test.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  lint-typecheck:
    name: Lint & Typecheck
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Install web dependencies
        # web/ is a separate Bun project with its own lockfile. `tsc -b` follows
        # the project reference into web/tsconfig.json, so its node_modules
        # (e.g. @testing-library/dom) must be present for the typecheck to resolve.
        run: cd web && bun install --frozen-lockfile

      - name: Lint (oxlint)
        run: oxlint .

      - name: Typecheck
        run: tsc -b

  test-unit:
    name: Unit Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run backend unit tests
        run: just test-backend

      - name: Run web unit tests
        run: just test-web

      - name: Run TLS integration tests (Node runner)
        run: just test-integration

  test-build:
    name: Build Verification
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build Electron app
        run: just build

  test-e2e:
    name: E2E Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Ensure Electron binary is installed
        run: |
          # electron's install.js downloads the platform zip into @electron/get's
          # cache reliably, but in CI its async extraction doesn't finish before the
          # process exits, leaving node_modules/electron/dist half-written (no electron
          # binary or chrome-sandbox). Run install.js to populate the download cache,
          # then extract the cached zip ourselves with unzip (synchronous, complete).
          rm -rf node_modules/electron/dist node_modules/electron/path.txt
          node node_modules/electron/install.js || true
          zip="$(ls -1 "$HOME"/.cache/electron/*/electron-*-linux-x64.zip | head -n1)"
          rm -rf node_modules/electron/dist
          mkdir -p node_modules/electron/dist
          unzip -q "$zip" -d node_modules/electron/dist
          printf 'electron' > node_modules/electron/path.txt
          # Guard: fail here (not in the chown step) if extraction ever regresses.
          test -f node_modules/electron/dist/chrome-sandbox

      - name: Fix Electron chrome-sandbox permissions
        run: |
          sudo chown root:root node_modules/electron/dist/chrome-sandbox
          sudo chmod 4755 node_modules/electron/dist/chrome-sandbox

      - name: Get Playwright version
        id: pw-version
        run: echo "version=$(bunx playwright --version | awk '{print $2}')" >> "$GITHUB_OUTPUT"

      - name: Cache Playwright browsers
        id: pw-cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-${{ steps.pw-version.outputs.version }}

      - name: Install Playwright browsers
        if: steps.pw-cache.outputs.cache-hit != 'true'
        run: bunx playwright install --with-deps chromium

      - name: Install Playwright system deps
        if: steps.pw-cache.outputs.cache-hit == 'true'
        run: bunx playwright install-deps chromium

      - name: Build Electron app
        run: just build

      - name: Install Xvfb
        run: sudo apt-get install -y xvfb

      - name: Run E2E tests
        run: xvfb-run --auto-servernum just test-e2e-run

      - name: Upload Playwright report
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        with:
          name: playwright-results
          path: |
            web/test-results/
            electron/e2e/test-results/
          retention-days: 30
          if-no-files-found: ignore

  test-runbooks:
    name: Runbook Tests
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Compile test CLI
        run: just compile-test-cli

      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
        with:
          role-to-assume: ${{ secrets.RUNBOOKS_TEST_AWS_ROLE_ARN }}
          aws-region: us-west-2

      - name: Export test credentials
        env:
          ORIG_KEY_ID: ${{ env.AWS_ACCESS_KEY_ID }}
          ORIG_SECRET: ${{ env.AWS_SECRET_ACCESS_KEY }}
          ORIG_TOKEN: ${{ env.AWS_SESSION_TOKEN }}
          ORIG_REGION: ${{ env.AWS_REGION }}
        run: |
          echo "RUNBOOKS_TEST_AWS_ACCESS_KEY_ID=${ORIG_KEY_ID}" >> "$GITHUB_ENV"
          echo "RUNBOOKS_TEST_AWS_SECRET_ACCESS_KEY=${ORIG_SECRET}" >> "$GITHUB_ENV"
          echo "RUNBOOKS_TEST_AWS_SESSION_TOKEN=${ORIG_TOKEN}" >> "$GITHUB_ENV"
          echo "RUNBOOKS_TEST_AWS_REGION=${ORIG_REGION}" >> "$GITHUB_ENV"

      - name: Run runbook tests
        env:
          RUNBOOKS_GITHUB_TOKEN: ${{ secrets.RUNBOOKS_GITHUB_TOKEN }}
        run: resources/bin/runbooks-test test testdata/...

  test-runbooks-app-token:
    name: Runbook Tests (GitHub App Token)
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Compile test CLI
        run: just compile-test-cli

      - name: Run GitHub auth flows with installation token
        env:
          # No RUNBOOKS_GITHUB_TOKEN: force the executor's fallback chain
          # (RUNBOOKS_GITHUB_TOKEN -> GITHUB_TOKEN -> GH_TOKEN) to land on the
          # ghs_ installation token, exercising validateInstallationToken.
          GITHUB_TOKEN: ${{ github.token }}
        run: resources/bin/runbooks-test test testdata/feature-demos/github-auth/...

  test-docs:
    name: Documentation Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0

      - name: Run docs tests
        run: just test-docs

  ci-summary:
    name: CI Summary
    needs:
      [
        lint-typecheck,
        test-unit,
        test-build,
        test-e2e,
        test-runbooks,
        test-runbooks-app-token,
        test-docs,
      ]
    runs-on: ubuntu-latest
    if: always()
    steps:
      - name: Check results
        env:
          LINT_RESULT: ${{ needs.lint-typecheck.result }}
          UNIT_RESULT: ${{ needs.test-unit.result }}
          BUILD_RESULT: ${{ needs.test-build.result }}
          E2E_RESULT: ${{ needs.test-e2e.result }}
          RUNBOOKS_RESULT: ${{ needs.test-runbooks.result }}
          RUNBOOKS_APP_RESULT: ${{ needs.test-runbooks-app-token.result }}
          DOCS_RESULT: ${{ needs.test-docs.result }}
        run: |
          for result in "$LINT_RESULT" "$UNIT_RESULT" "$BUILD_RESULT" "$E2E_RESULT" "$RUNBOOKS_RESULT" "$RUNBOOKS_APP_RESULT" "$DOCS_RESULT"; do
            if [ "$result" != "success" ] && [ "$result" != "skipped" ]; then
              echo "CI failed!"
              exit 1
            fi
          done
          echo "All checks passed!"