ci-tests.yml

name: Test

on:
  workflow_call:
    inputs:
      should_skip:
        description: "Whether to skip the workflow"
        required: false
        type: string
        default: "false"
      webapp_changed:
        description: "Whether webapp files changed"
        required: false
        type: string
        default: "true"
      application_server_changed:
        description: "Whether application-server files changed"
        required: false
        type: string
        default: "true"
      e2e_changed:
        description: "Whether browser E2E runtime files changed"
        required: false
        type: string
        default: "true"
      postgres_image_changed:
        description: "Whether PostgreSQL image inputs changed"
        required: false
        type: string
        default: "false"
    secrets:
      CHROMATIC_PROJECT_TOKEN:
        required: false
      SURGE_TOKEN:
        required: false

permissions: {}

env:
  SERVER_REACTOR_ARTIFACT: server-reactor-${{ github.run_id }}-${{ github.run_attempt }}

jobs:
  server-build:
    name: "App Server: Reactor"
    if: inputs.should_skip != 'true' && (inputs.application_server_changed == 'true' || inputs.e2e_changed == 'true')
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      checks: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup-node-pnpm
        with:
          install: "none"
      - uses: ./.github/actions/setup-caches
        with:
          cache-type: application-server-verification
          os: ${{ runner.os }}
      - name: Build reactor
        run: |
          rm -rf server/application/target/surefire-reports/*
          cd server
          if [[ "${INPUTS_APPLICATION_SERVER_CHANGED}" == "true" ]]; then
            ./mvnw -pl application -am package -Parchitecture-tests \
              -Dsurefire.includedGroups=unit,architecture -DskipCoverage=false --batch-mode
          else
            ./mvnw -pl application -am package -DskipTests --batch-mode
          fi
        env:
          INPUTS_APPLICATION_SERVER_CHANGED: ${{ inputs.application_server_changed }}
      - name: Validate built reactor
        run: |
          test -d server/application/target/classes
          test -d server/application/target/test-classes
          mapfile -t APPLICATION_JARS < <(find server/application/target -maxdepth 1 -name 'hephaestus-application-*.jar' ! -name '*-sources.jar' ! -name '*-javadoc.jar')
          mapfile -t CLIENT_JARS < <(find server/generated-clients/target -maxdepth 1 -name 'hephaestus-generated-clients-*.jar' ! -name '*-sources.jar' ! -name '*-javadoc.jar')
          (( ${#APPLICATION_JARS[@]} > 0 ))
          (( ${#CLIENT_JARS[@]} > 0 ))
      - name: Upload built reactor
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ env.SERVER_REACTOR_ARTIFACT }}
          path: |
            server/application/target/classes
            server/application/target/test-classes
            server/application/target/*.jar
            server/generated-clients/target/classes
            server/generated-clients/target/*.jar
            !server/application/target/*-sources.jar
            !server/application/target/*-javadoc.jar
            !server/generated-clients/target/*-sources.jar
            !server/generated-clients/target/*-javadoc.jar
          if-no-files-found: error
          retention-days: 1
          compression-level: 0
      - name: Upload test results
        if: always() && inputs.application_server_changed == 'true'
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        with:
          name: "Test Results - App Server Verification"
          path: "server/application/target/surefire-reports/TEST-*.xml"
          reporter: java-junit
          fail-on-error: false

  server-integration:
    name: "App Server: Integration"
    if: inputs.should_skip != 'true' && inputs.application_server_changed == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
      checks: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup-node-pnpm
        with:
          install: "none"
      - uses: ./.github/actions/setup-caches
        with:
          cache-type: application-server-integration
          os: ${{ runner.os }}
      - name: Run integration tests
        run: |
          rm -rf server/application/target/surefire-reports/*
          pnpm run test:server:integration
      - name: Upload test results
        if: always()
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        with:
          name: "Test Results - App Server Integration"
          path: "server/application/target/surefire-reports/TEST-*.xml"
          reporter: java-junit
          fail-on-error: false

  webapp-storybook:
    name: "Webapp: Stories"
    if: inputs.should_skip != 'true' && inputs.webapp_changed == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      checks: write
      pull-requests: write
      statuses: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: ./.github/actions/setup-node-pnpm
        with:
          install: "frozen"
      - uses: ./.github/actions/setup-browsers
      - name: Run story tests and generated-asset check
        id: tests
        continue-on-error: true
        run: |
          timeout --kill-after=30s 15m pnpm --filter webapp run test:storybook
          pnpm --filter webapp run export:assets
          BRAND_ASSETS=(webapp/brand webapp/public docs/images/readme docs/static/img/brand docs/static/img/favicon.png docs/static/img/hephaestus-social-card.png docker/compose.proxy.yaml)
          if [[ -n "$(git status --porcelain --untracked-files=all -- "${BRAND_ASSETS[@]}")" ]]; then
            echo "::error::Brand assets are stale. Run 'pnpm --filter webapp run export:assets' and commit the result."
            git status --short --untracked-files=all -- "${BRAND_ASSETS[@]}"
            exit 1
          fi
      - name: Build Storybook with dependency stats
        run: |
          pnpm --filter webapp run build-storybook
          test -s webapp/storybook-static/preview-stats.json
      - name: Chromatic visual testing
        id: chromatic
        continue-on-error: true
        if: >-
          success() &&
          (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
        uses: chromaui/action@4cc98810d00b34b8f9e89d454d64a8ac3d088340 # v18.7.1
        with:
          projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
          workingDir: webapp
          storybookBuildDir: storybook-static
          onlyChanged: true
          zip: true
          skip: "@(dependabot/**|renovate/**)"
          autoAcceptChanges: ${{ github.ref == 'refs/heads/main' && 'main' || '' }}
          exitZeroOnChanges: false
          logLevel: info
          junitReport: true
        env:
          CHROMATIC_BRANCH: ${{ github.head_ref || github.ref_name }}
          CHROMATIC_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
      - name: Deploy public Storybook preview
        id: storybook_preview
        if: >-
          github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository &&
          startsWith(steps.chromatic.outputs.storybookUrl, 'http')
        env:
          PREVIEW_URL: ls1intum-hephaestus-storybook-pr-${{ github.event.number }}.surge.sh
          SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }}
        run: ./node_modules/.bin/surge ./webapp/storybook-static "$PREVIEW_URL" --token "$SURGE_TOKEN"
      - name: Add Storybook preview to the pull request
        if: steps.storybook_preview.outcome == 'success'
        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
        with:
          header: storybook-preview
          message: |
            ## 🧩 Storybook Preview

            Review this pull request's components and interaction states:

            🔗 **[View Storybook Preview](https://ls1intum-hephaestus-storybook-pr-${{ github.event.number }}.surge.sh)**

            <sub>Preview for commit ${{ github.event.pull_request.head.sha }}. Updates automatically on new commits.</sub>
      - name: Create Storybook status check
        if: >-
          always() && startsWith(steps.chromatic.outputs.storybookUrl, 'http') &&
          (github.event_name != 'pull_request' || steps.storybook_preview.outcome == 'success')
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const storybookUrl = context.payload.pull_request
              ? 'https://ls1intum-hephaestus-storybook-pr-${{ github.event.number }}.surge.sh'
              : '${{ steps.chromatic.outputs.storybookUrl }}';
            await github.rest.repos.createCommitStatus({
              owner: context.repo.owner,
              repo: context.repo.repo,
              sha: context.payload.pull_request?.head?.sha || context.sha,
              state: 'success',
              target_url: storybookUrl,
              description: 'Click Details to view your Storybook',
              context: 'Preview / Storybook'
            });
      - name: Upload Storybook test results
        if: always()
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        with:
          name: "Test Results - Webapp Stories"
          path: "webapp/test-results/junit-storybook.xml"
          reporter: java-junit
          fail-on-error: false
      - name: Upload Chromatic test results
        if: always() && startsWith(steps.chromatic.outputs.storybookUrl, 'http')
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        with:
          name: "Test Results - Chromatic"
          path: "webapp/chromatic-build-*.xml"
          reporter: java-junit
          fail-on-error: false
      - name: Evaluate stories checks
        if: always()
        env:
          STORYBOOK_TESTS: ${{ steps.tests.outcome }}
          CHROMATIC: ${{ steps.chromatic.outcome }}
        run: |
          if [ "$STORYBOOK_TESTS" != success ] || { [ "$CHROMATIC" != success ] && [ "$CHROMATIC" != skipped ]; }; then
            echo "::error::Storybook tests or Chromatic failed; review both independently reported steps."
            exit 1
          fi

  webapp-e2e:
    name: "Webapp: E2E"
    needs: server-build
    if: inputs.should_skip != 'true' && inputs.e2e_changed == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 25
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup-node-pnpm
        with:
          install: "frozen"
      - uses: ./.github/actions/setup-caches
        with:
          cache-type: webapp-e2e
          os: ${{ runner.os }}
      - uses: ./.github/actions/setup-browsers
      - name: Download built reactor
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ env.SERVER_REACTOR_ARTIFACT }}
          path: server
      - name: Run end-to-end tests against the built server
        run: |
          # The base image may still be publishing; build the same Dockerfile as fallback.
          if [[ "${INPUTS_POSTGRES_IMAGE_CHANGED}" == "true" ]] ||
            ! docker pull ghcr.io/hephaestus-build/postgres:${{ github.event.pull_request.base.sha || github.sha }}; then
            docker build -t ghcr.io/hephaestus-build/postgres:dev docker/postgres
          else
            docker tag ghcr.io/hephaestus-build/postgres:${{ github.event.pull_request.base.sha || github.sha }} ghcr.io/hephaestus-build/postgres:dev
          fi
          docker compose -f server/compose.yaml up -d --wait --no-build postgres
          cleanup() {
            if [[ -n "${SERVER_PID:-}" ]]; then
              kill -TERM -- "-$SERVER_PID" 2>/dev/null || true
              (sleep 10; kill -KILL -- "-$SERVER_PID" 2>/dev/null || true) &
              KILL_WATCHDOG=$!
              wait "$SERVER_PID" 2>/dev/null || true
              if kill -0 -- "-$SERVER_PID" 2>/dev/null; then
                wait "$KILL_WATCHDOG" 2>/dev/null || true
              else
                kill "$KILL_WATCHDOG" 2>/dev/null || true
                wait "$KILL_WATCHDOG" 2>/dev/null || true
              fi
            fi
            docker compose -f server/compose.yaml down -v
          }
          trap cleanup EXIT
          mapfile -t SERVER_JARS < <(find server/application/target -maxdepth 1 -name 'hephaestus-application-*.jar' ! -name '*-sources.jar' ! -name '*-javadoc.jar')
          (( ${#SERVER_JARS[@]} == 1 ))
          SERVER_JAR=${SERVER_JARS[0]}
          SERVER_PORT=8080 MANAGEMENT_PORT=8080 POSTGRES_PORT=5432 \
            SPRING_DOCKER_COMPOSE_ENABLED=false APPLICATION_HOST_URL=http://localhost:4200 \
            setsid java -jar "$SERVER_JAR" --spring.profiles.active=e2e,playwright > e2e-server.log 2>&1 &
          SERVER_PID=$!
          timeout 5m bash -c 'until curl --fail --silent http://localhost:8080/actuator/health/liveness >/dev/null; do kill -0 '"${SERVER_PID}"' || exit 1; sleep 2; done'
          curl --fail --silent --show-error -X POST http://localhost:8080/auth/dev-login \
            -H 'content-type: application/json' -d '{"username":"e2e","admin":true}' >/dev/null
          docker compose -f server/compose.yaml exec -T postgres \
            psql -v ON_ERROR_STOP=1 -U root -d hephaestus < webapp/e2e/seed.sql
          timeout --kill-after=30s 10m pnpm --filter webapp run test:e2e
        env:
          INPUTS_POSTGRES_IMAGE_CHANGED: ${{ inputs.postgres_image_changed }}
      - name: Upload diagnostics
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: webapp-e2e-results
          path: |
            webapp/test-results
            e2e-server.log
          if-no-files-found: warn
          retention-days: 7