acceptance-tests.yml

name: Acceptance Tests

on:
  pull_request:
  workflow_dispatch:

jobs:
  detect-changes:
    name: detect-changes
    runs-on: ubuntu-latest
    outputs:
      docs-only: ${{ steps.check.outputs.docs-only }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - name: Check if changes are docs-only
        id: check
        run: |
          # Always run full CI on workflow_dispatch, tags, or when PR title contains [full-ci]
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            echo "docs-only=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          PR_TITLE="${{ github.event.pull_request.title }}"
          if echo "$PR_TITLE" | grep -qi "\[full-ci\]"; then
            echo "docs-only=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # Get changed files between the PR base and head
          CHANGED_FILES=$(git diff --name-only "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}" 2>/dev/null || git diff --name-only HEAD~1)

          # Patterns that are considered documentation/non-code changes
          DOCS_ONLY=true
          while IFS= read -r file; do
            case "$file" in
              .github/workflows/*) DOCS_ONLY=false; break ;;
              .github/*|.vscode/*|changelog/*|docs/*|deployments/*) ;;
              */CHANGELOG.md|*/CONTRIBUTING.md|*/README.md|CHANGELOG.md|CONTRIBUTING.md|LICENSE|README.md) ;;
              *) DOCS_ONLY=false; break ;;
            esac
          done <<< "$CHANGED_FILES"

          echo "docs-only=$DOCS_ONLY" >> "$GITHUB_OUTPUT"
          echo "Changed files docs-only: $DOCS_ONLY"

  build-and-test:
    name: build-and-test
    needs: [detect-changes]
    if: needs.detect-changes.outputs.docs-only != 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          cache: true

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "24"

      - name: Enable pnpm
        run: corepack enable && corepack prepare pnpm@10.33.3 --activate

      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
        with:
          php-version: "8.4"
          extensions: curl, xml, mbstring, zip, ldap, gd
          tools: composer

      - name: Install libvips-dev for ENABLE_VIPS build
        run: |
          sudo apt-get update -qq
          # NEEDRESTART_MODE=a: auto-restart services silently; without this, needrestart can fail with exit code 6
          sudo NEEDRESTART_MODE=a apt-get install -y libvips-dev

      - name: Pre-checks and generate
        run: |
          # Phase 1 — I/O + light CPU, no contention between tasks.
          # wa (I/O wait) will spike during npm/pnpm downloads.
          # Expected avg load: ~50-60 % CPU on 2 vCPU.
          vmstat 2 > /tmp/vmstat-phase1.log & MONITOR_PID=$!

          (make vendor-bin-codestyle && make vendor-bin-codesniffer && make test-php-style && make check-env-var-annotations) > /tmp/php-style.log   2>&1 & PIDS=($!)
          (npm install -g @gherlint/gherlint@1.1.0 && make test-gherkin-lint)                                                 > /tmp/gherkin.log     2>&1 & PIDS+=($!)
          bash tests/acceptance/check-deleted-suites-in-expected-failure.sh                                                   > /tmp/suites.log      2>&1 & PIDS+=($!)
          make govulncheck                                                                                                     > /tmp/govulncheck.log 2>&1 & PIDS+=($!)
          make ci-node-generate                                                                                                > /tmp/node-gen.log    2>&1 & PIDS+=($!)
          make ci-go-generate                                                                                                  > /tmp/go-gen.log      2>&1 & PIDS+=($!)
          make changelog-lint                                                                                                   > /tmp/changelog-lint.log 2>&1 & PIDS+=($!)

          FAILED=0
          for PID in "${PIDS[@]}"; do wait "$PID" || FAILED=1; done
          kill $MONITOR_PID 2>/dev/null; wait $MONITOR_PID 2>/dev/null || true

          # How to read the load line:
          #   busy    — % of time CPUs were doing work  (100% = fully saturated)
          #   runq    — processes waiting for a CPU turn; runq >> nCPU means tasks
          #             compete and each runs slower (runq 10 on 2 vCPU = ~5× slower)
          #   wa      — % waiting on disk/network; wa > 20% = I/O bound, not CPU bound
          #             → high wa: add more parallel tasks; high runq: reduce them
          awk '/^[ ]*[0-9]/ { busy=100-$15; sum_b+=busy; if(busy>pk_b)pk_b=busy;
                               sum_r+=$1;   if($1>pk_r) pk_r=$1; sum_wa+=$16; n++ }
               END { printf "=== phase 1 load (2 vCPU): avg busy %d%% peak %d%% | avg runq %.0f peak %d | avg wa %d%%\n",
                     sum_b/n, pk_b, sum_r/n, pk_r, sum_wa/n }' /tmp/vmstat-phase1.log

          echo "=== php-style ==="       && cat /tmp/php-style.log
          echo "=== gherkin ==="          && cat /tmp/gherkin.log
          echo "=== suites ==="           && cat /tmp/suites.log
          echo "=== govulncheck ==="      && cat /tmp/govulncheck.log
          echo "=== ci-node-generate ===" && cat /tmp/node-gen.log
          echo "=== ci-go-generate ==="   && cat /tmp/go-gen.log
          echo "=== changelog-lint ===" && cat /tmp/changelog-lint.log

          exit $FAILED

      - name: Trivy scan
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
        with:
          scan-type: fs
          format: table
          exit-code: 1
          severity: CRITICAL,HIGH
          trivy-config: .trivy.yaml

      - name: Build, lint and test
        run: |
          # Phase 2 — all three are CPU-bound Go compilation on 2 vCPU.
          # They compete for CPU (expect id < 10, load ~95 %) but share the
          # Go build cache within this runner, so make test reuses artifacts
          # from the ocis build. Critical path = ocis build (~300 s).
          vmstat 2 > /tmp/vmstat-phase2.log & MONITOR_PID=$!

          make ci-golangci-lint                          > /tmp/golangci-lint.log      2>&1 & PIDS=($!)
          ENABLE_VIPS=true make -C ocis build            > /tmp/ocis-build.log         2>&1 & PIDS+=($!)
          make test                                      > /tmp/unit-tests.log         2>&1 & PIDS+=($!)
          GOWORK=off make -C tests/ociswrapper build     > /tmp/ociswrapper-build.log  2>&1 & PIDS+=($!)

          FAILED=0
          for PID in "${PIDS[@]}"; do wait "$PID" || FAILED=1; done
          kill $MONITOR_PID 2>/dev/null; wait $MONITOR_PID 2>/dev/null || true

          # Signal: busy=saturated  runq>>2=tasks competing(slows each)  wa>20%=I/O bound
          awk '/^[ ]*[0-9]/ { busy=100-$15; sum_b+=busy; if(busy>pk_b)pk_b=busy;
                               sum_r+=$1;   if($1>pk_r) pk_r=$1; sum_wa+=$16; n++ }
               END { printf "=== phase 2 load (2 vCPU): avg busy %d%% peak %d%% | avg runq %.0f peak %d | avg wa %d%%\n",
                     sum_b/n, pk_b, sum_r/n, pk_r, sum_wa/n }' /tmp/vmstat-phase2.log

          echo "=== golangci-lint ==="     && cat /tmp/golangci-lint.log
          echo "=== ocis build ==="        && cat /tmp/ocis-build.log
          echo "=== ociswrapper build ===" && cat /tmp/ociswrapper-build.log
          echo "=== unit tests ==="        && cat /tmp/unit-tests.log

          exit $FAILED

      - name: Upload build artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: ocis-build-artifacts
          path: |
            ocis/bin/ocis
            tests/ociswrapper/bin/ociswrapper
          retention-days: 1
          if-no-files-found: error

  local-api-tests:
    name: ${{ matrix.suite }}
    needs: [build-and-test]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        suite:
          # contract & locks
          - apiContract
          - apiLocks
          # settings & notifications (needs email)
          - apiSettings
          - apiNotification
          - apiCors
          # graph
          - apiGraphUser
          - apiGraph
          - apiGraphGroup
          # spaces & dav
          - apiSpaces
          - apiSpacesShares
          - apiSpacesDavOperation
          - apiDownloads
          - apiAsyncUpload
          - apiDepthInfinity
          - apiArchiver
          - apiActivities
          # search
          - apiSearch1
          - apiSearch2
          - apiSearchContent    # needs Tika
          # sharing
          - apiSharingNgShares
          - apiReshare
          - apiSharingNgPermissions
          - apiSharingNgAdditionalShareRole
          - apiSharingNgDriveInvitation
          - apiSharingNgItemInvitation
          - apiSharingNgDriveLinkShare
          - apiSharingNgItemLinkShare
          - apiSharingNgLinkShareManagement
          # auth
          - apiAuthApp
          # antivirus (needs ClamAV)
          - apiAntivirus
          # federation (needs email + federation ocis)
          - apiOcm
          # collaboration (needs WOPI)
          - apiCollaboration
          - apiVault
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
        with:
          php-version: "8.4"
          extensions: curl, xml, mbstring, zip, ldap, gd
          tools: composer

      - name: Cache libcurl 8.12.0
        id: cache-libcurl
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: /opt/libcurl
          key: libcurl-8.12.0-${{ runner.os }}

      - name: Install libcurl 8.12.0 build dependencies
        # Always run: libvips-dev is needed at runtime (govips thumbnails in the pre-built binary)
        run: |
          sudo apt-get update -qq
          # NEEDRESTART_MODE=a: auto-restart services silently; without this, needrestart can fail with exit code 6
          sudo NEEDRESTART_MODE=a apt-get install -y libssl-dev libnghttp2-dev libpsl-dev libldap-dev libssh-dev zlib1g-dev libvips-dev

      - name: Compile libcurl 8.12.0 from source
        if: steps.cache-libcurl.outputs.cache-hit != 'true'
        run: |
          cd /tmp
          curl -sLO https://curl.se/download/curl-8.12.0.tar.gz
          tar xzf curl-8.12.0.tar.gz
          cd curl-8.12.0
          ./configure --with-ssl --with-zlib --with-nghttp2 --prefix=/opt/libcurl --enable-versioned-symbols --silent
          make -j$(nproc) --silent
          sudo make install --silent

      - name: Restore libcurl ldconfig
        # Always run: on cache hit the .so files are restored to /opt/libcurl/lib but
        # /etc/ld.so.cache on the fresh runner doesn't know about them yet.
        # Without ldconfig, PHP's curl extension can't find libcurl even though it's present.
        run: |
          echo "/opt/libcurl/lib" | sudo tee /etc/ld.so.conf.d/libcurl-8.conf
          sudo ldconfig
          /opt/libcurl/bin/curl --version | head -1
          php -r '
            $v = curl_version()["version"];
            echo "PHP curl: $v\n";
            if (version_compare($v, "8.12.0", "<")) {
              fwrite(STDERR, "FATAL: PHP sees libcurl $v, need >= 8.12.0\n");
              exit(1);
            }
          '

      - name: Download build artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ocis-build-artifacts

      - name: Restore binary permissions
        run: chmod +x ocis/bin/ocis tests/ociswrapper/bin/ociswrapper

      - name: Run ${{ matrix.suite }}
        run: BEHAT_SUITES=${{ matrix.suite }} python3 tests/acceptance/run-github.py

  cli-tests:
    needs: [build-and-test]
    name: ${{ matrix.suite }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        suite:
          - cliCommands,apiServiceAvailability   # grouped: both need ClamAV + email services
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
        with:
          php-version: "8.4"
          extensions: curl, xml, mbstring, zip, ldap, gd
          tools: composer

      - name: Install libvips runtime
        run: |
          sudo apt-get update -qq
          # NEEDRESTART_MODE=a: auto-restart services silently; without this, needrestart can fail with exit code 6
          sudo NEEDRESTART_MODE=a apt-get install -y libvips42t64

      - name: Download build artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ocis-build-artifacts

      - name: Restore binary permissions
        run: chmod +x ocis/bin/ocis tests/ociswrapper/bin/ociswrapper

      - name: Run ${{ matrix.suite }}
        run: BEHAT_SUITES="${{ matrix.suite }}" python3 tests/acceptance/run-github.py

  ldap-pool-tests:
    needs: [build-and-test]
    name: ldapPool-${{ matrix.suite }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        suite:
          - apiGraphUser,apiGraph,apiGraphGroup
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
        with:
          php-version: "8.4"
          extensions: curl, xml, mbstring, zip, ldap, gd
          tools: composer

      - name: Install libvips runtime
        run: |
          sudo apt-get update -qq
          # NEEDRESTART_MODE=a: auto-restart services silently; without this, needrestart can fail with exit code 6
          sudo NEEDRESTART_MODE=a apt-get install -y libvips42t64

      - name: Download build artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ocis-build-artifacts

      - name: Restore binary permissions
        run: chmod +x ocis/bin/ocis tests/ociswrapper/bin/ociswrapper

      - name: Run ${{ matrix.suite }} with OCIS_LDAP_POOL_ENABLED=true
        run: BEHAT_SUITES="${{ matrix.suite }}" OCIS_LDAP_POOL_ENABLED=true python3 tests/acceptance/run-github.py

  core-api-tests:
    name: ${{ matrix.suite }}
    needs: [build-and-test]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        suite:
          - "coreApiAuth,coreApiCapabilities,coreApiFavorites,coreApiMain,coreApiVersions"
          - "coreApiShareManagementBasicToShares,coreApiShareManagementToShares"
          - "coreApiSharees"
          - "coreApiSharePublicLink2"
          - "coreApiShareOperationsToShares1,coreApiShareOperationsToShares2,coreApiSharePublicLink1,coreApiShareCreateSpecialToShares1,coreApiShareCreateSpecialToShares2,coreApiShareUpdateToShares"
          - "coreApiTrashbin,coreApiTrashbinRestore,coreApiWebdavEtagPropagation1,coreApiWebdavEtagPropagation2"
          - "coreApiWebdavDelete,coreApiWebdavOperations,coreApiWebdavMove2"
          - "coreApiWebdavProperties"
          - "coreApiWebdavMove1,coreApiWebdavPreviews,coreApiWebdavUpload,coreApiWebdavUploadTUS"
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
        with:
          php-version: "8.4"
          extensions: curl, xml, mbstring, zip, ldap, gd
          tools: composer

      - name: Cache libcurl 8.12.0
        id: cache-libcurl
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: /opt/libcurl
          key: libcurl-8.12.0-${{ runner.os }}

      - name: Install libcurl 8.12.0 build dependencies
        # Always run: libvips-dev is needed at runtime (govips thumbnails in the pre-built binary)
        run: |
          sudo apt-get update -qq
          # NEEDRESTART_MODE=a: auto-restart services silently; without this, needrestart can fail with exit code 6
          sudo NEEDRESTART_MODE=a apt-get install -y libssl-dev libnghttp2-dev libpsl-dev libldap-dev libssh-dev zlib1g-dev libvips-dev

      - name: Compile libcurl 8.12.0 from source
        if: steps.cache-libcurl.outputs.cache-hit != 'true'
        run: |
          cd /tmp
          curl -sLO https://curl.se/download/curl-8.12.0.tar.gz
          tar xzf curl-8.12.0.tar.gz
          cd curl-8.12.0
          ./configure --with-ssl --with-zlib --with-nghttp2 --prefix=/opt/libcurl --enable-versioned-symbols --silent
          make -j$(nproc) --silent
          sudo make install --silent

      - name: Restore libcurl ldconfig
        # Always run: on cache hit the .so files are restored to /opt/libcurl/lib but
        # /etc/ld.so.cache on the fresh runner doesn't know about them yet.
        # Without ldconfig, PHP's curl extension can't find libcurl even though it's present.
        run: |
          echo "/opt/libcurl/lib" | sudo tee /etc/ld.so.conf.d/libcurl-8.conf
          sudo ldconfig
          /opt/libcurl/bin/curl --version | head -1
          php -r '
            $v = curl_version()["version"];
            echo "PHP curl: $v\n";
            if (version_compare($v, "8.12.0", "<")) {
              fwrite(STDERR, "FATAL: PHP sees libcurl $v, need >= 8.12.0\n");
              exit(1);
            }
          '

      - name: Download build artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ocis-build-artifacts

      - name: Restore binary permissions
        run: chmod +x ocis/bin/ocis tests/ociswrapper/bin/ociswrapper

      - name: Run ${{ matrix.suite }}
        run: >
          BEHAT_SUITES="${{ matrix.suite }}"
          ACCEPTANCE_TEST_TYPE=core-api
          WITH_REMOTE_PHP=true
          python3 tests/acceptance/run-github.py

  e2e-tests:
    name: e2e-${{ matrix.suite }}
    needs: [build-and-test]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - suite: part-1
            args: "--type playwright --total-parts 4 --xsuites search,app-provider,ocm,keycloak,mfa,oidc --run-part 1"
          - suite: part-2
            args: "--type playwright --total-parts 4 --xsuites search,app-provider,ocm,keycloak,mfa,oidc --run-part 2"
          - suite: part-3
            args: "--type playwright --total-parts 4 --xsuites search,app-provider,ocm,keycloak,mfa,oidc --run-part 3"
          - suite: part-4
            args: "--type playwright --total-parts 4 --xsuites search,app-provider,ocm,keycloak,mfa,oidc --run-part 4"
          - suite: search
            args: "--type playwright --suites search"
            tika: true
          - suite: keycloak
            args: "--type playwright --suites journeys,keycloak"
            keycloak: true
          - suite: mfa
            args: "--type playwright --suites mfa"
            mfa: true
          - suite: oidc
            args: "--type playwright specs/oidc/refreshToken.spec.ts"
            oidc: true
          - suite: oidc-iframe
            args: "--type playwright specs/oidc/iframeTokenRenewal.spec.ts"
            oidc_iframe: true
          - suite: app-provider
            args: "--type playwright --suites app-provider"
            collaboration: true
          - suite: ocm
            args: "--type playwright --suites ocm"
            federated: true
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          # 24.16.0 breaks playwright install (yauzl zip extraction hangs); pin to last known good.
          # https://github.com/microsoft/playwright/issues/40724
          node-version: "24.15.0"
      - name: Enable pnpm
        run: |
          corepack enable && corepack prepare pnpm@10.33.3 --activate
          pnpm config set store-dir ./.pnpm-store

      - name: Install libvips runtime
        run: |
          sudo apt-get update -qq
          # NEEDRESTART_MODE=a: auto-restart services silently; without this, needrestart can fail with exit code 6
          sudo NEEDRESTART_MODE=a apt-get install -y libvips42t64

      - name: Download build artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ocis-build-artifacts

      - name: Restore binary permissions
        run: chmod +x ocis/bin/ocis tests/ociswrapper/bin/ociswrapper

      - name: Cache Playwright Chromium
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/ms-playwright
          key: playwright-chromium-${{ hashFiles('web/pnpm-lock.yaml') }}

      # --- Tika (search suite only) ---
      - name: Start Tika
        if: matrix.tika == true
        run: |
          docker run -d --name tika --network host apache/tika:3.2.2.0-full
          timeout 120 bash -c 'until curl -sf http://localhost:9998; do sleep 2; done'
          echo "tika ready."

      # --- Keycloak (keycloak and mfa suites) ---
      - name: Generate Keycloak certs
        if: matrix.keycloak == true || matrix.mfa == true
        run: |
          mkdir -p keycloak-certs
          openssl req -x509 -newkey rsa:2048 \
            -keyout keycloak-certs/keycloakkey.pem \
            -out keycloak-certs/keycloakcrt.pem \
            -nodes -days 365 -subj '/CN=keycloak' \
            -addext 'subjectAltName=DNS:localhost,IP:127.0.0.1'
          chmod -R 777 keycloak-certs

      - name: Start Postgres
        if: matrix.keycloak == true || matrix.mfa == true
        run: |
          docker run -d --name postgres --network host \
            -e POSTGRES_DB=keycloak \
            -e POSTGRES_USER=keycloak \
            -e POSTGRES_PASSWORD=keycloak \
            postgres:alpine3.18
          timeout 30 bash -c 'until docker exec postgres pg_isready -U keycloak; do sleep 1; done'

      - name: Start Keycloak
        if: matrix.keycloak == true || matrix.mfa == true
        run: |
          # The mfa suite needs a different realm with TOTP MFA configured.
          # ocis-ci-realm uses ocis-server:9200, ocis-mfa-ci-realm uses localhost:9200;
          # ocis runs on 127.0.0.1:9200 so we rewrite both forms.
          if [[ "${{ matrix.mfa }}" == "true" ]]; then
            REALM_FILE=tests/config/ci/ocis-mfa-ci-realm.dist.json
          else
            REALM_FILE=tests/config/ci/ocis-ci-realm.dist.json
          fi
          sed -e 's|https://ocis-server:9200|https://127.0.0.1:9200|g' \
              -e 's|https://localhost:9200|https://127.0.0.1:9200|g' \
            "$REALM_FILE" > /tmp/ocis-realm.json
          docker run -d --name keycloak --network host \
            -e OCIS_DOMAIN=https://127.0.0.1:9200 \
            -e KC_HOSTNAME=localhost \
            -e KC_PORT=8443 \
            -e KC_DB=postgres \
            -e "KC_DB_URL=jdbc:postgresql://localhost:5432/keycloak" \
            -e KC_DB_USERNAME=keycloak \
            -e KC_DB_PASSWORD=keycloak \
            -e KC_FEATURES=impersonation \
            -e KC_BOOTSTRAP_ADMIN_USERNAME=admin \
            -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
            -e KC_HTTPS_CERTIFICATE_FILE=/keycloak-certs/keycloakcrt.pem \
            -e KC_HTTPS_CERTIFICATE_KEY_FILE=/keycloak-certs/keycloakkey.pem \
            -v "$(pwd)/keycloak-certs:/keycloak-certs:ro" \
            -v "/tmp/ocis-realm.json:/opt/keycloak/data/import/oCIS-realm.json:ro" \
            quay.io/keycloak/keycloak:26.2.5 \
            start-dev --proxy-headers xforwarded \
              --spi-connections-http-client-default-disable-trust-manager=true \
              --import-realm --health-enabled=true
          timeout 300 bash -c 'until curl -skf https://localhost:9000/health/ready; do sleep 3; done' \
            || (echo "=== keycloak logs ===" && docker logs keycloak --tail 80 && exit 1)
          echo "keycloak ready."

      # --- Collabora + OnlyOffice (app-provider suite only) ---
      - name: Start Collabora
        if: matrix.collaboration == true
        run: |
          docker run -d \
            --name collabora \
            --network host \
            --entrypoint bash \
            -e DONT_GEN_SSL_CERT=set \
            -e "extra_params=--o:ssl.enable=true --o:ssl.termination=true --o:welcome.enable=false --o:net.frame_ancestors=https://127.0.0.1:9200" \
            collabora/code:25.04.7.3.1 \
            -c "coolconfig generate-proof-key && bash /start-collabora-online.sh"
          timeout 150 bash -c 'until curl -kfsSL https://localhost:9980/hosting/discovery > /dev/null; do sleep 5; done'
          echo "collabora ready."

      - name: Start OnlyOffice
        if: matrix.collaboration == true
        run: |
          sudo systemctl stop postgresql || true
          docker run -d \
            --name onlyoffice \
            --network host \
            -e WOPI_ENABLED=true \
            -e USE_UNAUTHORIZED_STORAGE=true \
            -v "${{ github.workspace }}/tests/config/ci/only-office.json:/tmp/local.json:ro" \
            --entrypoint /bin/sh \
            onlyoffice/documentserver:9.2.1 \
            -c "set -e
          cp /tmp/local.json /etc/onlyoffice/documentserver/local.json
          openssl req -x509 -newkey rsa:4096 -keyout onlyoffice.key -out onlyoffice.crt -sha256 -days 365 -batch -nodes
          mkdir -p /var/www/onlyoffice/Data/certs
          cp onlyoffice.key /var/www/onlyoffice/Data/certs/
          cp onlyoffice.crt /var/www/onlyoffice/Data/certs/
          chmod 400 /var/www/onlyoffice/Data/certs/onlyoffice.key
          /app/ds/run-document-server.sh"
          timeout 150 bash -c 'until curl -kfsSL https://localhost:443/hosting/discovery > /dev/null; do sleep 5; done'
          echo "onlyoffice ready."

      - name: Run e2e-${{ matrix.suite }}
        run: E2E_ARGS="${{ matrix.args }}" python3 tests/acceptance/run-e2e.py
        env:
          TIKA_NEEDED: ${{ matrix.tika == true && 'true' || 'false' }}
          KEYCLOAK_NEEDED: ${{ matrix.keycloak == true && 'true' || 'false' }}
          MFA_NEEDED: ${{ matrix.mfa == true && 'true' || 'false' }}
          OIDC_NEEDED: ${{ matrix.oidc == true && 'true' || 'false' }}
          OIDC_IFRAME_NEEDED: ${{ matrix.oidc_iframe == true && 'true' || 'false' }}
          COLLABORATION_NEEDED: ${{ matrix.collaboration == true && 'true' || 'false' }}
          FEDERATED_NEEDED: ${{ matrix.federated == true && 'true' || 'false' }}

      - name: Upload tracing result
        if: failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: playwright-traces-${{ matrix.suite }}-${{ github.run_attempt }}
          path: web/reports/e2e
          retention-days: 7

      - name: Upload a11y result
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: playwright-a11y-result-${{ matrix.suite }}-${{ github.run_attempt }}
          path: web/reports/e2e/a11y-report.json
          retention-days: 7

  litmus:
    name: litmus
    needs: [build-and-test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install libvips runtime
        run: |
          sudo apt-get update -qq
          # NEEDRESTART_MODE=a: auto-restart services silently; without this, needrestart can fail with exit code 6
          sudo NEEDRESTART_MODE=a apt-get install -y libvips42t64

      - name: Download build artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ocis-build-artifacts

      - name: Restore binary permissions
        run: chmod +x ocis/bin/ocis

      - name: Run litmus
        run: python3 tests/acceptance/run-litmus.py

  cs3api:
    name: cs3api
    needs: [build-and-test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install libvips runtime
        run: |
          sudo apt-get update -qq
          # NEEDRESTART_MODE=a: auto-restart services silently; without this, needrestart can fail with exit code 6
          sudo NEEDRESTART_MODE=a apt-get install -y libvips42t64

      - name: Download build artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ocis-build-artifacts

      - name: Restore binary permissions
        run: chmod +x ocis/bin/ocis

      - name: Run cs3api validator
        run: python3 tests/acceptance/run-cs3api.py

  wopi-builtin:
    name: wopi-builtin
    needs: [build-and-test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install libvips runtime
        run: |
          sudo apt-get update -qq
          # NEEDRESTART_MODE=a: auto-restart services silently; without this, needrestart can fail with exit code 6
          sudo NEEDRESTART_MODE=a apt-get install -y libvips42t64

      - name: Download build artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ocis-build-artifacts

      - name: Restore binary permissions
        run: chmod +x ocis/bin/ocis

      - name: Run WOPI validator (builtin)
        run: python3 tests/acceptance/run-wopi.py --type builtin

  wopi-cs3:
    name: wopi-cs3
    needs: [build-and-test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install libvips runtime
        run: |
          sudo apt-get update -qq
          # NEEDRESTART_MODE=a: auto-restart services silently; without this, needrestart can fail with exit code 6
          sudo NEEDRESTART_MODE=a apt-get install -y libvips42t64

      - name: Download build artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ocis-build-artifacts

      - name: Restore binary permissions
        run: chmod +x ocis/bin/ocis

      - name: Run WOPI validator (cs3)
        run: python3 tests/acceptance/run-wopi.py --type cs3

  external-ldap-tests:
    name: external-ldap-smoke
    needs: [build-and-test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: go.mod
          cache: true

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "24"

      - name: Enable pnpm
        run: corepack enable && corepack prepare pnpm@10.28.1 --activate

      # web/idp assets must be embedded for `ocis server` to come up (same as run-github.py)
      - name: Generate assets
        run: make ci-node-generate

      - name: Build oCIS
        run: make -C ocis build

      # Boots an external osixia LDAP + oCIS (embedded idm excluded) and runs the
      # smoke scope against the graph API — exercises the external-directory
      # read-after-write / retry path (OCISDEV-1030/1032/1033) that the embedded-idm
      # acceptance jobs never hit.
      - name: Run external-LDAP smoke
        run: tests/ldap-smoke/run.sh

  external-ldap-distributed-tests:
    name: external-ldap-distributed-smoke
    needs: [build-and-test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: go.mod
          cache: true

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "24"

      - name: Enable pnpm
        run: corepack enable && corepack prepare pnpm@10.28.1 --activate

      # web/idp assets must be embedded for `ocis server` to come up (same as run-github.py)
      - name: Generate assets
        run: make ci-node-generate

      - name: Build oCIS
        run: make -C ocis build

      # Distributed LDAP topology (proxy over an async syncrepl replica + write master);
      # the replication lag exercises the retry / read-after-write path (OCISDEV-1030/1032/1033).
      - name: Run external-LDAP distributed smoke
        run: tests/ldap-smoke-distributed/run.sh

  all-acceptance-tests:
    needs: [detect-changes, local-api-tests, cli-tests, ldap-pool-tests, core-api-tests, litmus, cs3api, wopi-builtin, wopi-cs3, e2e-tests, external-ldap-tests, external-ldap-distributed-tests]
    runs-on: ubuntu-latest
    if: always()
    steps:
      - name: Check all jobs passed
        run: |
          # If docs-only, all test jobs are expected to be skipped — that's a pass
          if [[ "${{ needs.detect-changes.outputs.docs-only }}" == "true" ]]; then
            echo "Docs-only change — skipping tests is expected."
            exit 0
          fi
          if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
            exit 1
          fi