test.yml

name: Test

permissions: {}

on:
  push:
    branches: [main]
  pull_request:
  merge_group:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: full
  RUSTC_WRAPPER: "sccache"

jobs:
  build-test-artifacts:
    name: build test artifacts
    # Keep private-copy PR validation while avoiding a full test run for every
    # hourly mirror update to its main branch.
    if: github.repository == 'tempoxyz/zones' || github.event_name != 'push'
    runs-on: depot-ubuntu-latest-16
    timeout-minutes: 30
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          submodules: recursive
      - name: Mint read-only Earn token
        id: earn-token
        uses: tempoxyz/gh-actions/actions/github-sts@8819cf80bdcb39c36c34700e3f2ecc08bde54f23 # main
        with:
          scope: tempoxyz/earn
          policy: zones-read
      - name: Check out Earn contracts
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: tempoxyz/earn
          ref: main
          path: earn
          token: ${{ steps.earn-token.outputs.token }}
          persist-credentials: false
          submodules: true
      - uses: tempoxyz/gh-actions/vendor/dtolnay/rust-toolchain@3626124474a987bc74b41fc7ae65b2e23f8e4e4e
        with:
          toolchain: stable
      - uses: tempoxyz/gh-actions/actions/setup-mold@ab45d76f6e7420a094281a22aee1973ecc0754f8
      - uses: tempoxyz/gh-actions/vendor/mozilla-actions/sccache-action@3626124474a987bc74b41fc7ae65b2e23f8e4e4e
        with:
          version: v0.15.0
      - uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@6f436eb3a168279692739e8c0c9fdb52b94bfae7
        with:
          tool: nextest@0.9.124
      - name: Install Foundry
        uses: tempoxyz/gh-actions/actions/setup-foundry@16356ec5155405ba5e33f5558e80b5bf77eb70ab
        with:
          version: nightly

      - name: Resolve Solidity cache key
        id: solidity-key
        run: |
          {
            echo "forge-sha=$(forge --version | sed -n 's/^Commit SHA: //p')"
            echo "contracts-tree=$(git rev-parse HEAD:crates/contracts)"
            echo "earn-sha=$(git -C earn rev-parse HEAD)"
          } >> "$GITHUB_OUTPUT"

      - name: Restore Solidity artifacts
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: |
            earn/cache
            crates/contracts/cache
            crates/contracts/out
          key: forge-${{ runner.os }}-${{ steps.solidity-key.outputs.forge-sha }}-${{ steps.solidity-key.outputs.contracts-tree }}-${{ steps.solidity-key.outputs.earn-sha }}

      - name: Build Solidity artifacts
        run: |
          forge build --root crates/contracts --no-lint
          forge build \
            --root earn \
            --skip test \
            --skip script \
            --no-lint \
            --out "$GITHUB_WORKSPACE/crates/contracts/out"

      - name: Build and archive tests
        run: cargo nextest archive --profile ci --archive-file nextest-archive.tar.zst

      - name: Upload test artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: nextest-archive
          path: |
            nextest-archive.tar.zst
            crates/contracts/out
          if-no-files-found: error
          retention-days: 1
          # The nextest archive is already zstd-compressed; recompressing it is
          # slower and does not materially reduce artifact transfer size.
          compression-level: 0

  test:
    name: test (${{ matrix.partition }}/4)
    runs-on: depot-ubuntu-latest-16
    needs: build-test-artifacts
    timeout-minutes: 20
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        partition: [1, 2, 3, 4]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          submodules: recursive

      # The run phase consumes prebuilt binaries and does not need Rust/Cargo.
      - name: Prepare nextest install directory
        run: mkdir -p "$HOME/.cargo/bin"

      - uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@6f436eb3a168279692739e8c0c9fdb52b94bfae7
        with:
          tool: nextest@0.9.124

      - name: Download test artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: nextest-archive
          path: .

      - name: Run test shard
        run: |
          cargo-nextest nextest run \
            --archive-file nextest-archive.tar.zst \
            --workspace-remap "$GITHUB_WORKSPACE" \
            --profile ci \
            --partition hash:${{ matrix.partition }}/4

  test-success:
    name: test success
    runs-on: ubuntu-latest
    if: >-
      always() &&
      (github.repository == 'tempoxyz/zones' || github.event_name != 'push')
    permissions: {}
    needs:
      - build-test-artifacts
      - test
    timeout-minutes: 30
    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: tempoxyz/gh-actions/actions/check-needs@ab45d76f6e7420a094281a22aee1973ecc0754f8
        with:
          jobs: ${{ toJSON(needs) }}