ci-tests.yml

name: Unit Tests

on:
  push:
    branches: [ main, develop ]
    paths:
      - 'src/**'
      - 'tests/**'
      - 'pyproject.toml'
      - 'requirements*.txt'
      - 'uv.lock'
      - 'assets/**'
      - 'rxconfig.py'
      - '.github/workflows/ci-tests.yml'
  pull_request:
    branches: [ main, develop ]
    paths:
      - 'src/**'
      - 'tests/**'
      - 'pyproject.toml'
      - 'requirements*.txt'
      - 'uv.lock'
      - 'assets/**'
      - 'rxconfig.py'
      - '.github/workflows/ci-tests.yml'
  schedule:
    - cron: '0 2 * * *'

# Cancel in-progress runs when a new push arrives on the same branch/ref.
# Scheduled nightly runs use a stable group key so they never cancel each
# other (there is only ever one running at a time by schedule).
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  config:
    name: Configuration
    uses: ./.github/workflows/shared-config.yml

  setup-cache:
    name: Setup Test Cache
    needs: config
    uses: ./.github/workflows/cache-management.yml
    with:
      cache-type: dependencies
      cache-key-base: test-deps
      python-version: ${{ needs.config.outputs.default-python-version }}

  tests:
    name: Unit Tests (Default Python)
    needs: [config, setup-cache]
    uses: ./.github/workflows/reusable-test.yml
    with:
      test-type: unit
      python-version: ${{ needs.config.outputs.default-python-version }}
      default-python-version: ${{ needs.config.outputs.default-python-version }}
      continue-on-error: false
      aws-region: ${{ needs.config.outputs.aws-region }}
      aws-access-key: ${{ needs.config.outputs.aws-access-key }}
      aws-secret-key: ${{ needs.config.outputs.aws-secret-key }}
      environment: ${{ needs.config.outputs.environment }}
      testing-flag: ${{ needs.config.outputs.testing-flag }}

  integration-tests:
    name: Integration Tests (Default Python)
    needs: [config, setup-cache]
    uses: ./.github/workflows/reusable-test.yml
    with:
      test-type: integration
      python-version: ${{ needs.config.outputs.default-python-version }}
      default-python-version: ${{ needs.config.outputs.default-python-version }}
      continue-on-error: false
      aws-region: ${{ needs.config.outputs.aws-region }}
      aws-access-key: ${{ needs.config.outputs.aws-access-key }}
      aws-secret-key: ${{ needs.config.outputs.aws-secret-key }}
      environment: ${{ needs.config.outputs.environment }}
      testing-flag: ${{ needs.config.outputs.testing-flag }}

  e2e-tests:
    name: End-to-End Tests (Default Python)
    needs: [config, setup-cache]
    uses: ./.github/workflows/reusable-test.yml
    with:
      test-type: e2e
      python-version: ${{ needs.config.outputs.default-python-version }}
      default-python-version: ${{ needs.config.outputs.default-python-version }}
      continue-on-error: true
      aws-region: ${{ needs.config.outputs.aws-region }}
      aws-access-key: ${{ needs.config.outputs.aws-access-key }}
      aws-secret-key: ${{ needs.config.outputs.aws-secret-key }}
      environment: ${{ needs.config.outputs.environment }}
      testing-flag: ${{ needs.config.outputs.testing-flag }}

  # Per-provider matrix. One job per provider subtree under
  # tests/providers/. New providers land here as new matrix entries —
  # no separate onmoto job needed (moto-mocked tests live under
  # tests/providers/aws/mocked and run as part of the aws entry).
  providers-tests:
    name: Providers Tests
    needs: [config, setup-cache]
    strategy:
      fail-fast: false
      matrix:
        provider: [aws]
    uses: ./.github/workflows/reusable-test.yml
    with:
      test-type: providers
      provider: ${{ matrix.provider }}
      python-version: ${{ needs.config.outputs.default-python-version }}
      default-python-version: ${{ needs.config.outputs.default-python-version }}
      continue-on-error: false
      aws-region: ${{ needs.config.outputs.aws-region }}
      aws-access-key: ${{ needs.config.outputs.aws-access-key }}
      aws-secret-key: ${{ needs.config.outputs.aws-secret-key }}
      environment: ${{ needs.config.outputs.environment }}
      testing-flag: ${{ needs.config.outputs.testing-flag }}

  # Serial-marked provider tests (currently the live-AWS subtree).
  # The make target points pytest directly at ``tests/providers/<provider>/live``
  # because ``norecursedirs`` excludes that path from auto-recursion.  Without
  # ``--live`` the root conftest stamps every live test with ``skip_live``, so
  # the job collects the suite, reports SKIPPED, and exits 0 — that proves the
  # collection wiring + skip mechanism still work end-to-end on every PR.
  # When CI is wired up with real AWS credentials, set ``PYTEST_LIVE=--live``
  # in the workflow env to flip the suite into actual execution.
  providers-tests-serial:
    name: Providers Tests (Serial)
    needs: [config, setup-cache, providers-tests]
    strategy:
      fail-fast: false
      matrix:
        provider: [aws]
    uses: ./.github/workflows/reusable-test.yml
    with:
      test-type: providers-serial
      provider: ${{ matrix.provider }}
      python-version: ${{ needs.config.outputs.default-python-version }}
      default-python-version: ${{ needs.config.outputs.default-python-version }}
      continue-on-error: false
      aws-region: ${{ needs.config.outputs.aws-region }}
      aws-access-key: ${{ needs.config.outputs.aws-access-key }}
      aws-secret-key: ${{ needs.config.outputs.aws-secret-key }}
      environment: ${{ needs.config.outputs.environment }}
      testing-flag: ${{ needs.config.outputs.testing-flag }}

  infrastructure-tests:
    name: Infrastructure Tests (Default Python)
    needs: [config, setup-cache]
    uses: ./.github/workflows/reusable-test.yml
    with:
      test-type: infrastructure
      python-version: ${{ needs.config.outputs.default-python-version }}
      default-python-version: ${{ needs.config.outputs.default-python-version }}
      continue-on-error: false
      aws-region: ${{ needs.config.outputs.aws-region }}
      aws-access-key: ${{ needs.config.outputs.aws-access-key }}
      aws-secret-key: ${{ needs.config.outputs.aws-secret-key }}
      environment: ${{ needs.config.outputs.environment }}
      testing-flag: ${{ needs.config.outputs.testing-flag }}

  ui-unit-tests:
    name: UI Unit Tests
    needs: [config, setup-cache]
    uses: ./.github/workflows/reusable-test.yml
    with:
      test-type: ui-unit
      python-version: ${{ needs.config.outputs.default-python-version }}
      default-python-version: ${{ needs.config.outputs.default-python-version }}
      continue-on-error: false
      aws-region: ${{ needs.config.outputs.aws-region }}
      aws-access-key: ${{ needs.config.outputs.aws-access-key }}
      aws-secret-key: ${{ needs.config.outputs.aws-secret-key }}
      environment: ${{ needs.config.outputs.environment }}
      testing-flag: ${{ needs.config.outputs.testing-flag }}

  ui-smoke:
    name: UI Smoke
    needs: [config, setup-cache]
    uses: ./.github/workflows/reusable-test.yml
    with:
      test-type: ui-smoke
      python-version: ${{ needs.config.outputs.default-python-version }}
      default-python-version: ${{ needs.config.outputs.default-python-version }}
      continue-on-error: false
      aws-region: ${{ needs.config.outputs.aws-region }}
      aws-access-key: ${{ needs.config.outputs.aws-access-key }}
      aws-secret-key: ${{ needs.config.outputs.aws-secret-key }}
      environment: ${{ needs.config.outputs.environment }}
      testing-flag: ${{ needs.config.outputs.testing-flag }}

  build-and-package:
    name: Build & Package
    runs-on: ubuntu-latest
    needs: [config, setup-cache]
    permissions:
      contents: read

    steps:
    - name: Checkout code
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

    - name: Setup UV with cache
      uses: ./.github/actions/setup-uv-cached
      with:
        cache-key: ${{ needs.setup-cache.outputs.cache-key }}
        fail-on-cache-miss: false

    - name: Build package
      run: make build

    - name: Upload build artifacts
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
      with:
        name: build-artifacts-${{ needs.config.outputs.package-version }}
        retention-days: 60
        path: |
          dist/
          build/

  test-report:
    name: Generate Test Report
    runs-on: ubuntu-latest
    needs: [config, setup-cache, tests, integration-tests, e2e-tests, providers-tests, providers-tests-serial, infrastructure-tests, ui-unit-tests, ui-smoke]
    if: always()
    permissions:
      contents: read
      issues: read
      checks: write
      pull-requests: write

    steps:
    - name: Checkout code
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

    - name: Setup UV with cache
      uses: ./.github/actions/setup-uv-cached
      with:
        cache-key: ${{ needs.setup-cache.outputs.cache-key }}
        fail-on-cache-miss: false

    - name: Download test results
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
      with:
        path: test-results/

    - name: Publish Test Results
      uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3  # v2
      if: always()
      continue-on-error: true
      with:
        files: "test-results/**/junit-*.xml"
        check_name: "Test Results Summary"
        comment_mode: "always"
        job_summary: true
        action_fail: false
        fail_on: "nothing"