ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  # The release workflow runs the same checks on the tagged commit before publishing anything (spec 009).
  workflow_call:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  DOTNET_NOLOGO: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true

jobs:
  dotnet:
    name: .NET (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      # Full history: MinVer computes the package version from the tags (D-179).
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: actions/setup-dotnet@v6
        with:
          global-json-file: global.json

      # The integration tests build the psrunner wheel and create real Python environments with uv.
      - uses: astral-sh/setup-uv@v10.3.0

      # The Release build embeds the Vue panel (npm ci + npm run build in panel/; D-155).
      - uses: actions/setup-node@v7
        with:
          node-version-file: panel/.nvmrc
          cache: npm
          cache-dependency-path: panel/package-lock.json

      - name: Restore
        run: dotnet restore

      - name: Build
        run: dotnet build --no-restore --configuration Release

      # AC-5 in dry-run: the 7 packages (6 libraries + the psr tool) with one version, symbols included.
      - name: Pack (dry run)
        if: runner.os == 'Linux'
        run: |
          dotnet pack PythonScriptRunner.slnx --no-build --configuration Release --output artifacts/packages
          ls artifacts/packages
          count=$(ls artifacts/packages/*.nupkg | wc -l)
          versions=$(ls artifacts/packages/*.nupkg | sed -E 's#.*/PythonScriptRunner(\.[A-Za-z]+)+\.([0-9].*)\.nupkg#\2#' | sort -u | wc -l)
          test "$count" -eq 7 || { echo "Expected 7 packages, got $count"; exit 1; }
          test "$versions" -eq 1 || { echo "The packages do not share one version"; exit 1; }
          test "$(ls artifacts/packages/*.snupkg | wc -l)" -eq 7 || { echo "Missing symbol packages"; exit 1; }

      # weasyprint (CS-2 fixture, html-para-pdf) renders with pango.
      - name: Install pango
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libpango-1.0-0 libpangoft2-1.0-0 libharfbuzz0b fonts-dejavu-core

      # The panel E2E tests drive Chromium with Playwright (spec 008; D-149, D-156).
      - name: Install Chromium
        if: runner.os == 'Linux'
        run: pwsh tests/PythonScriptRunner.Panel.E2E.Tests/bin/Release/net10.0/playwright.ps1 install --with-deps chromium

      # The persistence, queue, worker, dashboard and panel tests start PostgreSQL 16, RabbitMQ 3.13 and Mailpit with
      # Testcontainers (Docker); GitHub's Windows runners cannot run Linux containers, so Windows runs the Core tests only.
      - name: Test
        if: runner.os == 'Linux'
        run: dotnet test --no-build --configuration Release --solution tests/PythonScriptRunner.SemE2E.slnf --filter-not-trait "Category=Timing"

      # The tests that assert a duration (timeout, cancellation, latency, p95) run alone and one at a time: next to the
      # other test projects, the runner's shared CPU made them miss their limits by a few milliseconds (D-188).
      - name: Test (timing)
        if: runner.os == 'Linux'
        run: |
          for project in Core Dashboard Worker; do
            dotnet test --no-build --configuration Release --project "tests/PythonScriptRunner.$project.Tests" --filter-trait "Category=Timing" --parallel none
          done

      # The panel E2E tests run alone: containers starting or stopping in the other test projects change the host's network
      # interfaces, and Chromium then aborts requests in flight with ERR_NETWORK_CHANGED.
      - name: Test (panel E2E)
        if: runner.os == 'Linux'
        run: dotnet test --no-build --configuration Release --project tests/PythonScriptRunner.Panel.E2E.Tests

      - name: Upload Playwright traces
        if: failure() && runner.os == 'Linux'
        uses: actions/upload-artifact@v7
        with:
          name: playwright-traces
          path: tests/PythonScriptRunner.Panel.E2E.Tests/bin/Release/net10.0/TestResults/traces/
          if-no-files-found: ignore

      - name: Test (Core)
        if: runner.os == 'Windows'
        run: dotnet test --no-build --configuration Release --project tests/PythonScriptRunner.Core.Tests

  quality:
    name: Quality
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: actions/setup-dotnet@v6
        with:
          global-json-file: global.json

      - uses: astral-sh/setup-uv@v10.3.0

      - uses: actions/setup-node@v7
        with:
          node-version-file: panel/.nvmrc
          cache: npm
          cache-dependency-path: panel/package-lock.json

      - name: Verify formatting
        run: dotnet format --verify-no-changes

      # Dependency audit (spec 009): known vulnerabilities in NuGet packages (transitive included), in the panel's
      # runtime npm packages (high and critical) and in the Python SDK's dependencies.
      - name: Audit NuGet packages
        run: |
          dotnet list PythonScriptRunner.slnx package --vulnerable --include-transitive | tee vulnerable.txt
          if grep -q "has the following vulnerable packages" vulnerable.txt; then exit 1; fi

      - name: Audit npm packages
        working-directory: panel
        run: npm audit --omit=dev --audit-level=high

      - name: Audit Python packages
        working-directory: python/psrunner
        run: |
          uv export --frozen --no-dev --no-emit-project --no-hashes --format requirements-txt > requirements-audit.txt
          uvx pip-audit --requirement requirements-audit.txt --no-deps --disable-pip

  # Spec 009, AC-3/AC-7/AC-8 and spec 001, AC-30: the host images as they run in production, and the docker-compose
  # generated by `aspire publish`.
  containers:
    name: Containers
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: actions/setup-dotnet@v6
        with:
          global-json-file: global.json

      - uses: docker/setup-buildx-action@v4

      - name: Build the worker image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: hosts/PythonScriptRunner.WorkerHost/Dockerfile
          tags: psr-worker:ci
          load: true
          cache-from: type=gha,scope=psr-worker
          cache-to: type=gha,scope=psr-worker,mode=max

      - name: Build the dashboard image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: hosts/PythonScriptRunner.DashboardHost/Dockerfile
          tags: psr-dashboard:ci
          load: true
          cache-from: type=gha,scope=psr-dashboard
          cache-to: type=gha,scope=psr-dashboard,mode=max

      - name: Install the Aspire CLI
        run: dotnet tool install --global Aspire.Cli --version 13.6.2

      - name: Test
        run: dotnet test --project tests/PythonScriptRunner.Containers.Tests
        env:
          PSR_TEST_WORKER_IMAGE: psr-worker:ci
          PSR_TEST_DASHBOARD_IMAGE: psr-dashboard:ci

      # A failed test keeps the logs of its containers (hosts, PostgreSQL, RabbitMQ, compose services).
      - name: Upload container logs
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: container-logs
          path: tests/PythonScriptRunner.Containers.Tests/bin/Debug/net10.0/TestResults/container-logs/
          if-no-files-found: ignore

  # Spec 009, AC-1/AC-2: the Aspire AppHost brings everything up and the author runs CS-1 and CS-2.
  apphost:
    name: Aspire AppHost
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: actions/setup-dotnet@v6
        with:
          global-json-file: global.json

      - uses: astral-sh/setup-uv@v10.3.0

      # The panel runs as a Vite app inside the AppHost.
      - uses: actions/setup-node@v7
        with:
          node-version-file: panel/.nvmrc
          cache: npm
          cache-dependency-path: panel/package-lock.json

      # weasyprint (CS-2) renders with pango.
      - name: Install pango
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libpango-1.0-0 libpangoft2-1.0-0 libharfbuzz0b fonts-dejavu-core

      - name: Test
        run: dotnet test --project tests/PythonScriptRunner.AppHost.Tests

  panel:
    name: Panel (Vue)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: panel
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version-file: panel/.nvmrc
          cache: npm
          cache-dependency-path: panel/package-lock.json

      - name: Install
        run: npm ci --no-audit --no-fund

      - name: Lint
        run: npm run lint

      - name: Type check
        run: npm run typecheck

      # The TypeScript types are generated from the versioned OpenAPI snapshot of the Dashboard tests (D-137).
      - name: API types up to date
        run: npm run api:check

      - name: Test
        run: npm test

      # vue-tsc + vite build + the initial bundle budget (≤ 500 KB gzip; spec 008).
      - name: Build
        run: npm run build

  python-sdk:
    name: psrunner (${{ matrix.os }}, Python ${{ matrix.python }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]
        python: ['3.10', '3.11', '3.12', '3.13']
        include:
          # Windows only on the default version to save Actions minutes.
          - os: windows-latest
            python: '3.12'
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        working-directory: python/psrunner
    steps:
      - uses: actions/checkout@v7

      - uses: astral-sh/setup-uv@v10.3.0
        with:
          python-version: ${{ matrix.python }}

      - name: Install
        run: uv sync --locked

      - name: Lint
        run: |
          uv run ruff check src tests
          uv run ruff format --check src tests

      - name: Type check
        run: uv run mypy

      - name: Test
        run: uv run pytest