/environment-variables.md
@@ -15,6 +15,23 @@ All secrets **must** start with the `VAULT_` prefix (e.g., `VAULT_API_KEY`, `VAU
 
 For complete Vault setup instructions including paths, annotations, and access requests, see [OpenShift CI Pipeline - Vault Secrets](/overlay/tutorials/ci-pipeline#vault-secrets).
 
+## Vault Auto-Loading (Local Development)
+
+Set `VAULT=1` or `VAULT=true` to automatically fetch secrets from Vault during global setup. This replaces the need to manually copy secrets into `.env` files.
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `VAULT` | Enable automatic Vault secret loading | - |
+| `VAULT_ADDR` | Vault server URL | `https://vault.ci.openshift.org` |
+| `VAULT_BASE_PATH` | Base path in Vault KV store | `selfservice/rhdh-plugin-export-overlays` |
+
+```bash
+VAULT=1 yarn test
+VAULT=1 ./run-e2e.sh -w argocd
+```
+
+See [Running Locally - Secrets from Vault](/overlay/tutorials/running-locally#secrets-from-vault) for full details.
+
 ## Core Variables
 
 ### RHDH Configuration

diff --git a/docs/overlay/reference/run-e2e.md b/docs/overlay/reference/run-e2e.md
@@ -168,7 +168,7 @@ Cleans all `node_modules` and `yarn.lock` to ensure fresh resolution, then runs
 Extracts `projects: [...]` blocks from each workspace's `playwright.config.ts` using `sed` text processing. Injects `testDir` into each project pointing to the workspace's `tests/` directory.
 
 ::: info Why sed Instead of Import?
-Importing workspace configs would execute their top-level code (e.g., `dotenv.config()`, `process.env` mutations), which can pollute the environment for other workspaces. Text extraction avoids this.
+Importing workspace configs would execute their top-level code (e.g., `process.env` mutations), which can pollute the environment for other workspaces. Text extraction avoids this.
 :::
 
 The generated config imports `baseConfig` from the test utils package, which provides reporters, timeouts, video/screenshot/trace settings, and global setup.

diff --git a/docs/overlay/reference/scripts.md b/docs/overlay/reference/scripts.md
@@ -22,6 +22,16 @@ Equivalent to:
 playwright test
 ```
 
+### yarn test:vault
+
+Run tests with secrets automatically fetched from Vault:
+
+```bash
+yarn test:vault
+```
+
+Equivalent to `VAULT=1 yarn test`. Handles OIDC login, fetches global and per-workspace secrets. See [Running Locally - Secrets from Vault](/overlay/tutorials/running-locally#secrets-from-vault) for details.
+
 ### yarn test:headed
 
 Run tests with browser visible:
@@ -139,6 +149,7 @@ Standard `package.json` scripts section:
 {
   "scripts": {
     "test": "playwright test",
+    "test:vault": "VAULT=1 playwright test",
     "report": "playwright show-report",
     "test:ui": "playwright test --ui",
     "test:headed": "playwright test --headed",

diff --git a/docs/overlay/reference/troubleshooting.md b/docs/overlay/reference/troubleshooting.md
@@ -197,11 +197,7 @@ oc login --token=<token> --server=<server>
 
 **Solutions:**
 - Check `.env` file exists and contains variable
-- Verify dotenv is loaded:
-  ```typescript
-  import dotenv from "dotenv";
-  dotenv.config({ path: `${import.meta.dirname}/.env` });
-  ```
+- Verify `.env` file exists in your `e2e-tests/` directory (loaded automatically by global setup)
 - Set in test code:
   ```typescript
   process.env.MY_VAR = "value";

diff --git a/docs/overlay/test-structure/directory-layout.md b/docs/overlay/test-structure/directory-layout.md
@@ -49,6 +49,7 @@ Defines the test package with dependencies and scripts:
   "packageManager": "yarn@4.12.0",
   "scripts": {
     "test": "playwright test",
+    "test:vault": "VAULT=1 playwright test",
     "report": "playwright show-report",
     "test:ui": "playwright test --ui",
     "test:headed": "playwright test --headed",
@@ -62,9 +63,8 @@ Defines the test package with dependencies and scripts:
   "devDependencies": {
     "@eslint/js": "10.0.1",
     "@playwright/test": "1.59.1",
-    "@red-hat-developer-hub/e2e-test-utils": "1.1.30",
+    "@red-hat-developer-hub/e2e-test-utils": "1.1.33",
     "@types/node": "25.5.2",
-    "dotenv": "17.4.1",
     "eslint": "10.2.0",
     "eslint-plugin-check-file": "3.3.1",
     "eslint-plugin-playwright": "2.10.1",
@@ -81,9 +81,6 @@ Extends the base configuration from `@red-hat-developer-hub/e2e-test-utils`:
 
 ```typescript
 import { defineConfig } from "@red-hat-developer-hub/e2e-test-utils/playwright-config";
-import dotenv from "dotenv";
-
-dotenv.config({ path: `${import.meta.dirname}/.env` });
 
 export default defineConfig({
   projects: [

diff --git a/docs/overlay/tutorials/new-workspace.md b/docs/overlay/tutorials/new-workspace.md
@@ -45,6 +45,7 @@ Create `package.json` with the following content:
   "description": "E2E tests for <your-plugin>",
   "scripts": {
     "test": "playwright test",
+    "test:vault": "VAULT=1 playwright test",
     "report": "playwright show-report",
     "test:ui": "playwright test --ui",
     "test:headed": "playwright test --headed",
@@ -60,7 +61,6 @@ Create `package.json` with the following content:
     "@playwright/test": "1.59.1",
     "@red-hat-developer-hub/e2e-test-utils": "<latest-version>",
     "@types/node": "25.5.2",
-    "dotenv": "17.4.1",
     "eslint": "10.2.0",
     "eslint-plugin-check-file": "3.3.1",
     "eslint-plugin-playwright": "2.10.1",
@@ -80,9 +80,6 @@ Replate `<latest-version>` with the latest available version of this library.
 
 ```typescript
 import { defineConfig } from "@red-hat-developer-hub/e2e-test-utils/playwright-config";
-import dotenv from "dotenv";
-
-dotenv.config({ path: `${import.meta.dirname}/.env` });
 
 export default defineConfig({
   projects: [