tests-trigger.yml

name: main-workflow

on:
  workflow_dispatch:
    inputs:
      protocol:
        description: 'RPC Protocol to test'
        required: true
        default: 'rpc_v2'
        type: choice
        options:
          - rpc_v2
          - legacy
  push:
    branches: [ main, develop, '*.rc' ]
  pull_request:
    branches: [ main, develop, '*.rc' ]

defaults:
  run:
    shell: bash

env:
  HUSKY: 0

jobs:
  build_docker:
    permissions:
      contents: read
      packages: write
    runs-on: ubuntu-latest
    outputs:
      image_tag: ${{ steps.meta.outputs.tags }}
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}/firebolt-client-ci
          tags: type=sha

      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Get Transport Version for Build-Arg
        id: transport_version
        run: echo "version=$(cat ${{ github.workspace }}/.transport.version)" >> $GITHUB_OUTPUT

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: .github/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            DEPS_TRANSPORT_V=${{ steps.transport_version.outputs.version }}
            DEPS_TRANSPORT_PROTOCOL=${{ github.event.inputs.protocol || 'rpc_v2' }}
          cache-from: type=gha,scope=${{ github.workflow }}
          cache-to: type=gha,mode=max,scope=${{ github.workflow }}

  format_check:
    permissions:
      contents: read
      packages: read
    needs: [build_docker]
    runs-on: ubuntu-latest
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Run clang-format check
        run: |
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c " \
              set -e \
              && git ls-files -- '*.cpp' '*.h' | xargs clang-format --dry-run --Werror \
            "

  build_project:
    permissions:
      contents: read
      packages: read
    needs: [build_docker]
    runs-on: ubuntu-latest
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get version
        run: |
          VERSION=$(git describe --tags --dirty --match "v[0-9]*")
          echo "VERSION=$VERSION" >> $GITHUB_ENV
          echo "version: $VERSION"

      - name: Configure Project
        run: |
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c " \
              set -e \
              && cmake -B build -S . \
                    -DCMAKE_BUILD_TYPE=Debug \
                    -DENABLE_TESTS=ON \
              && cp docs/openrpc/the-spec/firebolt-open-rpc.json build/test/ \
            "

      - name: Build Project
        run: |
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c " \
              set -e \
              && cmake --build build --parallel \
            "

      - name: Install Project to build/install
        run: |
          docker run --rm --user "$(id -u):$(id -g)" -v ${{ github.workspace }}:/workspace ${{ needs.build_docker.outputs.image_tag }} \
            bash -c " \
              set -e \
              && cmake --install build --prefix build/install \
            "

      - name: Upload build directory
        uses: actions/upload-artifact@v4
        with:
          name: build-dir
          path: ${{ github.workspace }}/build

  trigger-L1:
    permissions:
      contents: read
      packages: read
    needs: [build_docker, build_project]
    uses: ./.github/workflows/L1-tests.yml
    with:
      image_tag: ${{ needs.build_docker.outputs.image_tag }}

  trigger-L2:
    permissions:
      contents: read
      packages: read
    needs: [build_docker, build_project]
    uses: ./.github/workflows/L2-tests.yml
    with:
      image_tag: ${{ needs.build_docker.outputs.image_tag }}
      protocol: ${{ github.event.inputs.protocol || 'rpc_v2' }}

  coverage_gate:
    name: Coverage Gate
    needs: [trigger-L1, trigger-L2]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Run coverage script tests
        run: python3 .github/scripts/compare_coverage_test.py

      - name: Fetch baseline from build-metadata branch
        # Gracefully handle a missing build-metadata branch (first-time setup)
        continue-on-error: true
        run: |
          set -euo pipefail
          if git fetch origin build-metadata 2>/dev/null; then
            if git cat-file -e FETCH_HEAD:coverage-baseline.json 2>/dev/null; then
              git show FETCH_HEAD:coverage-baseline.json > coverage-baseline.json
              echo "Loaded coverage-baseline.json from build-metadata branch"
            else
              echo "build-metadata branch exists but coverage-baseline.json not found — skipping baseline comparison"
              echo "{}" > coverage-baseline.json
            fi
          else
            echo "build-metadata branch not found — absolute threshold check only (first-time setup)"
            echo "{}" > coverage-baseline.json
          fi

      - name: Download unit test coverage artifact
        continue-on-error: true
        uses: actions/download-artifact@v4
        with:
          name: artifacts-L1-client
          path: ./unit-coverage

      - name: Download component test coverage artifact
        continue-on-error: true
        uses: actions/download-artifact@v4
        with:
          name: artifacts-L2-client
          path: ./component-coverage

      - name: Compare coverage to baseline
        run: |
          python3 .github/scripts/compare_coverage.py \
            --baseline coverage-baseline.json \
            --unit ./unit-coverage/filtered_coverage.info \
            --component ./component-coverage/filtered_coverage.info

  update_baseline:
    name: Update Coverage Baseline
    # Runs on push to develop when both test suites pass.
    # Independent of coverage_gate — the gate is informational and must never
    # block the baseline from reflecting the actual state of passing tests.
    if: >-
      github.event_name == 'push' &&
      github.ref == 'refs/heads/develop' &&
      needs.trigger-L1.result == 'success' &&
      needs.trigger-L2.result == 'success'
    needs: [trigger-L1, trigger-L2]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      actions: read
    # Queue concurrent runs; do not cancel in-progress — each merge deserves
    # a baseline update and force-push is atomic so queuing is safe.
    concurrency:
      group: update-baseline-develop
      cancel-in-progress: false
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Fetch existing baseline for comparison report
        # Best-effort — if the branch or file is absent we compare against nothing.
        continue-on-error: true
        run: |
          set -euo pipefail
          if git fetch origin build-metadata 2>/dev/null; then
            if git cat-file -e FETCH_HEAD:coverage-baseline.json 2>/dev/null; then
              git show FETCH_HEAD:coverage-baseline.json > old-baseline.json
              echo "Loaded existing baseline for comparison"
            else
              echo '{}' > old-baseline.json
            fi
          else
            echo '{}' > old-baseline.json
          fi

      - name: Download unit test coverage artifact
        uses: actions/download-artifact@v4
        with:
          name: artifacts-L1-client
          path: ./unit-coverage

      - name: Download component test coverage artifact
        uses: actions/download-artifact@v4
        with:
          name: artifacts-L2-client
          path: ./component-coverage

      - name: Extract coverage and write new baseline
        id: extract
        run: |
          set -euo pipefail
          BL_ARG="old-baseline.json"
          [ -f "$BL_ARG" ] || echo '{}' > "$BL_ARG"

          python3 .github/scripts/compare_coverage.py \
            --baseline "$BL_ARG" \
            --unit ./unit-coverage/filtered_coverage.info \
            --component ./component-coverage/filtered_coverage.info \
            --output-json new-baseline.json \
            --commit "$GITHUB_SHA" \
            --timestamp "$(date -u '+%Y-%m-%dT%H:%M:%SZ')"

          if [ ! -s new-baseline.json ]; then
            echo "Coverage extraction produced no output — skipping baseline update"
            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
            echo "New baseline to commit:"
            cat new-baseline.json
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Commit and push updated baseline to build-metadata
        if: steps.extract.outputs.skip == 'false'
        run: |
          set -euo pipefail
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git config user.name "github-actions[bot]"

          # Check out the build-metadata branch, or create it as an orphan.
          if git fetch origin build-metadata 2>/dev/null; then
            git checkout -B build-metadata FETCH_HEAD
          else
            git checkout --orphan build-metadata
            git rm -rf . --quiet 2>/dev/null || true
          fi

          cp -f new-baseline.json coverage-baseline.json

          git add coverage-baseline.json

          # Only commit when there is an actual change.
          if git diff --cached --quiet; then
            echo "Coverage baseline unchanged — no commit needed"
          else
            MSG=$(printf \
              'chore: update coverage baseline after develop merge [skip ci]\n\nCommit : %s\nRun ID : %s' \
              "$GITHUB_SHA" "$GITHUB_RUN_ID")
            git commit -m "$MSG"
            git push --force-with-lease origin build-metadata
            echo "Pushed updated baseline to build-metadata"
          fi