test.yml

name: Test

on:
  push:
    branches:
      - main
      - master
  pull_request:
    branches:
      - main
      - master
  repository_dispatch:
    types: [contract-updated]
  workflow_dispatch:

jobs:
  lint:
    name: lint
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: "go.mod"
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v7
        with:
          version: v2.11.4

  unit:
    name: unit (L1)
    runs-on: macos-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: "go.mod"

      - name: Vet
        run: go vet ./...

      - name: Run unit + contract tests
        run: make test-coverage

      - name: Upload coverage to Codecov
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
        uses: codecov/codecov-action@v4
        with:
          use_oidc: true
          files: ./coverage.out
          flags: unittests
          name: openboot-coverage
          fail_ci_if_error: false

      - name: Upload coverage artifacts (on failure)
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: debug-coverage
          path: |
            coverage.out
            coverage.html
          retention-days: 7

  contract:
    name: contract schema (L2)
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Contract schema validation
        run: |
          git clone --depth 1 https://github.com/openbootdotdev/openboot-contract.git /tmp/contract
          pip3 install --break-system-packages jsonschema

          python3 -c "
          import json, jsonschema, sys

          checks = [
            ('/tmp/contract/schemas/remote-config.json', '/tmp/contract/fixtures/config-v1.json'),
            ('/tmp/contract/schemas/snapshot.json', '/tmp/contract/fixtures/snapshot-v1.json'),
          ]

          failed = 0
          for schema_path, fixture_path in checks:
            schema = json.load(open(schema_path))
            data = json.load(open(fixture_path))
            try:
              jsonschema.validate(data, schema)
              print(f'  ✓ {fixture_path.split(\"/\")[-1]} matches {schema_path.split(\"/\")[-1]}')
            except jsonschema.ValidationError as e:
              print(f'  ✗ {fixture_path.split(\"/\")[-1]}: {e.message}')
              failed += 1

          sys.exit(1 if failed else 0)
          "

  curl-bash-smoke:
    name: curl|bash smoke
    if: github.event_name != 'pull_request'
    runs-on: macos-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: "go.mod"

      - name: Build
        run: make build

      - name: Start mock server
        run: |
          python3 scripts/mock-server.py 18888 ./openboot &
          echo $! > /tmp/mock-pid
          for i in $(seq 1 20); do
            curl -sf http://localhost:18888/api/packages >/dev/null 2>&1 && break
            sleep 0.3
          done

      - name: Run curl|bash install (dry-run)
        run: curl -fsSL http://localhost:18888/testuser/test-config/install | bash

      - name: Stop mock server
        if: always()
        run: kill $(cat /tmp/mock-pid) 2>/dev/null || true

  cli-compat:
    name: old-cli compat
    if: github.event_name != 'pull_request'
    runs-on: macos-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Get previous release version
        id: prev
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          ARCH=$(uname -m)
          if [ "$ARCH" = "arm64" ]; then
            ASSET="openboot-darwin-arm64"
          else
            ASSET="openboot-darwin-amd64"
          fi
          PREV=$(curl -sf https://api.github.com/repos/openbootdotdev/openboot/releases \
            -H "Authorization: Bearer $GITHUB_TOKEN" | \
            ASSET="$ASSET" python3 -c "
          import json, os, sys
          asset = os.environ['ASSET']
          releases = json.load(sys.stdin)
          # Keep stable releases that still have the binary asset for this arch.
          # Some older releases have had their binaries deleted (e.g. v0.55.1),
          # so fall back to the most recent release that is still downloadable.
          stable = [r for r in releases
                    if not r.get('prerelease') and not r.get('draft')
                    and any(a.get('name') == asset for a in r.get('assets', []))]
          if stable:
              print(stable[0]['tag_name'])
          else:
              sys.exit(1)
          " 2>/dev/null) || true
          echo "version=$PREV" >> $GITHUB_OUTPUT

      - name: Download previous release binary
        if: steps.prev.outputs.version != ''
        run: |
          VER="${{ steps.prev.outputs.version }}"
          ARCH=$(uname -m)
          if [ "$ARCH" = "arm64" ]; then
            SUFFIX="darwin-arm64"
          else
            SUFFIX="darwin-amd64"
          fi
          curl -fsSL \
            "https://github.com/openbootdotdev/openboot/releases/download/${VER}/openboot-${SUFFIX}" \
            -o /tmp/openboot-prev
          chmod +x /tmp/openboot-prev

      - name: Start mock server for compat test
        if: steps.prev.outputs.version != ''
        run: |
          python3 scripts/mock-server.py 18889 /tmp/openboot-prev &
          echo $! > /tmp/compat-mock-pid
          for i in $(seq 1 20); do
            curl -sf http://localhost:18889/api/packages >/dev/null 2>&1 && break
            sleep 0.3
          done

      - name: Run previous binary against current mock
        if: steps.prev.outputs.version != ''
        run: |
          if /tmp/openboot-prev install --help >/dev/null 2>&1; then
            OPENBOOT_DRY_RUN=true OPENBOOT_API_URL=http://localhost:18889 \
              /tmp/openboot-prev install -s testuser/test-config
          else
            OPENBOOT_DRY_RUN=true OPENBOOT_API_URL=http://localhost:18889 \
              /tmp/openboot-prev -s -u testuser/test-config
          fi

      - name: Stop compat mock server
        if: always()
        run: kill $(cat /tmp/compat-mock-pid) 2>/dev/null || true