ci.yml

# This workflow uses actions that are not certified by GitHub.  They are
# provided by a third-party and are governed by separate terms of service,
# privacy policy, and support documentation.
#
# This workflow will install a prebuilt Ruby version, install dependencies, and
# run tests and linters.
name: "Lint & Tests"
permissions:
  contents: read
  pull-requests: write
on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
  workflow_dispatch:
jobs:
  lint:
    # This is Ubuntu 24.04 currently: https://github.com/actions/runner-images/blob/ubuntu24/20250907.24/images/ubuntu/Ubuntu2404-Readme.md
    # Building an own image is not worth it, pulling it in gh actions
    # is about as slow as installing the dependencies and it blocks using cached gems
    runs-on: ubuntu-latest
    #container:
    #  image: ghcr.io/mapforge-org/mapforge-ci-runner:latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Update package lists
        run: sudo apt-get update
      - name: Disable mandb updates
        run: |
          sudo mv /usr/bin/mandb /usr/bin/mandb.bak
          echo -e '#!/bin/sh\nexit 0' | sudo tee /usr/bin/mandb > /dev/null
          sudo chmod +x /usr/bin/mandb
      - name: Install dependencies
        run: sudo apt-get install --no-install-recommends -y libimlib2-dev
      - name: Install Ruby and gems
        uses: ruby/setup-ruby@v1
        with:
          # caches by Gemfile.lock checksum
          bundler-cache: true
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
      - name: Install npm dependencies
        run: npm ci --ignore-scripts
      - name: Security audit dependencies
        run: bin/bundler-audit --update
      - name: Security audit application code
        run: bin/brakeman -q -w2
      - name: Lint Ruby files
        run: bin/rubocop --parallel
      - name: Lint Javascript
        run: npm run lint:js
      - name: Lint CSS
        run: npm run lint:css

  test:
    runs-on: ubuntu-latest
    # The runner is too weak for more than 2 headless Chrome instances, so every job
    # keeps 2 processes and the fan out happens over jobs. All jobs must compute the
    # same 6 groups, so they must read the same runtime log. Only the coverage job
    # writes that cache.
    strategy:
      fail-fast: false
      matrix:
        include:
          - part: 1
            groups: "1,2"
          - part: 2
            groups: "3,4"
          - part: 3
            groups: "5,6"
    #container:
    #  image: ghcr.io/mapforge-org/mapforge-ci-runner:latest
    services:
      mongodb:
        image: mongo:8.3
        ports:
        - 27017:27017
        # credentials are only needed when not running on ubuntu-latest VM
        # credentials:
        #  username: ${{ secrets.DOCKER_USERNAME }}
        #  password: ${{ secrets.DOCKER_TOKEN }}
    env:
      RAILS_ENV: test
      COVERAGE: true
      CI_PART: ${{ matrix.part }} # turns off the per job coverage minimum
      SE_AVOID_STATS: true # skip Selenium stats
      SE_DISABLE_REMOTE_MANAGER: true # skip Selenium plausible telemetry
      # MONGO_URL is only needed when not running on ubuntu-latest VM
      # MONGO_URL: "mongodb:27017"
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Update package lists
        run: sudo apt-get update
      - name: Disable mandb updates
        run: |
          sudo mv /usr/bin/mandb /usr/bin/mandb.bak
          echo -e '#!/bin/sh\nexit 0' | sudo tee /usr/bin/mandb > /dev/null
          sudo chmod +x /usr/bin/mandb
      - name: Install dependencies
      #  run: sudo apt-get install -y ruby-dev build-essential git libvips pkg-config libimlib2 libimlib2-dev imagemagick
        run: sudo apt-get install --no-install-recommends -y libimlib2 libimlib2-dev imagemagick
      - name: Install Ruby and gems
        uses: ruby/setup-ruby@v1
        with:
          # caches by Gemfile.lock checksum
          bundler-cache: true
      # Share test run timings across CI runs for optimal distribution
      - name: Restore spec runtimes
        uses: actions/cache/restore@v4
        with:
          path: tmp/parallel_runtime_rspec.log
          key: rspec-runtime-${{ github.run_id }}
          restore-keys: rspec-runtime-
      - name: Run tests
        id: rspec
        #run: |
        #  bin/rspec --pattern "spec/**/*_spec.rb,engines/**/*_spec.rb"
        run: |
          # --group-by runtime reads the log without a rescue, so it must exist
          mkdir -p tmp && touch tmp/parallel_runtime_rspec.log
          bin/parallel_rspec spec engines -n 6 \
            --group-by runtime --allowed-missing 100 --only-group ${{ matrix.groups }}
        shell: bash
      # The coverage job needs this artifact, so a failed upload must fail this job.
      # Otherwise "re-run failed jobs" only re-runs coverage and never regenerates it.
      - name: Upload partial results
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: part-${{ matrix.part }}
          include-hidden-files: true
          path: |
            coverage/.resultset.json
            tmp/parallel_runtime_rspec.log
      # Diagnostic uploads only. The artifact backend returns transient 403s on
      # finalize, which must not change the job result.
      - name: Upload screenshots
        if: failure()
        continue-on-error: true
        uses: actions/upload-artifact@v6
        with:
          name: screenshots-${{ matrix.part }}
          path: ./tmp/capybara
      - name: Upload logs
        if: failure()
        continue-on-error: true
        uses: actions/upload-artifact@v6
        with:
          name: rails-logs-${{ matrix.part }}
          path: ./log/test.log

  coverage:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Update package lists
        run: sudo apt-get update
      - name: Install dependencies
        run: sudo apt-get install --no-install-recommends -y libimlib2-dev
      - name: Install Ruby and gems
        uses: ruby/setup-ruby@v1
        with:
          # caches by Gemfile.lock checksum
          bundler-cache: true
      - name: Download partial results
        uses: actions/download-artifact@v4
        with:
          pattern: part-*
          path: parts
      # Every job only knows the coverage of its own groups. The minimum in
      # spec/rails_helper.rb therefore cannot apply. Enforce it over the merged data.
      - name: Check merged coverage
        run: |
          bundle exec ruby -e '
            require "simplecov"
            SimpleCov.collate Dir["parts/*/coverage/.resultset.json"], "rails" do
              minimum_coverage 100
              skip "app/jobs/application_job.rb"
              skip "lib/tasks"
            end
          '
      - name: Upload coverage
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@v6
        with:
          name: coverage
          path: ./coverage
      - name: Merge spec runtimes
        run: |
          mkdir -p tmp
          cat parts/*/tmp/parallel_runtime_rspec.log > tmp/parallel_runtime_rspec.log
      - name: Save spec runtimes
        uses: actions/cache/save@v4
        with:
          path: tmp/parallel_runtime_rspec.log
          key: rspec-runtime-${{ github.run_id }}
      # - name: Coveralls
      #   uses: coverallsapp/github-action@v2
      #   with:
      #     fail-on-error: false