name: Test

on:
  workflow_dispatch:
  pull_request:
  merge_group:
  push:
    branches: [ main, develop ]

permissions:
  # Private fork: actions/checkout needs contents:read to clone. Upstream is public,
  # where an empty token can still read the repo, so an empty permissions block works there and
  # fails here with `fatal: repository not found`.
  contents: read

# Enrich gradle.properties for CI/CD
env:
  # Reduced from upstream's -Xmx8g / 4 GB Kotlin daemon for the self-hosted runners.
  # Each incus container reports 48 GiB and 8 cores, so a single build has ample room —
  # but the containers are oversubscribed against their host, and two concurrent heavy
  # Gradle jobs get their daemons SIGKILLed ("the daemon has disappeared", no
  # OutOfMemoryError, no heap dump). Running the same job alone succeeds. Lower heaps
  # make two builds likelier to coexist; the real fix is sizing the containers to the
  # host. See the "Report runner capacity" step.
  GRADLE_OPTS: -Dorg.gradle.jvmargs="-Xmx6g -XX:MaxMetaspaceSize=768m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError" -Dkotlin.daemon.jvm.options=-Xmx2g -XX:+UseG1GC
  # --max-workers caps how many test tasks run at once. build.gradle.kts sets
  # maxParallelForks = cores/2 and screenshot tests fork at maxHeapSize=2g, so on these
  # 8-core containers the default (workers = cores = 8) allows 8 x 4 x 2g = 64 GB of test
  # JVMs against a 48 GiB cgroup limit, with no swap — the daemon gets OOM-killed and
  # Gradle reports "the daemon has disappeared". GitHub's 4-core hosted runners reach only
  # 2 x 2 x 2g = 16 GB and additionally have the 8 GB swapfile added above.
  CI_GRADLE_ARG_PROPERTIES: --stacktrace -Dsonar.gradle.skipCompile=true --no-configuration-cache --max-workers=4

jobs:
  tests:
    name: Runs unit tests
    runs-on: [self-hosted, Linux, X64]

    # Allow all jobs on main and develop. Just one per PR.
    concurrency:
      group: ${{ github.ref == 'refs/heads/main' && format('unit-tests-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('unit-tests-develop-{0}', github.sha) || format('unit-tests-{0}', github.ref) }}
      cancel-in-progress: true
    steps:
      # Records the container's real limits so heap settings can be read against them
      # instead of guessed at. Mirrors healthchat-release-playstore.yml.
      - name: Report runner capacity
        if: runner.environment == 'self-hosted'
        run: |
          free -h; nproc; df -h .
          cat /sys/fs/cgroup/memory.max 2>/dev/null \
            || cat /sys/fs/cgroup/memory/memory.limit_in_bytes 2>/dev/null \
            || echo "no cgroup memory limit visible"
      - name: Free Disk Space (Ubuntu)
        # Only meaningful on GitHub's throwaway VMs. On a persistent self-hosted runner this
        # would delete dotnet/haskell/docker images from the host on every run.
        if: runner.environment == 'github-hosted'
        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
        with:
          # This might remove tools that are actually needed, if set to "true" but frees about 6 GB
          tool-cache: true
          # All of these default to true, but we should only need the 'android' one (and maybe swap-storage?)
          android: false
          dotnet: true
          haskell: true
          # This takes way too long to run (~2 minutes) and it saves only ~5.5GB
          large-packages: false
          docker-images: true
          swap-storage: false

      # Increase swapfile size to prevent screenshot tests getting terminated
      # https://github.com/actions/runner-images/discussions/7188#discussioncomment-6750749
      - name: 💽 Increase swapfile size
        # /mnt/swapfile is a GitHub runner-image path and this needs passwordless sudo,
        # so it only applies to the hosted VMs.
        if: runner.environment == 'github-hosted'
        run: |
          sudo swapoff -a
          sudo fallocate -l 8G /mnt/swapfile
          sudo chmod 600 /mnt/swapfile
          sudo mkswap /mnt/swapfile
          sudo swapon /mnt/swapfile
          sudo swapon --show
      - name: ⏬ Checkout with LFS
        uses: nschloe/action-cached-lfs-checkout@385a8ecc719e50b8c71af6ab01a624b486b7c3bc # v1.2.5
        with:
          # Ensure we are building the branch and not the branch after being merged on develop
          # https://github.com/actions/checkout/issues/881
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
      - name: Add SSH private keys for submodule repositories
        uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
        with:
          ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
      - name: Clone submodules
        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
        run: git submodule update --init --recursive
      - name: ☕️ Use JDK 21
        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
      - name: Configure gradle
        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
        with:
          cache-read-only: ${{ github.ref != 'refs/heads/develop' }}

      - name: ⚙️ Run unit tests
        run: ./gradlew :app:testGplayDebugUnitTest testDebugUnitTest -x :tests:konsist:testDebugUnitTest $CI_GRADLE_ARG_PROPERTIES --continue

      - name: ⚙️ Run screenshot tests
        run: ./gradlew verifyPaparazziDebug $CI_GRADLE_ARG_PROPERTIES --continue

      - name: ⚙️ Generate kover coverage report
        run: ./gradlew :koverXmlReportMerged :koverHtmlReportMerged :koverVerifyAll -x testDebugUnitTest $CI_GRADLE_ARG_PROPERTIES

      - name: 🚫 Upload kover failed coverage reports
        if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: kover-error-report
          path: |
            build/reports/kover

      - name: ✅ Upload kover report (disabled)
        if: always()
        run: echo "This is now done only once a day, see nightlyReports.yml"

      - name: 🚫 Upload test results on error
        if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: tests-and-screenshot-tests-results
          path: |
            **/build/paparazzi/failures/
            **/build/reports/tests/*UnitTest/

      - name: 🚫 Modify summary on error
        if: failure()
        run: |
          echo """## Tests failed!
          
          """ >> $GITHUB_STEP_SUMMARY
          python3 .github/workflows/scripts/parse_test_failures.py . >> $GITHUB_STEP_SUMMARY
          echo "---" >> $GITHUB_STEP_SUMMARY

      # https://github.com/codecov/codecov-action
      # This fork has no CODECOV_TOKEN, and Codecov rejects tokenless uploads from private
      # repositories ("Token required - not valid tokenless upload"). With
      # fail_ci_if_error: true that failed the whole job *after* the tests had passed, so
      # skip the upload unless a token is configured. Adding the secret re-enables it.
      - name: ☂️ Upload coverage reports to codecov
        if: env.CODECOV_TOKEN != ''
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
        with:
          fail_ci_if_error: true
          token: ${{ secrets.CODECOV_TOKEN }}
          files: build/reports/kover/reportMerged.xml
          verbose: true