tests.yml

name: Tests

# Runs on pushes to main as well as PRs. This used to be pull_request-only,
# which meant it silently stopped running once work started going straight to
# main -- it last ran in April while main kept moving.
on:
  push:
    branches:
      - main
  pull_request:
  # The library-update workflow opens its pull request with a token that starts
  # no workflows, and dispatches this one on the branch instead.
  workflow_dispatch:

permissions:
  contents: read

jobs:
  unit:
    name: Unit tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          # `.nvmrc`, not a second copy of the number: git hooks and preflight
          # read that file too, so a bump reaches CI and local checks together.
          node-version-file: .nvmrc
          cache: npm

      - name: Install dependencies
        run: npm ci

      # Before the tests, not after. tsconfig maps the workspace libraries to
      # their builds in dist/, so a spec importing one -- reactome-gsa-form has
      # no npm copy to fall back on -- resolves only once they are built. With
      # the build after the tests, such a spec passed on any machine that had
      # built them and failed to resolve here. The type-aware lint rules and knip
      # need them too: without dist/ they report against a different graph than
      # they do locally, which already failed one run with "Cannot find module
      # 'reactome-gsa-form'". About 16s.
      - name: Build workspace libraries
        run: npm run build:libs

      - name: Test
        run: npm test

      # The app build is the only thing that runs Angular's template type
      # checking, and strictTemplates is on: a template referencing a member
      # that does not exist, binding an input on a component it never imported,
      # or using a pipe that is not in scope fails here. None of that shows up
      # in the unit tests -- a merge once landed a dead @if block that compiled
      # and passed every test. Without this step the only build was the deploy
      # job, so a broken template reached main and was found by a person.
      #
      # content-dist is a gitignored asset input, so stage:content has to run or
      # ng build cannot find it. The libraries no longer need a step of their
      # own: `npm run build` builds them, because a build that does not produce
      # what it links against is a build that can pass here and ship something
      # else -- a fix to the diagram style library reached CI and never reached
      # the dev server, which built the app without building the library. (That
      # library and ngx-reactome-style now come built from ngx-reactome-base.)
      - name: Compile CMS content
        run: npm run stage:content

      - name: Build the app
        run: npm run build

      # The embeddable diagram (spec 009) is served to other sites' pages and is
      # built by nothing else, so it is built here on every change, with its
      # size budget. Two angular.json projects rotted unbuilt before (#339).
      - name: Build the embeddable diagram
        run: npm run build:embed

      # Lint errors must be zero -- eslint.config.js only marks a rule "error"
      # once the codebase is clean of it, so an error is always a new violation.
      # Warnings are the ~1600 pre-existing findings, held to a baseline so they
      # can only go down.
      # Formatting is checked, not applied. The previous workflow ran prettier
      # on PR branches and pushed a commit back -- it used yarn in an npm repo
      # and prettier was never a dependency, so it silently formatted nothing
      # for months, and it could not run at all once work went straight to main.
      - name: Check formatting
        run: npm run format:check

      # The site and the server-side services (tools/tsconfig.json, spec 013).
      # The build checks the site's types; only this checks the services'.
      - name: Type check
        run: npm run check:types

      - name: Lint
        run: npm run check:lint

      # eslint sees unused symbols within a file; knip sees whole files and
      # exports nothing imports, which was the bigger pile. Also baselined,
      # because some findings need someone who knows the data model to judge --
      # the graph classes are referenced by schemaClass name, not by import.
      - name: Check unreachable code has not increased
        run: npm run check:dead

      # A pull request that moves code between modules rewrites the
      # per-module baselines, so a rise could hide inside the move (spec 014):
      # each baseline's total is held to the base branch's.
      - name: Check the ratchets' totals have not risen
        # A dispatched run (the library-update branch's) is held to main.
        if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
        env:
          BASE_REF: ${{ github.base_ref || 'main' }}
        run: |
          git fetch --no-tags --depth=1 origin "$BASE_REF"
          node scripts/check-baseline-totals.mjs "origin/$BASE_REF"

      # A recorded answer cut off after its headers replayed as a successful
      # empty one, and the page quietly showed nothing. The harness aborts
      # those now; this refuses a recording that has one.
      - name: E2E recordings
        run: npm run check:har

  nginx:
    # nginx -t on the image each deployment builds. The unit tests read the
    # routes as text; only nginx says whether they parse -- an unquoted ';' in
    # a location regex passed them all and was refused at deploy time.
    name: nginx configuration
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: nginx -t, dev, release and production
        run: deploy/nginx/test-config.sh

  java-library:
    # The library service's image (spec 015 T063): each Reactome library built
    # from its pinned commit, the service's unit tests, and its answers over
    # sbml-exporter's fixture graph compared with that commit's expected files.
    # CI's alone: preflight builds no images.
    name: Java library service
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: '3.12'
      - name: python-libsbml, as sbml-exporter's CI has it
        run: pip install python-libsbml==5.21.2
      - name: Build the image
        run: docker build -f deploy/java-library/Dockerfile -t java-library .
      - name: Its answers over the fixture graph
        run: deploy/java-library/check.sh java-library

  e2e:
    # The code suite only: "is the code right?". The release checks -- every
    # top-level pathway draws, every download link resolves, the version and news
    # and statistics match what is being served -- depend on generated release
    # data this runner does not have, and live in release-verification.yml.
    #
    # Still sharded: playwright splits by test, so coverage is unchanged and the
    # wall clock stays a few minutes rather than the 30 that got a job killed.
    name: End-to-end (${{ matrix.shard }}/4)
    runs-on: ubuntu-latest
    timeout-minutes: 25
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          # `.nvmrc`, not a second copy of the number: git hooks and preflight
          # read that file too, so a bump reaches CI and local checks together.
          node-version-file: .nvmrc
          cache: npm

      - name: Install dependencies
        run: npm ci

      # The app links against reactome-table and reactome-gsa-form from dist/,
      # so it cannot be served until they are built. The style libraries come
      # built, from ngx-reactome-base.
      - name: Build workspace libraries
        run: npm run build:libs

      # site-search-index.json is generated, not committed, and the search
      # specs depend on it.
      - name: Generate content indices and compile content
        run: |
          npm run generate:indices
          npm run stage:content

      - name: Install Playwright browser
        run: npx playwright install --with-deps chromium

      # playwright.config.ts starts `ng serve` itself and waits for :4200.
      # Backend data comes from the recordings in e2e/har, replayed inside the
      # browser by e2e/support/backend.ts -- nothing here talks to a server.
      #
      # This used to set REACTOME_BACKEND to https://reactome.org, so every push
      # ran the suite against the public site: roughly 1,400 requests a run, and
      # a red build whenever production had a bad minute. It now names a closed
      # port on purpose. The fixtures serve every recorded call, so the port is
      # never reached; if a request ever escapes the recordings it fails at once
      # instead of quietly reaching production again.
      - name: Run e2e
        env:
          REACTOME_BACKEND: http://127.0.0.1:9
        run: npm run e2e -- --shard=${{ matrix.shard }}/4

      # A test that fails and then passes is reported flaky and the build goes
      # green, with the fact only in the log. This puts it in the job summary
      # and ratchets the count, the same way check:lint and check:dead work.
      # Skips too: every one is listed with its reason, and one missing from
      # e2e/expected-skips.json fails the shard -- a skip reports green while
      # checking nothing. Runs even when the suite failed, because a failing
      # run still has flakiness worth seeing.
      - name: Report flaky and skipped tests
        if: ${{ !cancelled() }}
        run: node scripts/check-flaky.mjs playwright-report/report.json

      - name: Upload Playwright report
        uses: actions/upload-artifact@v7
        if: ${{ !cancelled() }}
        with:
          # One name per shard: artifacts with the same name collide and the
          # upload fails, losing the report exactly when it is wanted.
          name: playwright-report-${{ matrix.shard }}
          path: playwright-report/
          retention-days: 7