_test.yaml

name: _test

on:
  workflow_call:
    inputs:
      no-cache:
        description: Skip test cache check and run all tests without cache
        type: boolean
        default: false

env:
  BODY_LIMIT: "1048576000"

jobs:
  test:
    # hz self-hosted DinD runner — this job runs pl-compose (docker compose up a
    # Platforma backend), so it needs a real Docker daemon.
    runs-on: hz-ubuntu-dind
    steps:
      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.GH_ZEN_APP_ID }}
          private-key: ${{ secrets.GH_ZEN_APP_PRIVATE_KEY }}

      - uses: actions/checkout@v4
        with:
          token: ${{ steps.app-token.outputs.token }}
          fetch-depth: 0

      - uses: ./.github/actions/setup
        with:
          npmjs-token: ${{ secrets.NPMJS_TOKEN }}
          github-token: ${{ steps.app-token.outputs.token }}
          aws-iam-role: ${{ secrets.AWS_CI_IAM_MONOREPO_SIMPLE_ROLE }}
          # Caches → RGW: turbo to ci-turbo-cache, pnpm to ci-actions-cache (both
          # use-fallback → GitHub). Shared org secrets/vars (selected to platforma).
          turbo-s3-bucket: ${{ vars.HZ_CI_TURBO_S3_BUCKET }}
          turbo-s3-endpoint: https://${{ vars.HZ_CI_TURBO_S3_ENDPOINT }}
          turbo-s3-region: ${{ vars.HZ_CI_TURBO_S3_REGION }}
          turbo-s3-access-key: ${{ secrets.HZ_CI_TURBO_S3_ACCESS_KEY }}
          turbo-s3-secret-key: ${{ secrets.HZ_CI_TURBO_S3_SECRET_KEY }}
          cache-s3-access-key: ${{ secrets.HZ_CI_CACHE_S3_ACCESS_KEY }}
          cache-s3-secret-key: ${{ secrets.HZ_CI_CACHE_S3_SECRET_KEY }}
          quay-username: ${{ secrets.QUAY_USERNAME }}
          quay-robot-token: ${{ secrets.QUAY_ROBOT_TOKEN }}

      - name: Check test cache (dry-run)
        if: ${{ !inputs.no-cache }}
        id: dry-run
        run: |
          pnpm run test:local+dry-run > ./test-dry-run.json || true
          SKIP_TESTS=$(sed -n '/^{/,$p' ./test-dry-run.json | jq -r '.tasks | map(select(.task == "test")) | all((.cache.status == "HIT") or (.cache.status == "MISS" and .command == "<NONEXISTENT>"))' 2>/dev/null || echo "false")
          echo "skip=$SKIP_TESTS" >> "$GITHUB_OUTPUT"
          echo "Test cache skip: $SKIP_TESTS"

      - name: Build
        if: inputs.no-cache || steps.dry-run.outputs.skip != 'true'
        env:
          NPMJS_TOKEN: ${{ secrets.NPMJS_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PL_DOCKER_REGISTRY_PUSH_TO: "quay.io/milaboratories/pl-containers"
        run: pnpm run ci:build:local

      - name: Structure check (internal blocks)
        if: inputs.no-cache || steps.dry-run.outputs.skip != 'true'
        env:
          NPMJS_TOKEN: ${{ secrets.NPMJS_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        # Gate: every block under etc/blocks/* must be up to date with the
        # canonical structure (block-tools structure check --sdk-internal).
        # block-tools is built by the preceding Build step.
        run: pnpm run check-blocks

      - name: Login to ECR
        if: inputs.no-cache || steps.dry-run.outputs.skip != 'true'
        id: ecr-login
        uses: aws-actions/amazon-ecr-login@v2
        with:
          mask-password: "true"

      - name: Start Platforma Docker
        if: inputs.no-cache || steps.dry-run.outputs.skip != 'true'
        uses: milaboratory/github-ci/actions/docker/pl-compose@v4
        env:
          PL_LICENSE: ${{ secrets.MI_LICENSE }}
          MI_LICENSE: ${{ secrets.MI_LICENSE }}
          # The local runner serves a scratch request out of the command's working directory,
          # which is what exec.test.ts's scratch cases assert. pl #2192 made that opt-in, so
          # without this the backend advertises no scratch and those tests skip themselves.
          PL_HAS_SCRATCH_SPACE: "true"
        with:
          pl-docker-registry: ${{ format('{0}/{1}', steps.ecr-login.outputs.registry, 'pl') }}
          pl-docker-tag: main
          pl-test-assets-dir: assets
          pl-log-level: info

      - name: Run tests
        if: inputs.no-cache || steps.dry-run.outputs.skip != 'true'
        env:
          PL_ADDRESS: "http://127.0.0.1:6345"
          PL_TEST_USER: ${{ secrets.PL_CI_TEST_USER }}
          PL_TEST_PASSWORD: ${{ secrets.PL_CI_TEST_PASSWORD }}
          PL_LICENSE: ${{ secrets.MI_LICENSE }}
          MI_LICENSE: ${{ secrets.MI_LICENSE }}
          NPMJS_TOKEN: ${{ secrets.NPMJS_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: pnpm run ${{ inputs.no-cache && 'ci:test:local+no-cache' || 'ci:test:local' }}

      - name: Upload coverage
        if: always()
        uses: milaboratory/github-ci/actions/node/upload-coverage@v4
        with:
          test-coverage-reports: "**/coverage/lcov.info"
          test-results-reports: "**/test-report.junit.xml"