openhuman/.github/workflows/test-reusable.yml

---
# Reusable test workflow — frontend unit tests, Rust core tests, Rust Tauri
# shell tests. Used by PR/push (`test.yml`).
#
# Caching: pnpm store, Swatinem rust-cache, CEF runtime, and sccache backed
# by the GitHub Actions cache. Cache keys mirror what the release build
# matrix uses so warm caches survive across workflows on the same SHA.
name: Test (reusable)

on:
  workflow_call:
    inputs:
      ref:
        description: Git ref (tag or SHA) to test. Release workflows pass the
          freshly-pushed staging/production tag here so pretest validates
          the exact commit the build matrix will check out, not main HEAD
          at workflow_dispatch time. Defaults to empty (checkout uses its
          own default, i.e. the workflow's triggering ref).
        type: string
        default: ""
      run_unit:
        description: Run frontend Vitest suite.
        type: boolean
        default: true
      run_rust_core:
        description: Run `cargo test -p openhuman` (core crate).
        type: boolean
        default: true
      run_rust_tauri:
        description: Run `cargo test --manifest-path app/src-tauri/Cargo.toml`.
        type: boolean
        default: true

permissions:
  # `actions: read` lets scripts/ci-cancel-aware.sh poll the run status so
  # cancelled builds inside container jobs stop themselves (docker exec
  # swallows the runner's signals).
  actions: read
  contents: read
  packages: read

env:
  # Consumed by scripts/ci-cancel-aware.sh's cancellation watchdog.
  GH_TOKEN: ${{ github.token }}

jobs:
  i18n-coverage:
    if: inputs.run_unit
    name: i18n Coverage
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    container:
      image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 1
      - name: Cache pnpm store
        uses: actions/cache@v5
        with:
          path: ~/.local/share/pnpm/store
          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: |
            pnpm-store-${{ runner.os }}-
      - name: Install dependencies
        run: bash scripts/ci-cancel-aware.sh pnpm install --frozen-lockfile
      - name: Verify i18n coverage (missing / extra / drifted / en.ts ↔ chunks)
        run: bash scripts/ci-cancel-aware.sh pnpm i18n:check

  unit-tests:
    if: inputs.run_unit
    name: Frontend Unit Tests
    runs-on: ubuntu-22.04
    timeout-minutes: 30
    container:
      image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 1
      # The RPC-catalog drift-guard test (rpcMethods.test.ts) reads
      # vendor/tinychannels/src/controllers/schemas.rs at test time. This lane
      # otherwise checks out without submodules, so init just that one — not
      # `submodules: recursive`, which would also pull the large tauri-cef fork
      # this job never builds.
      - name: Init tinychannels submodule (drift-guard test reads its schemas)
        run: git submodule update --init vendor/tinychannels
      - name: Cache pnpm store
        uses: actions/cache@v5
        with:
          path: ~/.local/share/pnpm/store
          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: |
            pnpm-store-${{ runner.os }}-
      - name: Install dependencies
        run: bash scripts/ci-cancel-aware.sh pnpm install --frozen-lockfile
      - name: Run tests with coverage
        run: bash scripts/ci-cancel-aware.sh pnpm test:coverage
        env:
          NODE_ENV: test
      - name: Upload coverage reports
        if: always()
        uses: actions/upload-artifact@v5
        with:
          name: coverage-report
          path: coverage
          retention-days: 7

  rust-core-tests:
    if: inputs.run_rust_core
    name: Rust Core Tests + Quality
    runs-on: ubuntu-22.04
    timeout-minutes: 20
    container:
      image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
    env:
      CARGO_INCREMENTAL: "0"
      RUSTC_WRAPPER: sccache
      SCCACHE_GHA_ENABLED: "true"
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 1
          persist-credentials: false
          submodules: recursive
      - name: Cache Rust build artifacts
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target
          cache-on-failure: true
          key: core
      - name: Install sccache
        uses: mozilla-actions/sccache-action@v0.0.9
      - name: Test core crate (openhuman)
        run: bash scripts/ci-cancel-aware.sh cargo test -p openhuman

  rust-core-tests-windows:
    if: inputs.run_rust_core
    name: Rust Core Tests (Windows — secrets ACL)
    runs-on: windows-latest
    timeout-minutes: 30
    env:
      CARGO_INCREMENTAL: '0'
      SCCACHE_GHA_ENABLED: 'true'
      RUSTC_WRAPPER: sccache
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 1
          persist-credentials: false
          submodules: recursive
      - name: Cache Rust build artifacts
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target
          cache-on-failure: true
          key: core-windows
      - name: Install sccache
        uses: mozilla-actions/sccache-action@v0.0.9
      - name: Run Windows-specific secrets tests
        # Runs the keyring::encrypted_store suite (keyring::encrypted_store::tests),
        # which contains the #[cfg(windows)] tests:
        #   - self_repair_recovers_from_locked_key_file (OPENHUMAN-TAURI-GN)
        #   - self_repair_does_not_trigger_for_corrupt_file
        #   - is_permission_error_* (access denied, not-found, raw OS error 5)
        #   - qualify_windows_username_* (local, domain, case, empty env vars)
        # Note: repair_windows_acl is a helper fn, not a test.
        # security/secrets.rs is a one-line re-export with no tests of its own;
        # the old filter (-- security::secrets) silently matched nothing.
        run: bash scripts/ci-cancel-aware.sh cargo test -p openhuman -- keyring::encrypted_store --nocapture

  rust-tauri-tests:
    if: inputs.run_rust_tauri
    name: Rust Tauri Shell Tests
    runs-on: ubuntu-22.04
    timeout-minutes: 20
    container:
      image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
    env:
      CARGO_INCREMENTAL: "0"
      RUSTC_WRAPPER: sccache
      SCCACHE_GHA_ENABLED: "true"
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 1
          # Required for app/src-tauri/vendor/tauri-cef.
          persist-credentials: false
          submodules: recursive
      - name: Cache Rust build artifacts
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: |
            . -> target
            app/src-tauri -> target
          cache-on-failure: true
          key: tauri
      - name: Cache CEF binary distribution
        uses: actions/cache@v5
        with:
          path: ~/.cache/tauri-cef
          key: cef-ubuntu-22.04-${{ hashFiles('app/src-tauri/Cargo.toml') }}
          restore-keys: |
            cef-ubuntu-22.04-
      - name: Install sccache
        uses: mozilla-actions/sccache-action@v0.0.9
      - name: Test Tauri shell (OpenHuman)
        run: bash scripts/ci-cancel-aware.sh cargo test --manifest-path app/src-tauri/Cargo.toml