test-matrix.yml

name: Test Matrix

on:
  schedule:
    # Nightly comprehensive testing: all Python versions across the full matrix.
    # Not triggered on push because ci-tests.yml already covers default-Python
    # unit/integration on every main/develop push, and the multi-Python sweep
    # would duplicate that work.  Keeping the nightly run ensures all supported
    # versions are validated regularly without burning extra CI minutes on PRs.
    - cron: '0 2 * * *'
  workflow_dispatch:
    # Allow manual triggering of the full matrix at any time.

# Scope concurrency per-ref: two schedule runs can never overlap and a manual
# dispatch on main won't cancel a running nightly sweep on a different ref.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  config:
    name: Get Configuration
    uses: ./.github/workflows/shared-config.yml

  setup-cache:
    name: Setup Test Cache
    needs: config
    uses: ./.github/workflows/cache-management.yml
    with:
      cache-type: dependencies
      cache-key-base: test-deps
      python-version: ${{ needs.config.outputs.default-python-version }}

  unit-tests:
    name: Unit Tests
    needs: [config, setup-cache]
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]  # Disabled windows-latest, macos-latest for now
        # Dynamic matrix from config with static fallback for act/dry-run
        # Update static list when adding new Python versions (currently 3.10-3.14)
        python-version: ${{ fromJSON(needs.config.outputs.python-versions || '["3.10", "3.11", "3.12", "3.13", "3.14"]') }}
    uses: ./.github/workflows/reusable-test.yml
    secrets: inherit
    with:
      test-type: unit
      python-version: ${{ matrix.python-version }}
      os: ${{ matrix.os }}
      default-python-version: ${{ needs.config.outputs.default-python-version }}
      cache-key: ${{ needs.setup-cache.outputs.cache-key }}
      artifact-prefix: test-matrix
      aws-region: ${{ needs.config.outputs.aws-region }}
      aws-access-key: ${{ needs.config.outputs.aws-access-key }}
      aws-secret-key: ${{ needs.config.outputs.aws-secret-key }}
      environment: ${{ needs.config.outputs.environment }}
      testing-flag: ${{ needs.config.outputs.testing-flag }}

  integration-tests:
    name: Integration Tests
    needs: [config, setup-cache]
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]  # Disabled windows-latest, macos-latest for now
        # Dynamic matrix from config with static fallback for act/dry-run
        # Update static list when adding new Python versions (currently 3.10-3.14)
        python-version: ${{ fromJSON(needs.config.outputs.python-versions || '["3.10", "3.11", "3.12", "3.13", "3.14"]') }}
    uses: ./.github/workflows/reusable-test.yml
    secrets: inherit
    with:
      test-type: integration
      python-version: ${{ matrix.python-version }}
      os: ${{ matrix.os }}
      default-python-version: ${{ needs.config.outputs.default-python-version }}
      cache-key: ${{ needs.setup-cache.outputs.cache-key }}
      artifact-prefix: test-matrix
      aws-region: ${{ needs.config.outputs.aws-region }}
      aws-access-key: ${{ needs.config.outputs.aws-access-key }}
      aws-secret-key: ${{ needs.config.outputs.aws-secret-key }}
      environment: ${{ needs.config.outputs.environment }}
      testing-flag: ${{ needs.config.outputs.testing-flag }}

  # Provider matrix: auto-discovered from tests/providers/*/testconf.mk via
  # shared-config.  Adding a new provider directory + testconf.mk fragment
  # causes it to run here across all Python versions with no workflow edit.
  providers-tests:
    name: Providers Tests
    needs: [config, setup-cache]
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]
        python-version: ${{ fromJSON(needs.config.outputs.python-versions || '["3.10", "3.11", "3.12", "3.13", "3.14"]') }}
        # Dynamic discovery: static fallback ['aws'] keeps CI valid in forks.
        provider: ${{ fromJSON(needs.config.outputs.providers || '["aws"]') }}
    uses: ./.github/workflows/reusable-test.yml
    secrets: inherit
    with:
      test-type: providers
      provider: ${{ matrix.provider }}
      python-version: ${{ matrix.python-version }}
      os: ${{ matrix.os }}
      default-python-version: ${{ needs.config.outputs.default-python-version }}
      cache-key: ${{ needs.setup-cache.outputs.cache-key }}
      artifact-prefix: test-matrix
      aws-region: ${{ needs.config.outputs.aws-region }}
      aws-access-key: ${{ needs.config.outputs.aws-access-key }}
      aws-secret-key: ${{ needs.config.outputs.aws-secret-key }}
      environment: ${{ needs.config.outputs.environment }}
      testing-flag: ${{ needs.config.outputs.testing-flag }}

  # package-variant-tests was removed from this workflow.
  # The authoritative package-variant testing lives in package-testing.yml which
  # builds the wheel (not editable source), tests the minimal and all meta-extras,
  # and includes import-guard, dependency-isolation, and error-message-quality
  # steps.  Running a lighter import-probe matrix here too caused the same
  # Python/extra combinations to be checked twice on every main push.

  e2e-tests:
    name: End-to-End Tests
    needs: [config, setup-cache]
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]  # Disabled windows-latest, macos-latest for now
        # Dynamic matrix from config with static fallback for act/dry-run
        # Update static list when adding new Python versions (currently 3.10-3.14)
        python-version: ${{ fromJSON(needs.config.outputs.python-versions || '["3.10", "3.11", "3.12", "3.13", "3.14"]') }}
    uses: ./.github/workflows/reusable-test.yml
    secrets: inherit
    with:
      test-type: e2e
      python-version: ${{ matrix.python-version }}
      os: ${{ matrix.os }}
      default-python-version: ${{ needs.config.outputs.default-python-version }}
      cache-key: ${{ needs.setup-cache.outputs.cache-key }}
      artifact-prefix: test-matrix
      aws-region: ${{ needs.config.outputs.aws-region }}
      aws-access-key: ${{ needs.config.outputs.aws-access-key }}
      aws-secret-key: ${{ needs.config.outputs.aws-secret-key }}
      environment: ${{ needs.config.outputs.environment }}
      testing-flag: ${{ needs.config.outputs.testing-flag }}

  test-summary:
    name: Test Summary
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: [unit-tests, integration-tests, providers-tests, e2e-tests]
    if: always()
    permissions:
      contents: read

    steps:
    - name: Download all test results
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
      with:
        path: test-results/

    - name: Display test summary
      run: |
        # Count test result files
        UNIT_RESULTS=$(find test-results/ -name "*unit.xml" | wc -l)
        INTEGRATION_RESULTS=$(find test-results/ -name "*integration.xml" | wc -l)

        {
          echo "## Test Matrix Results"
          echo ""
          echo "- Unit test configurations: $UNIT_RESULTS"
          echo "- Integration test configurations: $INTEGRATION_RESULTS"
          echo ""
          echo "### Test Result Files:"
        } >> "$GITHUB_STEP_SUMMARY"
        find test-results/ -name "*.xml" | sort >> "$GITHUB_STEP_SUMMARY"