test.yml

name: "Test"

on:
  pull_request:
    branches:
      - main
    paths:
      - "core/**"
      - "testbed/**"
      - "integrations/**"
      - "nix/**"
      - ".github/workflows/**"
  push:
    branches:
      - main
    paths:
      - "core/**"
      - "testbed/**"
      - "integrations/**"
      - "nix/**"
      - ".github/workflows/**"

permissions:
  id-token: write
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
      - uses: DeterminateSystems/determinate-nix-action@v3.21.2
        with:
          extra-conf: |
            accept-flake-config = true
            extra-substituters = https://cache.iog.io https://neohaskell.cachix.org
            extra-trusted-public-keys = hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ= neohaskell.cachix.org-1:mo2cLaGbwqbrxs9xhqKK8jeNsn3osi7t6XoAmxSZssc=
      - uses: DeterminateSystems/magic-nix-cache-action@v14
      - uses: actions/cache@v5
        with:
          path: dist-newstyle
          key: ${{ runner.os }}-cabal-${{ hashFiles('**/*.cabal', 'cabal.project') }}
          restore-keys: |
            ${{ runner.os }}-cabal-
      - name: Build the project with cabal
        run: nix develop --command cabal build all --disable-documentation
      - uses: actions/upload-artifact@v7
        with:
          name: dist-newstyle
          path: dist-newstyle
          compression-level: 0
          retention-days: 1
          if-no-files-found: error

  test-core:
    needs: [build]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
      - uses: DeterminateSystems/determinate-nix-action@v3.21.2
        with:
          extra-conf: |
            accept-flake-config = true
            extra-substituters = https://cache.iog.io https://neohaskell.cachix.org
            extra-trusted-public-keys = hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ= neohaskell.cachix.org-1:mo2cLaGbwqbrxs9xhqKK8jeNsn3osi7t6XoAmxSZssc=
      - uses: DeterminateSystems/magic-nix-cache-action@v14
      - uses: actions/download-artifact@v8
        with:
          name: dist-newstyle
          path: dist-newstyle
      - name: Run nhcore-test-core
        run: LOG_LEVEL=Warn nix develop --command cabal test nhcore-test-core

  test-auth:
    needs: [build]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
      - uses: DeterminateSystems/determinate-nix-action@v3.21.2
        with:
          extra-conf: |
            accept-flake-config = true
            extra-substituters = https://cache.iog.io https://neohaskell.cachix.org
            extra-trusted-public-keys = hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ= neohaskell.cachix.org-1:mo2cLaGbwqbrxs9xhqKK8jeNsn3osi7t6XoAmxSZssc=
      - uses: DeterminateSystems/magic-nix-cache-action@v14
      - uses: actions/download-artifact@v8
        with:
          name: dist-newstyle
          path: dist-newstyle
      - name: Run nhcore-test-auth
        run: LOG_LEVEL=Warn nix develop --command cabal test nhcore-test-auth

  test-integration:
    needs: [build]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
      - uses: DeterminateSystems/determinate-nix-action@v3.21.2
        with:
          extra-conf: |
            accept-flake-config = true
            extra-substituters = https://cache.iog.io https://neohaskell.cachix.org
            extra-trusted-public-keys = hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ= neohaskell.cachix.org-1:mo2cLaGbwqbrxs9xhqKK8jeNsn3osi7t6XoAmxSZssc=
      - uses: DeterminateSystems/magic-nix-cache-action@v14
      - uses: actions/download-artifact@v8
        with:
          name: dist-newstyle
          path: dist-newstyle
      - name: Run nhcore-test-integration
        run: LOG_LEVEL=Warn nix develop --command cabal test nhcore-test-integration

  test-service:
    needs: [build]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
      - uses: DeterminateSystems/determinate-nix-action@v3.21.2
        with:
          extra-conf: |
            accept-flake-config = true
            extra-substituters = https://cache.iog.io https://neohaskell.cachix.org
            extra-trusted-public-keys = hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ= neohaskell.cachix.org-1:mo2cLaGbwqbrxs9xhqKK8jeNsn3osi7t6XoAmxSZssc=
      - uses: DeterminateSystems/magic-nix-cache-action@v14
      - uses: actions/download-artifact@v8
        with:
          name: dist-newstyle
          path: dist-newstyle
      - name: Start PostgreSQL
        run: |
          docker run -d --name neohaskell_postgres \
            -e POSTGRES_USER=neohaskell \
            -e POSTGRES_PASSWORD=neohaskell \
            -e POSTGRES_DB=neohaskell \
            -p 5432:5432 \
            postgres:16-alpine \
            postgres -c max_connections=200
          for i in $(seq 1 30); do
            pg_isready -h 127.0.0.1 -U neohaskell && break || sleep 1
          done
          if ! pg_isready -h 127.0.0.1 -U neohaskell; then
            echo "::error::PostgreSQL failed to start within 30 seconds"
            exit 1
          fi
        env:
          PGPASSWORD: neohaskell
      - name: Run nhcore-test-service
        run: LOG_LEVEL=Warn nix develop --command cabal test nhcore-test-service

  test-hurl:
    needs: [build]
    runs-on: ubuntu-latest
    # 40m: the dev-shell entry pulls HLS / fourmolu / hlint / ormolu /
    # stylish-haskell / floskell on cold magic-nix-cache, and the post-job
    # cache upload step pushes those same paths back to GHA cache (~12m).
    # Tests themselves run in ~8.5m, dev-shell pull ~5m, post-cache upload
    # ~12m worst case. 40m absorbs the cold-cache one-time cost; warm-cache
    # runs finish in ~10m total.
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@v7
      - uses: DeterminateSystems/determinate-nix-action@v3.21.2
        with:
          extra-conf: |
            accept-flake-config = true
            extra-substituters = https://cache.iog.io https://neohaskell.cachix.org
            extra-trusted-public-keys = hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ= neohaskell.cachix.org-1:mo2cLaGbwqbrxs9xhqKK8jeNsn3osi7t6XoAmxSZssc=
      - uses: DeterminateSystems/magic-nix-cache-action@v14
      - uses: actions/download-artifact@v8
        with:
          name: dist-newstyle
          path: dist-newstyle
      - name: Restore executable permissions
        run: find dist-newstyle/build -type f -name 'nhtestbed' -exec chmod +x {} +
      - name: Start PostgreSQL
        run: |
          docker run -d --name neohaskell_postgres \
            -e POSTGRES_USER=neohaskell \
            -e POSTGRES_PASSWORD=neohaskell \
            -e POSTGRES_DB=neohaskell \
            -p 5432:5432 \
            postgres:16-alpine \
            postgres -c max_connections=200
          for i in $(seq 1 30); do
            pg_isready -h 127.0.0.1 -U neohaskell && break || sleep 1
          done
          if ! pg_isready -h 127.0.0.1 -U neohaskell; then
            echo "::error::PostgreSQL failed to start within 30 seconds"
            exit 1
          fi
        env:
          PGPASSWORD: neohaskell
      - name: Install hurl
        run: |
          curl -LO https://github.com/Orange-OpenSource/hurl/releases/download/6.0.0/hurl_6.0.0_amd64.deb
          sudo dpkg -i hurl_6.0.0_amd64.deb
      - name: Install poppler-utils (for PDF extraction tests)
        run: sudo apt-get update && sudo apt-get install -y poppler-utils
      - name: Run integration tests
        run: nix develop --command ./testbed/scripts/run-tests.sh

  ci-gate:
    if: always()
    needs: [test-core, test-auth, test-integration, test-service, test-hurl]
    runs-on: ubuntu-latest
    steps:
      - name: Check all tests passed
        run: |
          results=(
            "${{ needs.test-core.result }}"
            "${{ needs.test-auth.result }}"
            "${{ needs.test-integration.result }}"
            "${{ needs.test-service.result }}"
            "${{ needs.test-hurl.result }}"
          )
          for r in "${results[@]}"; do
            if [[ "$r" != "success" ]]; then
              echo "::error::Test job failed with result: $r"
              exit 1
            fi
          done