tests.yml

---
name: brew test-bot
permissions: {}

env:
  UBUNTU_VERSION: "24.04"

on:
  push:
    branches:
      - master
  pull_request:

concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: true

jobs:
  # Check syntax and detect which platforms need testing
  setup:
    uses: ./.github/workflows/_detect-formulas.yml
    permissions:
      contents: read
    with:
      base-sha: ${{ github.event.pull_request.base.sha || '' }}
      before-sha: ${{ github.event.before || '' }}
      event-name: ${{ github.event_name }}
      head-sha: ${{ github.sha }}
      run-homebrew-setup: true

  # Build bottles on required platforms
  build-bottles:
    if: needs.setup.outputs.has-formulae == 'true'
    needs: setup
    permissions:
      actions: read
      checks: read
      contents: read
      packages: read
      pull-requests: read
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: ${{ needs.setup.outputs.disable-failfast == 'false' }}
      matrix:
        os: ${{ fromJson(needs.setup.outputs.platforms) }}
    steps:
      - name: More space
        if: runner.os == 'Linux'
        uses: LizardByte/actions/actions/more_space@d0ae7f82215a479fe2b74f4088c53ee6460513dd  # v2026.728.214955
        with:
          analyze-space-savings: true
          clean-all: true
          safe-packages: brew

      - name: Set up Homebrew
        id: set-up-homebrew
        uses: Homebrew/actions/setup-homebrew@main
        with:
          stable: false
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Select configured Xcode
        if: runner.os == 'macOS'
        env:
          MATRIX_OS: ${{ matrix.os }}
          TESTING_FORMULAE: ${{ needs.setup.outputs.testing-formulae }}
        run: |
          TAP_PATH="$(brew --repository "${GITHUB_REPOSITORY}")"
          XCODE_CONFIG="${TAP_PATH}/ci_config/xcode_versions.json"
          MACOS_VERSION="${MATRIX_OS#macos-}"

          XCODE_VERSIONS=$(jq -r \
            --arg formulae "${TESTING_FORMULAE}" \
            --arg macos_version "${MACOS_VERSION}" \
            '[($formulae | split(",")[]) as $formula |
              .[$formula][$macos_version] // empty] | unique[]' \
            "${XCODE_CONFIG}")
          XCODE_VERSION_COUNT=$(printf '%s\n' "${XCODE_VERSIONS}" | sed '/^$/d' | wc -l | tr -d ' ')

          if [ "${XCODE_VERSION_COUNT}" -eq 0 ]; then
            echo "No custom Xcode version configured for macOS ${MACOS_VERSION}."
            exit 0
          fi

          if [ "${XCODE_VERSION_COUNT}" -gt 1 ]; then
            echo "Conflicting Xcode versions configured for ${TESTING_FORMULAE} on macOS ${MACOS_VERSION}:"
            echo "${XCODE_VERSIONS}"
            exit 1
          fi

          XCODE_PATH="/Applications/Xcode_${XCODE_VERSIONS}.app"
          if [ ! -d "${XCODE_PATH}" ]; then
            echo "Configured Xcode installation does not exist: ${XCODE_PATH}"
            exit 1
          fi

          echo "Selecting Xcode ${XCODE_VERSIONS} for ${TESTING_FORMULAE} on macOS ${MACOS_VERSION}."
          sudo xcode-select --switch "${XCODE_PATH}"
          xcodebuild -version

      - name: Cache Homebrew Bundler RubyGems
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: ${{ steps.set-up-homebrew.outputs.gems-path }}
          key: ${{ matrix.os }}-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }}
          restore-keys: ${{ matrix.os }}-rubygems-

      # TODO: periodically check if this gets fixed in Homebrew
      # https://github.com/orgs/Homebrew/discussions/6615
      # https://github.com/ruby/rubygems/issues/7983
      - name: Fix ruby gems directory permissions
        if: matrix.os == format('ubuntu-{0}-arm', env.UBUNTU_VERSION)
        run: |
          # Fix ownership first so current user can write, then remove world-writable
          BUNDLE_DIR="$(brew --prefix)/Homebrew/Library/Homebrew/vendor/bundle/ruby"
          if [ -d "${BUNDLE_DIR}" ]; then
            # Take ownership so we can write to it
            sudo chown -R "$(whoami):$(id -gn)" "${BUNDLE_DIR}"
            # Remove world-writable permissions to satisfy Bundler security
            chmod -R o-w "${BUNDLE_DIR}"
            echo "Fixed ownership and permissions for ${BUNDLE_DIR}"
          fi

      - name: Brew cleanup before
        run: brew test-bot --fail-fast --only-cleanup-before

      # Homebrew's Linux sandbox requires bwrap on PATH before brew test-bot runs brew doctor.
      # Install it after cleanup-before, which prunes formulae from the prefix.
      # The sysctls enable the rootless user namespaces that bwrap needs to create the sandbox.
      - name: Set up Homebrew Linux sandbox
        if: runner.os == 'Linux'
        run: |
          brew install bubblewrap
          sudo sysctl -w kernel.unprivileged_userns_clone=1
          sudo sysctl -w user.max_user_namespaces=28633
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true

      - name: Brew setup
        run: brew test-bot --fail-fast --only-setup

      - name: Base64-encode GITHUB_TOKEN for HOMEBREW_DOCKER_REGISTRY_TOKEN
        id: base64-encode
        if: github.event_name == 'pull_request'
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          base64_token=$(echo -n "${TOKEN}" | base64 | tr -d "\n")
          echo "::add-mask::${base64_token}"
          echo "token=${base64_token}" >> "${GITHUB_OUTPUT}"

      - name: Build bottles
        if: github.event_name == 'pull_request'
        env:
          HOMEBREW_DOCKER_REGISTRY_TOKEN: ${{ steps.base64-encode.outputs.token }}
          TESTING_FORMULAE: ${{ needs.setup.outputs.testing-formulae }}
        run: |
          test_bot_args=(
            --fail-fast
            --only-formulae
            --root-url=https://ghcr.io/v2/lizardbyte/homebrew
          )

          if [ -n "${TESTING_FORMULAE}" ]; then
            test_bot_args+=("--testing-formulae=${TESTING_FORMULAE}")
          fi

          brew test-bot "${test_bot_args[@]}"

      - name: Upload bottles as artifact
        if: always() && github.event_name == 'pull_request'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: bottles_${{ matrix.os }}
          path: '*.bottle.*'

  # Conclusion job that checks test results
  conclusion:
    if: always()
    needs:
      - setup
      - build-bottles
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - name: Check workflow results
        env:
          SETUP_RESULT: ${{ needs.setup.result }}
          BOTTLES_RESULT: ${{ needs.build-bottles.result }}
          HAS_FORMULAE: ${{ needs.setup.outputs.has-formulae }}
        run: |
          echo "Workflow Status Summary:"
          echo "  setup: ${SETUP_RESULT}"
          echo "  build-bottles: ${BOTTLES_RESULT}"
          echo "  has-formulae: ${HAS_FORMULAE}"

          # If no formulae were changed, workflow should succeed
          if [ "${HAS_FORMULAE}" == "false" ]; then
            echo "✅ No formula changes detected - workflow succeeded"
            exit 0
          fi

          # Check for failures (not skipped or cancelled)
          if [ "${SETUP_RESULT}" == "failure" ]; then
            echo "❌ Setup and detection failed"
            exit 1
          fi

          if [ "${BOTTLES_RESULT}" == "failure" ]; then
            echo "❌ Test bot failed"
            exit 1
          fi

          # Success if all required jobs succeeded or were skipped
          echo "✅ All tests passed"
          exit 0

  # Check if bottles have been published (for PRs with formula changes)
  check-bottle-published:
    if: always() && github.event_name == 'pull_request'
    needs:
      - setup
      - conclusion
    permissions:
      pull-requests: read
    runs-on: ubuntu-latest
    steps:
      - name: Check for bottle published label
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
        env:
          HAS_FORMULAE: ${{ needs.setup.outputs.has-formulae }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const hasFormulae = process.env.HAS_FORMULAE === 'true';
            const prNumber = context.issue.number;

            // If no formula changes, pass automatically
            if (!hasFormulae) {
              console.log('✅ No formula changes detected - skipping bottle published check');
              return;
            }

            console.log(`Checking for bottle-published label on PR #${prNumber}...`);

            // Get PR labels
            const { data: labels } = await github.rest.issues.listLabelsOnIssue({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: prNumber
            });

            const labelNames = labels.map(label => label.name);
            console.log(`PR labels: ${labelNames.join(', ')}`);

            // Check if bottle published label exists
            const hasBottlePublished = labelNames.includes('bottle-published');

            if (hasBottlePublished) {
              console.log('✅ bottle-published label found - PR can be merged');
            } else {
              console.log('❌ bottle-published label not found - bottles must be published before merging');
              throw new Error('bottle-published label not found');
            }

  auto-approve-lizardbyte-bot:
    if: |
      github.event_name == 'pull_request' &&
      github.event.pull_request.user.login == 'LizardByte-bot'
    needs: conclusion
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - name: Label PR with pr-pull
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
        with:
          github-token: ${{ secrets.GH_BOT_TOKEN }}
          script: |
            await github.rest.issues.addLabels({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              labels: ['pr-pull']
            });