ci-fork.yml

name: Tests (Fork)

on:
  pull_request:

permissions:
  contents: read

jobs:
  check:
    name: All tests passed
    if: github.event.pull_request.head.repo.fork == true
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 120
    env:
      CARGO_INCREMENTAL: "0"
      CARGO_NET_GIT_FETCH_WITH_CLI: "true"
      # Bound the build/test memory peak: this job's recurring failure mode
      # is the runner agent being starved for memory mid Rust-tests (GitHub
      # reports "runner lost communication" with no logs). Full-width
      # parallelism (16 rustc jobs, then 16 concurrent test binaries — many
      # of which spawn servers and embedded databases) is what spikes it.
      CARGO_BUILD_JOBS: "12"
      NEXTEST_TEST_THREADS: "10"

    steps:
      - name: Validate PR title
        env:
          TITLE: ${{ github.event.pull_request.title }}
        run: |
          if ! echo "$TITLE" | grep -qE '^(feat|fix|refactor|chore|docs|test|ci|perf)(\(.+\))?!?: .+'; then
            echo "::error::PR title must follow Conventional Commits: <type>: <description>"
            echo "  Valid types: feat, fix, refactor, chore, docs, test, ci, perf"
            echo "  Example: feat: add Azure container deployment support"
            exit 1
          fi

      - uses: actions/checkout@v7

      - name: Install development tools
        id: mise
        uses: jdx/mise-action@v5
        env:
          MISE_DATA_DIR: ${{ runner.temp }}/mise-tools
          MISE_DISABLE_TOOLS: rust
        with:
          version: 2026.10.1
          add_shims_to_path: false
          install_args: node pnpm
          cache_key: "{{default}}-${{ hashFiles('package.json') }}"

      - name: Cache pnpm dependencies
        uses: actions/setup-node@v7
        with:
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Install Rust toolchain
        uses: jdx/mise-action@v5
        env:
          MISE_DATA_DIR: ${{ runner.temp }}/mise-rust
        with:
          version: 2026.10.1
          add_shims_to_path: false
          install_args: rust
          cache: false

      - uses: Swatinem/rust-cache@v2

      - uses: taiki-e/install-action@nextest

      - name: Install protoc
        uses: arduino/setup-protoc@v3
        with:
          version: "27.x"
          repo-token: ${{ github.token }}

      - uses: hashicorp/setup-terraform@v4
        with:
          terraform_version: 1.15.3
          terraform_wrapper: false

      - uses: azure/setup-helm@v5

      - name: Install kubeconform
        run: |
          case "$(uname -m)" in
            x86_64) KUBECONFORM_ARCH=amd64 ;;
            aarch64|arm64) KUBECONFORM_ARCH=arm64 ;;
            *) echo "Unsupported kubeconform architecture: $(uname -m)" >&2; exit 1 ;;
          esac
          curl -L "https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-${KUBECONFORM_ARCH}.tar.gz" \
            | tar xz kubeconform
          sudo mv kubeconform /usr/local/bin/kubeconform

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint
        run: pnpm format-and-lint

      - name: TypeScript typecheck
        env:
          NODE_OPTIONS: "--max-old-space-size=12288"
        run: pnpm test:ts

      - name: Rust tests (non-cloud)
        run: |
          cargo nextest run --workspace \
            --features alien-bindings/platform-sdk \
            --exclude byocdb \
            --exclude endpoint-agent \
            --exclude alien-test-server \
            --filter-expr 'not (package(alien-aws-clients) and kind(test)) and not (package(alien-gcp-clients) and kind(test)) and not (package(alien-azure-clients) and kind(test)) and not (package(alien-bindings) and kind(test)) and not binary_id(alien-build::build_integration_tests) and not binary_id(alien-build::image_shape_tests) and not binary_id(alien-build::rust_integration_tests) and not binary_id(alien-build::typescript_integration_tests) and not binary_id(alien-worker-runtime::cloudrun) and not binary_id(alien-worker-runtime::lambda) and not binary_id(alien-test::distribution) and not binary_id(alien-test::pull) and not binary_id(alien-test::push) and not binary_id(alien-manager::registry_proxy_cloud_test)'

      - name: Platform SDK full-api tests
        # Workspace builds use the filtered client; these tests need every operation.
        run: cargo test --locked -p alien-platform-api --features full-api

      - name: Install operation compiler generation tools
        run: |
          MISE_DATA_DIR="$RUNNER_TEMP/mise-rust" mise -E release-prepare install rust
          VERSION=$(node -e 'const fs = require("node:fs"); console.log(fs.readFileSync("Cargo.lock", "utf8").match(/name = "wasm-bindgen"\nversion = "([^"]+)"/)[1])')
          MISE_DATA_DIR="$RUNNER_TEMP/mise-rust" mise -E release-prepare exec -- cargo install --locked --version "$VERSION" wasm-bindgen-cli

      - name: Regenerate local TypeScript APIs
        run: pnpm generate

      - name: Check generated files are committed
        run: git diff --exit-code -- packages/core packages/sdk packages/permissions/generated