test.yml

name: Test

on:
  push:
    branches:
      - main
      - master
  pull_request:
    branches:
      - main
      - master
  repository_dispatch:
    types: [contract-updated]
  workflow_dispatch:
    inputs:
      run_destructive:
        description: 'Run destructive (real install) tests'
        required: false
        type: boolean
        default: false

jobs:
  lint:
    name: lint
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: "go.mod"
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v7
        with:
          version: v2.11.4

  unit:
    name: unit (L1)
    runs-on: macos-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: "go.mod"

      - name: Vet
        run: go vet ./...

      - name: Run unit + contract tests
        run: make test-coverage

      - name: Upload coverage to Codecov
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
        uses: codecov/codecov-action@v4
        with:
          use_oidc: true
          files: ./coverage.out
          flags: unittests
          name: openboot-coverage
          fail_ci_if_error: false

      - name: Upload coverage artifacts (on failure)
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: debug-coverage
          path: |
            coverage.out
            coverage.html
          retention-days: 7

  integration:
    name: integration (L2)
    runs-on: macos-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: "go.mod"

      - name: Run integration tests
        run: make test-integration

      - name: Run destructive tests
        if: ${{ inputs.run_destructive == true }}
        run: make test-destructive

  contract:
    name: contract schema (L3)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Contract schema validation
        run: |
          git clone --depth 1 https://github.com/openbootdotdev/openboot-contract.git /tmp/contract
          pip3 install --break-system-packages jsonschema

          python3 -c "
          import json, jsonschema, sys

          checks = [
            ('/tmp/contract/schemas/remote-config.json', '/tmp/contract/fixtures/config-v1.json'),
            ('/tmp/contract/schemas/snapshot.json', '/tmp/contract/fixtures/snapshot-v1.json'),
          ]

          failed = 0
          for schema_path, fixture_path in checks:
            schema = json.load(open(schema_path))
            data = json.load(open(fixture_path))
            try:
              jsonschema.validate(data, schema)
              print(f'  ✓ {fixture_path.split(\"/\")[-1]} matches {schema_path.split(\"/\")[-1]}')
            except jsonschema.ValidationError as e:
              print(f'  ✗ {fixture_path.split(\"/\")[-1]}: {e.message}')
              failed += 1

          sys.exit(1 if failed else 0)
          "

  curl-bash-smoke:
    name: curl|bash smoke
    runs-on: macos-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: "go.mod"

      - name: Build
        run: make build

      - name: Start mock server
        run: |
          python3 scripts/mock-server.py 18888 ./openboot &
          echo $! > /tmp/mock-pid
          for i in $(seq 1 20); do
            curl -sf http://localhost:18888/api/packages >/dev/null 2>&1 && break
            sleep 0.3
          done

      - name: Run curl|bash install (dry-run)
        run: curl -fsSL http://localhost:18888/testuser/test-config/install | bash

      - name: Stop mock server
        if: always()
        run: kill $(cat /tmp/mock-pid) 2>/dev/null || true

  macos-e2e:
    name: macos e2e (L5)
    runs-on: macos-latest
    # Only on release tags or manual dispatch — these are slow and destructive.
    if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
    timeout-minutes: 45
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: "go.mod"

      - name: Run macOS E2E (release tier)
        run: make test-vm-release

  cli-compat:
    name: old-cli compat
    runs-on: macos-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Get previous release version
        id: prev
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          PREV=$(curl -sf https://api.github.com/repos/openbootdotdev/openboot/releases \
            -H "Authorization: Bearer $GITHUB_TOKEN" | \
            python3 -c "
          import json, sys
          releases = json.load(sys.stdin)
          stable = [r for r in releases if not r.get('prerelease') and not r.get('draft')]
          if len(stable) >= 2:
              print(stable[1]['tag_name'])
          elif len(stable) == 1:
              print(stable[0]['tag_name'])
          else:
              sys.exit(1)
          " 2>/dev/null) || true
          echo "version=$PREV" >> $GITHUB_OUTPUT

      - name: Download previous release binary
        if: steps.prev.outputs.version != ''
        run: |
          VER="${{ steps.prev.outputs.version }}"
          ARCH=$(uname -m)
          if [ "$ARCH" = "arm64" ]; then
            SUFFIX="darwin-arm64"
          else
            SUFFIX="darwin-amd64"
          fi
          curl -fsSL \
            "https://github.com/openbootdotdev/openboot/releases/download/${VER}/openboot-${SUFFIX}" \
            -o /tmp/openboot-prev
          chmod +x /tmp/openboot-prev

      - name: Start mock server for compat test
        if: steps.prev.outputs.version != ''
        run: |
          python3 scripts/mock-server.py 18889 /tmp/openboot-prev &
          echo $! > /tmp/compat-mock-pid
          for i in $(seq 1 20); do
            curl -sf http://localhost:18889/api/packages >/dev/null 2>&1 && break
            sleep 0.3
          done

      - name: Run previous binary against current mock
        if: steps.prev.outputs.version != ''
        run: |
          OPENBOOT_DRY_RUN=true OPENBOOT_API_URL=http://localhost:18889 \
            /tmp/openboot-prev -s -u testuser/test-config

      - name: Stop compat mock server
        if: always()
        run: kill $(cat /tmp/compat-mock-pid) 2>/dev/null || true