test.yml

name: Test Suite

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

# Least-privilege token: this workflow only reads the repo (tests + coverage
# artifact upload need no write scopes)
permissions:
  contents: read

env:
  # Coverage threshold - configurable, not hardcoded
  # Set to 0 to disable threshold enforcement
  #
  # NOTE: kcov cannot trace subprocess executions due to LD_PRELOAD limitations.
  # When bats runs tests, it spawns new bash processes that kcov cannot instrument.
  # This is a known limitation (see: https://github.com/bats-core/bats-core/issues/15)
  # Coverage is kept as informational-only; test pass rate is the quality gate.
  COVERAGE_THRESHOLD: 0
  KCOV_VERSION: "42"

jobs:
  test:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        # Test jobs never push — don't persist GITHUB_TOKEN in git config (#282)
        persist-credentials: false

    - name: Setup Node.js
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
        node-version: '18'

    - name: Install dependencies
      run: |
        npm install
        sudo apt-get update
        sudo apt-get install -y jq

    - name: Run unit tests
      run: npm run test:unit

    - name: Run integration tests
      run: npm run test:integration || true

    - name: Run E2E tests
      run: npm run test:e2e
      timeout-minutes: 15

    - name: Generate test report
      run: |
        {
          echo "## Test Results"
          echo "✅ Unit tests passed"
          echo "✅ E2E tests passed"
        } >> "$GITHUB_STEP_SUMMARY"

  coverage:
    runs-on: ubuntu-latest
    needs: test

    steps:
    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        # Test jobs never push — don't persist GITHUB_TOKEN in git config (#282)
        persist-credentials: false

    - name: Setup Node.js
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
        node-version: '18'

    - name: Install dependencies
      run: |
        npm install
        sudo apt-get update
        sudo apt-get install -y jq

    - name: Build and install kcov from source
      run: |
        # Install kcov build dependencies
        sudo apt-get install -y \
          cmake \
          g++ \
          binutils-dev \
          libcurl4-openssl-dev \
          libdw-dev \
          libiberty-dev \
          zlib1g-dev \
          libssl-dev

        # Clone and build kcov
        git clone --depth 1 --branch v${KCOV_VERSION} https://github.com/SimonKagstrom/kcov.git /tmp/kcov-src
        cd /tmp/kcov-src
        mkdir build && cd build
        cmake -DCMAKE_INSTALL_PREFIX=/usr/local ..
        make -j$(nproc)
        sudo make install

        # Verify installation
        /usr/local/bin/kcov --version

    - name: Verify kcov installation
      run: |
        which kcov
        kcov --version

    - name: Run tests with coverage
      run: |
        mkdir -p coverage

        # Use full path to bats since kcov subprocess doesn't inherit npm PATH
        BATS_CMD="$(pwd)/node_modules/.bin/bats"

        # Run CLI parsing tests under kcov
        kcov --include-path="$(pwd)/ralph_loop.sh,$(pwd)/lib" \
             --exclude-pattern=tests/,node_modules/ \
             coverage/cli-parsing \
             bash -c "$BATS_CMD tests/unit/test_cli_parsing.bats" || true

        # Run all unit tests under kcov for comprehensive coverage
        kcov --include-path="$(pwd)/ralph_loop.sh,$(pwd)/lib" \
             --exclude-pattern=tests/,node_modules/ \
             coverage/all-unit \
             bash -c "$BATS_CMD tests/unit/" || true

    - name: Parse coverage results
      id: coverage
      run: |
        # Extract coverage percentage from kcov JSON output
        COVERAGE_FILE="coverage/all-unit/kcov-merged/coverage.json"

        if [[ -f "$COVERAGE_FILE" ]]; then
          COVERAGE_PCT=$(jq -r '.percent_covered // "0"' "$COVERAGE_FILE" | cut -d'.' -f1)
          echo "coverage_percent=$COVERAGE_PCT" >> $GITHUB_OUTPUT
          echo "Coverage: ${COVERAGE_PCT}%"
        else
          # Fallback: try to find any coverage.json
          COVERAGE_FILE=$(find coverage -name "coverage.json" -type f 2>/dev/null | head -1)
          if [[ -n "$COVERAGE_FILE" && -f "$COVERAGE_FILE" ]]; then
            COVERAGE_PCT=$(jq -r '.percent_covered // "0"' "$COVERAGE_FILE" | cut -d'.' -f1)
            echo "coverage_percent=$COVERAGE_PCT" >> $GITHUB_OUTPUT
            echo "Coverage (from $COVERAGE_FILE): ${COVERAGE_PCT}%"
          else
            echo "coverage_percent=0" >> $GITHUB_OUTPUT
            echo "Warning: Could not find coverage results"
            # List what we do have for debugging
            find coverage -type f -name "*.json" 2>/dev/null || echo "No JSON files found"
            ls -laR coverage/ 2>/dev/null || echo "Coverage directory empty or not found"
          fi
        fi

    - name: Check coverage threshold
      run: |
        COVERAGE=${{ steps.coverage.outputs.coverage_percent }}
        THRESHOLD=${{ env.COVERAGE_THRESHOLD }}

        echo "## Coverage Report" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "| Metric | Value |" >> $GITHUB_STEP_SUMMARY
        echo "|--------|-------|" >> $GITHUB_STEP_SUMMARY
        echo "| Coverage | ${COVERAGE}% |" >> $GITHUB_STEP_SUMMARY
        echo "| Threshold | ${THRESHOLD}% |" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY

        if [[ "$THRESHOLD" -eq 0 ]]; then
          echo "✅ Coverage threshold enforcement disabled" >> $GITHUB_STEP_SUMMARY
          echo "Coverage threshold enforcement disabled (COVERAGE_THRESHOLD=0)"
          exit 0
        fi

        if [[ -z "$COVERAGE" || "$COVERAGE" == "0" ]]; then
          echo "⚠️ Coverage measurement failed - skipping threshold check" >> $GITHUB_STEP_SUMMARY
          echo "Coverage measurement failed - skipping threshold check"
          exit 0
        fi

        if [[ "$COVERAGE" -lt "$THRESHOLD" ]]; then
          echo "❌ Coverage ${COVERAGE}% is below threshold ${THRESHOLD}%" >> $GITHUB_STEP_SUMMARY
          echo "::error::Coverage ${COVERAGE}% is below threshold ${THRESHOLD}%"
          exit 1
        else
          echo "✅ Coverage ${COVERAGE}% meets threshold ${THRESHOLD}%" >> $GITHUB_STEP_SUMMARY
          echo "Coverage ${COVERAGE}% meets threshold ${THRESHOLD}%"
        fi

    - name: Upload coverage artifacts
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      if: always()
      with:
        name: coverage-report
        path: coverage/
        retention-days: 7

    - name: Upload coverage to Codecov (optional)
      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
      if: always()
      continue-on-error: true
      with:
        directory: coverage/all-unit
        fail_ci_if_error: false
        verbose: true