test.yml

name: "Test"
on:
  pull_request:
  merge_group:
  push:
    branches:
      - master

jobs:
  changes:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    outputs:
      package-lock-json: ${{ steps.filter.outputs.package-lock-json }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            package-lock-json:
              - 'frontend/package-lock.json'
  test-controller:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-nix
        with:
          attic_token: ${{ secrets.ATTIC_TOKEN }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
      - name: Configure poetry
        run: |
          nix develop .#ci --command poetry config virtualenvs.in-project true

      - name: Cache the virtualenv
        uses: actions/cache@v4
        with:
          path: ./controller/.venv
          key: ${{ runner.os }}-venv-${{ hashFiles('**/poetry.lock') }}

      - name: Cache dev env
        uses: ./.github/actions/run-command-with-nix-cache-upload
        with:
          attic_token: ${{ secrets.ATTIC_TOKEN }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            nix develop .#ci --command echo "Cache dev env"

      - name: Install dependencies
        run: |
          nix develop .#ci --command poetry install
        working-directory: controller

      - name: Run tests
        run: |
          nix develop .#ci --command poetry run python -m pytest -sxv
        working-directory: controller

  test-frontend-integration:
    runs-on: ubuntu-22.04-arm
    needs: changes
    if: ${{ ! (needs.changes.outputs.package-lock-json == 'true' && github.actor == 'renovate[bot]' && github.event_name == 'pull_request') }}
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-nix
        with:
          attic_token: ${{ secrets.ATTIC_TOKEN }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
      - name: Install dependencies
        run: |
          npm ci
        working-directory: frontend
      - name: Build application
        uses: ./.github/actions/run-command-with-nix-cache-upload
        with:
          attic_token: ${{ secrets.ATTIC_TOKEN }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            nix build .#thymis-controller --print-build-logs
      - name: Run tests
        uses: ./.github/actions/run-command-with-nix-cache-upload
        with:
          attic_token: ${{ secrets.ATTIC_TOKEN }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            set +e  # revert the default `set -e`
            export THYMIS_FLAKE_ROOT='..'
            nix develop .#onlyPlaywrightBrowsers --command npm run test 2>&1 | tee output.log
            PLAYWRIGHT_EXIT_CODE=$?
            if grep -q -e "Error: A snapshot doesn't exist at" -e "Screenshot comparison failed" output.log; then
              echo "Playwright tests failed due to a snapshot issue"
              echo "SNAPSHOT_DIFFERENCES=true" >> $GITHUB_ENV
            fi
            if grep -q -E -e "npx playwright install" -e "error: attribute '\"[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+\"' missing" output.log; then
              echo "Playwright tests failed due to missing browsers"
              echo "MISSING_BROWSERS=true" >> $GITHUB_ENV
            fi
            if grep -q -E -e "[[:digit:]]+ failed" -e "was not able to start" output.log; then
              echo "Playwright tests failed"
              exit 1
            fi
            exit $PLAYWRIGHT_EXIT_CODE
          working-directory: frontend
      - uses: actions/upload-artifact@v4
        id: artifact-upload
        if: always()
        with:
          name: playwright-report
          path: frontend/playwright-report/
          retention-days: 30
      - name: Comment on PR with report link
        uses: thollander/actions-comment-pull-request@v3
        if: ${{ always() && github.event_name == 'pull_request' && env.SNAPSHOT_DIFFERENCES == 'true' }}
        with:
          message: |
            ### Playwright visual snapshot differences were detected.
            View the [Playwright report](${{ steps.artifact-upload.outputs.artifact-url }}) to review the visual differences.
            **To approve the snapshot changes and update the snapshots, please comment:** /approve-snapshots
          comment-tag: playwright-snapshots
          mode: recreate
      - name: Get Thymis App Token
        id: generate-token
        if: ${{ failure() && env.MISSING_BROWSERS == 'true' }}
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ vars.THYMIS_APP_ID }}
          private-key: ${{ secrets.THYMIS_APP_PRIVATE_KEY }}
      - uses: actions/checkout@v4
        if: ${{ failure() && env.MISSING_BROWSERS == 'true' }}
        with:
          token: ${{ steps.generate-token.outputs.token }}
          path: thymis-2
          ref: ${{ github.head_ref || github.ref_name }}
      - name: check if failed because of playwright hash failure, in that case, commit the new hash
        if: ${{ failure() && env.MISSING_BROWSERS == 'true' }}
        env:
          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
          BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
        run: |
          cd thymis-2
          USER_NAME=${{ steps.generate-token.outputs.app-slug }}[bot]
          USER_ID=$(gh api "/users/${USER_NAME}" --jq '.id')
          USER_EMAIL="${USER_ID}+${{ steps.generate-token.outputs.app-slug }}[bot]@users.noreply.github.com"
          git config user.email $USER_EMAIL
          git config user.name $USER_NAME

          # get version of playwright using jq (./frontend/package-lock.json)
          playwrightVersion=$(jq -r '.packages["node_modules/playwright-core"].version' ../frontend/package-lock.json)

          # call ./nix/playwright-by-version/add-version.sh with the playwright version
          ./nix/playwright-by-version/add-version.sh $playwrightVersion

          # if this is a renovate PR (identify by the branch name, "renovate/" prefix)
          # then amend the commit instead of creating a new one, so that renovate does not panic
          # we need to force push in this case
          # additional condition: only if the last commits author is "renovate[bot]"
          lastCommitAuthor=$(git log -1 --pretty=format:'%an')
          echo "last commit author: '$lastCommitAuthor'"
          # only push if no changes were made to the branch since this added
          if [[ ${{ github.event.pull_request.head.sha || github.sha }} == $(git rev-parse HEAD) ]]; then
            git commit -m "chore(nix,automation): add playwright version $playwrightVersion"
            git push
          else
            echo "Changes were made to the branch since the last commit, not pushing"
          fi

  test-frontend-integration-stable-input:
    runs-on: ubuntu-22.04-arm
    needs: changes
    if: ${{ ! (needs.changes.outputs.package-lock-json == 'true' && github.actor == 'renovate[bot]' && github.event_name == 'pull_request') }}
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-nix
        with:
          attic_token: ${{ secrets.ATTIC_TOKEN }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
      - name: Install dependencies
        run: |
          npm ci
        working-directory: frontend
      - name: Build application
        uses: ./.github/actions/run-command-with-nix-cache-upload
        with:
          attic_token: ${{ secrets.ATTIC_TOKEN }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            nix build .#thymis-controller --print-build-logs
      - name: Run tests
        uses: ./.github/actions/run-command-with-nix-cache-upload
        with:
          attic_token: ${{ secrets.ATTIC_TOKEN }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            nix develop .#onlyPlaywrightBrowsers --command npm run test 2>&1 | tee output.log
            if grep -q -e "Error: A snapshot doesn't exist at" -e "Screenshot comparison failed" output.log; then
              echo "Playwright tests failed due to a snapshot issue"
              echo "SNAPSHOT_DIFFERENCES=true" >> $GITHUB_ENV
            fi
            if grep -q -E -e "[[:digit:]]+ failed" -e "was not able to start" output.log; then
              echo "Playwright tests failed"
              exit 1
            fi
          working-directory: frontend
      - uses: actions/upload-artifact@v4
        id: artifact-upload
        if: always()
        with:
          name: playwright-report-stable-input
          path: frontend/playwright-report/
          retention-days: 30
      - name: Comment on PR with report link
        uses: thollander/actions-comment-pull-request@v3
        if: ${{ always() && github.event_name == 'pull_request' && env.SNAPSHOT_DIFFERENCES == 'true' }}
        with:
          message: |
            ### Playwright visual snapshot differences were detected.
            View the [Playwright report](${{ steps.artifact-upload.outputs.artifact-url }}) to review the visual differences.
            **To approve the snapshot changes and update the snapshots, please comment:** /approve-snapshots
          comment-tag: playwright-snapshots
          mode: recreate

  test-pre-commit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: 3.13
      - name: Install pre-commit
        run: |
          python -m pip install pre-commit
      - name: Install node dependencies
        run: |
          npm ci
        working-directory: frontend
      - name: Run pre-commit
        run: |
          pre-commit run --all-files