mcpproxy-go/.github/workflows/native-tests.yml at main · smart-mcp-proxy/mcpproxy-go · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
# Native macOS tray test gate (MCP-1214).
#
# The macOS tray Settings form is a separate hand-port of the Web UI catalog,
# so web-only QA cannot catch native-only behavior bugs (validation, dirty
# detection, placeholders, bindings). This workflow makes that surface a
# first-class, deterministic merge gate:
#
#   - swift-test       : runs the native unit tests (GUI-free logic), which
#                        directly cover the spec-074 duration-field bugs.
#   - settings-parity  : fails when the web (fields.ts) and native
#                        (SettingsCatalog.swift) duration-field catalogs drift.
#
# Both job names are stable so they can be added to branch protection as
# required status checks. See docs/qa-merge-gate.md.
#
# REQUIRED-SAFE DESIGN (MCP-1219)
# -------------------------------
# These jobs are meant to be REQUIRED status checks on `main`. A required check
# that never produces a status blocks every PR that lacks it. GitHub produces
# NO status for a workflow skipped by a top-level `paths:` filter — the check
# stays "Expected — Waiting" forever and blocks the PR. So this workflow must
# trigger on EVERY pull request, then decide internally whether the real work
# runs:
#
#   - No top-level `paths:` filter -> the workflow always runs.
#   - The `changes` job detects whether native / settings files were touched.
#   - swift-test / settings-parity are gated with a job-level `if:`. On a PR
#     that touches none of those paths they are SKIPPED, and a skipped job
#     reports its required context as satisfied (green) — unlike a skipped
#     workflow, which reports nothing and blocks.
#
# Net effect: a native PR runs the real tests; a non-native PR (e.g. a deps
# bump) shows both contexts green without spending a macOS runner. Verify this
# on a non-native PR BEFORE adding the contexts to branch protection
# (docs/qa-merge-gate.md "Activation").
name: Native macOS Tests

on:
  pull_request:
  push:
    branches: [main, next]

permissions:
  contents: read

jobs:
  changes:
    name: detect-native-changes
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      native: ${{ steps.filter.outputs.native }}
      gotray: ${{ steps.filter.outputs.gotray }}
    steps:
      - uses: actions/checkout@v7.0.1
      - uses: dorny/paths-filter@v4
        id: filter
        with:
          filters: |
            native:
              - 'native/macos/**'
              - 'frontend/src/views/settings/**'
              - 'frontend/src/components/settings/**'
              - 'scripts/check-settings-parity.py'
              - '.github/workflows/native-tests.yml'
              # Go-owned goldens Swift reads by relative path (Spec 109-m M15):
              # a Go-side label, enum, order or attention change must run
              # swift test, not only the Go and vitest suites.
              - 'internal/health/testdata/**'
              - 'internal/contracts/testdata/**'
              - 'internal/runtime/testdata/attention_parity_*'
              - 'internal/registries/testdata/catalog_github_order.json'
              - 'internal/secret/testdata/**'
              - 'internal/profile/testdata/contract/**'
              - 'specs/*/parity-matrix.json'
              - 'frontend/src/types/contracts.ts'
            gotray:
              - 'internal/tray/**'
              - 'cmd/mcpproxy-tray/**'
              - 'internal/updatecheck/**'
              - '.github/workflows/native-tests.yml'

  swift-test:
    name: swift-test
    needs: changes
    if: needs.changes.outputs.native == 'true'
    runs-on: macos-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7.0.1
      - name: Show Swift toolchain
        run: swift --version
      - name: Run native unit tests
        working-directory: native/macos/MCPProxy
        # The whole suite runs. The former skip-set (AutoStart first-run, two
        # SSE-parser edge cases, a JSONEncoder canary, SSE decode) is fixed — two
        # of them were real bugs the skips were hiding — so there is nothing left
        # to exclude. Do not reintroduce --skip: a skipped test is an untested
        # code path that looks green.
        run: swift test

  go-tray-test:
    name: go-tray-test
    needs: changes
    if: needs.changes.outputs.gotray == 'true'
    runs-on: macos-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
        with:
          go-version: "1.26"
          cache: true
      # internal/tray is behind `!nogui && !headless && !linux`, so NOTHING in
      # the PR gate compiles it: pr-build.yml tests with `-tags nogui`, and
      # unit-tests.yml narrows its pull_request matrix to ubuntu-latest. Its
      # tests — including the self-update archive-member regression tests —
      # used to run only on the push-to-main macOS/Windows legs, i.e. after
      # merge. This job is the PR-time gate for that package. No `-tags nogui`,
      # and macOS so the `!linux` half of the tag is satisfied too.
      - name: Test the tray package
        run: go test -race ./internal/tray/... ./internal/updatecheck/...

  settings-parity:
    name: settings-parity
    needs: changes
    if: needs.changes.outputs.native == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7.0.1
      - uses: actions/setup-python@v7
        with:
          python-version: '3.12'
      - name: Web <-> native settings catalog parity
        run: python3 scripts/check-settings-parity.py