.github/workflows/ci.yaml

name: CI

# Controls when the action will run
on:
    # Triggers the workflow on push or pull request events but only for the main branch
    push:
        branches: [main, 2.x]
    pull_request:
        branches: [main, 2.x]

    # Allows you to run this workflow manually from the Actions tab
    workflow_dispatch:

concurrency:
    # Cancel previous actions from the same PR or branch except 'main' branch.
    # See https://docs.github.com/en/actions/using-jobs/using-concurrency and https://docs.github.com/en/actions/learn-github-actions/contexts for more info.
    group: concurrency-group::${{ github.workflow }}::${{ github.event.pull_request.number > 0 && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}${{ github.ref_name == 'main' && format('::{0}', github.run_id) || ''}}
    cancel-in-progress: ${{ github.ref_name != 'main' }}

jobs:
    semantic-pull-request:
        if: github.event_name == 'pull_request'
        runs-on: ubuntu-latest
        steps:
            - uses: amannn/action-semantic-pull-request@v5
              env:
                  GITHUB_TOKEN: ${{ github.token }}
    # Prepares dynamic test matrix values for ubuntu tests
    e2e-tests-list:
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v6
            - id: folder
              name: Prepare 'folder' matrix axis
              # Include tests not run on Aspect Workflows: tests with test.sh, tests depending on secrets
              run: |
                  a=(
                    e2e/js_image_oci
                    e2e/js_run_devserver
                    e2e/npm_translate_lock_package_visibility
                    e2e/npm_translate_lock_replace_packages
                    e2e/update_pnpm_lock
                    e2e/update_pnpm_lock_with_import
                    e2e/verify_patches
                    e2e/webpack_devserver
                    e2e/webpack_devserver_esm
                  )
                  if [[ "${{ env.ASPECT_GHTESTER_SSH_KEY }}" ]]; then
                    a+=(
                      e2e/git_dep_metadata
                      e2e/npm_translate_lock_git+ssh
                    )
                  fi
                  if [[ "${{ env.ASPECT_NPM_AUTH_TOKEN }}" ]]; then
                    a+=( e2e/npm_translate_lock_auth )
                  fi
                  printf -v j '"%s",' "${a[@]}"
                  echo "res=[${j%,}]" | tee -a $GITHUB_OUTPUT
              env:
                  ASPECT_GHTESTER_SSH_KEY: ${{ secrets.ASPECT_GHTESTER_SSH_KEY }}
                  ASPECT_NPM_AUTH_TOKEN: ${{ secrets.ASPECT_NPM_AUTH_TOKEN }}
        outputs:
            folder: ${{ steps.folder.outputs.res }}

    # Ubuntu tests - e2e tests with test.sh or secret dependencies not tested within Aspect Workflows
    test:
        runs-on: ubuntu-22.04-4core
        needs: e2e-tests-list
        defaults:
            run:
                working-directory: ${{ matrix.folder }}
        strategy:
            fail-fast: false
            matrix:
                folder: ${{ fromJSON(needs.e2e-tests-list.outputs.folder) }}
        env:
            ASPECT_GH_PACKAGES_AUTH_TOKEN: ${{ secrets.ASPECT_GH_PACKAGES_AUTH_TOKEN }}
            ASPECT_NPM_AUTH_TOKEN: ${{ secrets.ASPECT_NPM_AUTH_TOKEN }}
            ASPECT_RULES_JS_FROZEN_PNPM_LOCK: 1
        steps:
            - uses: actions/checkout@v6
            # Setup an ssh keypair and github.com in known_hosts for e2e/git_dep_metadata,
            # which exercises fetching a git repository via ssh.
            - uses: webfactory/ssh-agent@v0.9.1
              if: env.ASPECT_GHTESTER_SSH_KEY != ''
              env:
                  ASPECT_GHTESTER_SSH_KEY: ${{ secrets.ASPECT_GHTESTER_SSH_KEY }}
              with:
                  ssh-private-key: ${{ secrets.ASPECT_GHTESTER_SSH_KEY }}

            - uses: bazel-contrib/setup-bazel@0.18.0
              with:
                  bazelisk-cache: true
                  disk-cache: ${{ matrix.folder }}
                  repository-cache: true

            - name: bazel test //...
              run: |
                  bazel test \
                    --test_tag_filters=-skip-on-bazel7 \
                    --build_tag_filters=-skip-on-bazel7 \
                    //...

            - name: Check that unused npm packages were not fetched
              run: ls $(bazel info output_base)/external | grep -v __links | grep -vz unused

            - name: bazel coverage //...
              run: |
                  bazel coverage \
                    --test_tag_filters=-skip-on-bazel7 \
                    --build_tag_filters=-skip-on-bazel7 \
                    --instrument_test_targets \
                    //...

            - name: Optional ./test.sh
              run: |
                  if [[ -f ./test.sh ]]; then
                    ./test.sh
                  else
                    echo "No test.sh in ${PWD}; skipping"
                  fi

    # Mac/Windows smoke tests - only e2e/bzlmod
    # Only run on main branch (not PRs) to minimize minutes (billed at 10X and 2X respectively)
    # https://docs.github.com/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions#included-storage-and-minutes
    smoke:
        if: github.ref_name == 'main' || contains(github.head_ref, 'macos') || contains(github.head_ref, 'windows')
        runs-on: ${{ matrix.os }}
        defaults:
            run:
                working-directory: e2e/bzlmod
        strategy:
            fail-fast: false
            matrix:
                os: [macos-latest, windows-latest]
        env:
            ASPECT_RULES_JS_FROZEN_PNPM_LOCK: 1
        steps:
            - uses: actions/checkout@v6

            - uses: bazel-contrib/setup-bazel@0.18.0
              with:
                  bazelisk-cache: true
                  disk-cache: ${{ matrix.os }}-bzlmod
                  repository-cache: true

            - name: bazel test //...
              shell: bash
              run: |
                  bazel test \
                    --test_tag_filters=-skip-on-bazel7 \
                    --build_tag_filters=-skip-on-bazel7 \
                    //...

    # For branch protection settings, this job provides a "stable" name that can be used to gate PR merges
    # on "all matrix jobs were successful".
    conclusion:
        needs: [test, smoke]
        runs-on: ubuntu-latest
        if: always()
        steps:
            - run: |
                  if [[ "${{ needs.test.result }}" == "success" && ("${{ needs.smoke.result }}" == "success" || "${{ needs.smoke.result }}" == "skipped") ]]; then
                    exit 0
                  else
                    exit 1
                  fi