test-suite-web-desktop-e2e-pr.yml

name: "[Test] PR Suite Web & Desktop e2e tests"
# Executed as part of PR checks
# Builds the desktop app and deploys the web app to dev.suite.sldev.cz/suite-web/<branch-name>/web
# Runs full e2e test suite for Suite Desktop and Suite Web

permissions:
  id-token: write # for fetching the OIDC token
  contents: read # for actions/checkout
  pull-requests: write # for posting comments

on:
  pull_request:
    branches:
      - develop
    paths-ignore:
      - "suite-native/**"
      - "packages/react-native-usb/**"
      # ignore unrelated github workflows config files
      - ".github/workflows/connect*"
      - ".github/workflows/suite-native*"
      - ".github/workflows/build-desktop*"
      - ".github/workflows/release*"
      - ".github/actions/release*/**"
      - "**.md"

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

env:
  DEV_SERVER_URL: "https://dev.suite.sldev.cz"
  STAGING_SUITE_SERVER_URL: "https://staging-suite.trezor.io"

jobs:
  determine-strategy:
    name: Determine test strategy
    if: github.repository == 'trezor/trezor-suite'
    runs-on: ubuntu-latest
    outputs:
      strategy: ${{ steps.determine.outputs.strategy }}
      spec-list: ${{ steps.determine.outputs.spec-list }}
    steps:
      - name: Checkout PR head
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
      - name: Determine test strategy
        id: determine
        uses: ./.github/actions/determine-test-strategy

  # ── Desktop ────────────────────────────────────────────────────────────────

  build-app:
    needs:
      - determine-strategy
    if: github.repository == 'trezor/trezor-suite'
    uses: ./.github/workflows/build-suite-desktop-e2e.yml

  post-currents-pr-info-desktop:
    if: github.repository == 'trezor/trezor-suite' && github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    concurrency:
      group: post-currents-pr-info-desktop-${{ github.event.pull_request.number }}
      cancel-in-progress: false
    needs:
      - build-app
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
      - name: Install Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version-file: ".nvmrc"
      - name: Generate GitHub App token
        id: trezor-bot-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          client-id: ${{ secrets.TREZOR_BOT_APP_ID }}
          private-key: ${{ secrets.TREZOR_BOT_PRIVATE_KEY }}
      - name: Post Currents link
        uses: ./.github/actions/post-currents-link
        with:
          github_token: ${{ steps.trezor-bot-token.outputs.token }}
          project: "desktop"
          currents-project-id: "4ytF0E"
      - name: Post quarantine list
        uses: ./.github/actions/post-quarantine-list
        with:
          github_token: ${{ steps.trezor-bot-token.outputs.token }}
          currents_api_key: ${{ secrets.CURRENTS_API_KEY }}
          project_name: "desktop"

  run-e2e-suite-desktop-tests:
    if: |
      always() &&
      github.repository == 'trezor/trezor-suite' &&
      needs.build-app.result == 'success' &&
      needs.resolve-spec-list.result == 'success'
    needs:
      - build-app
      - resolve-spec-list
    strategy:
      fail-fast: false
      matrix:
        TEST_GROUP: ${{ fromJSON(needs.resolve-spec-list.outputs.matrix-desktop) }}
    uses: ./.github/workflows/template-suite-run-e2e.yml
    with:
      target: "desktop"
      pw-config: ${{ needs.resolve-spec-list.outputs.spec-list != '' && './playwright-config/playwright-desktop-pr-all.config.ts' || './playwright-config/playwright-desktop-pr.config.ts' }}
      test-group: ${{ matrix.TEST_GROUP }}
      fail-fast: "7"
      currents-project-id: "4ytF0E"
      download-artifact-name: "desktop-app-build-e2e"
      spec-list: ${{ needs.resolve-spec-list.outputs.spec-list }}
    secrets:
      currents-record-key: ${{ secrets.CURRENTS_RECORD_KEY }}
      e2e-passphrase: ${{ secrets.E2E_TEST_PASSPHRASE }}
      e2e-passphrase-live: ${{ secrets.E2E_TEST_PASSPHRASE_LIVE }}

  # ── Web ────────────────────────────────────────────────────────────────────

  build-web:
    if: github.repository == 'trezor/trezor-suite'
    uses: ./.github/workflows/build-suite-web-e2e.yml

  extract-branch:
    if: github.repository == 'trezor/trezor-suite'
    runs-on: ubuntu-latest
    outputs:
      branch: ${{ steps.extract_branch.outputs.branch }}
    steps:
      - name: Extract branch name
        id: extract_branch
        run: |
          BRANCH_NAME="${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}"
          echo "branch=$BRANCH_NAME" >> $GITHUB_OUTPUT

  build-connect:
    needs: [extract-branch]
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          ref: ${{ needs.extract-branch.outputs.branch }}

      - name: Release connect to dev environment
        uses: ./.github/actions/release-connect
        with:
          awsRoleToAssume: "arn:aws:iam::538326561891:role/gh_actions_trezor_suite_dev_deploy"
          awsRegion: "eu-central-1"
          serverHostname: "dev.suite.sldev.cz"
          serverPath: "connect/${{ needs.extract-branch.outputs.branch }}"
          uploadArtifacts: "true"
          buildArtifacts: "true"
          nodeEnv: "development"
          connectPopupUrl: "https://dev.suite.sldev.cz/suite-web/${{ needs.extract-branch.outputs.branch }}/web/connect-popup"
          suiteWebUrl: "https://dev.suite.sldev.cz/suite-web/${{ needs.extract-branch.outputs.branch }}/web"

  run-llm-analysis:
    name: LLM test analysis
    needs:
      - determine-strategy
    if: github.repository == 'trezor/trezor-suite' && needs.determine-strategy.outputs.strategy == 'analyze'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      spec-list: ${{ steps.llm-select.outputs.spec-list }}
    steps:
      # SECURITY: check out the trusted develop branch so that only reviewed code
      # runs with secrets. The PR head is fetched separately purely for computing
      # the diff; its code is never installed or executed.
      - name: Checkout repository (trusted develop ref)
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          ref: develop
          fetch-depth: 0
      - name: Fetch PR head for diff
        run: git fetch origin pull/${{ github.event.pull_request.number }}/head:pr-head
      - name: Check PR size
        id: check-size
        uses: ./.github/actions/check-pr-size
        with:
          additions: ${{ github.event.pull_request.additions }}
          deletions: ${{ github.event.pull_request.deletions }}
      - name: Run LLM test selector
        id: llm-select
        if: steps.check-size.outputs.is_small_pr == 'true'
        uses: ./.github/actions/llm-test-selector
        with:
          openrouter-api-key: ${{ secrets.E2E_SELECTOR_API_KEY }}
      - name: Post LLM analysis to PR description
        if: steps.check-size.outputs.is_small_pr == 'true'
        uses: ./.github/actions/post-llm-analysis
        with:
          trezor-bot-app-id: ${{ secrets.TREZOR_BOT_APP_ID }}
          trezor-bot-private-key: ${{ secrets.TREZOR_BOT_PRIVATE_KEY }}

  resolve-spec-list:
    name: Resolve spec list
    needs:
      - determine-strategy
      - run-llm-analysis
    if: always() && github.repository == 'trezor/trezor-suite'
    runs-on: ubuntu-latest
    outputs:
      spec-list: ${{ steps.resolve.outputs.spec-list }}
      matrix-desktop: ${{ steps.matrix.outputs.matrix-desktop }}
      matrix-web: ${{ steps.matrix.outputs.matrix-web }}
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
      - name: Resolve final spec list
        id: resolve
        shell: bash
        run: |
          STRATEGY="${{ needs.determine-strategy.outputs.strategy }}"
          DIRECT_SPEC="${{ needs.determine-strategy.outputs.spec-list }}"
          LLM_SPEC="${{ needs.run-llm-analysis.outputs.spec-list }}"

          if [[ "$STRATEGY" == "specific-tests" ]]; then
            echo "Using direct spec list from strategy determination: $DIRECT_SPEC"
            echo "spec-list=$DIRECT_SPEC" >> "$GITHUB_OUTPUT"
          elif [[ "$STRATEGY" == "analyze" ]] && [[ -n "$LLM_SPEC" ]]; then
            echo "Using LLM-recommended spec list: $LLM_SPEC"
            echo "spec-list=$LLM_SPEC" >> "$GITHUB_OUTPUT"
          else
            echo "Running all tests (strategy=$STRATEGY, LLM spec empty or PR too large)."
            echo "spec-list=" >> "$GITHUB_OUTPUT"
          fi
      - name: Resolve test matrix
        id: matrix
        uses: ./.github/actions/resolve-test-matrix
        with:
          spec-list: ${{ steps.resolve.outputs.spec-list }}
          max-desktop: "7"
          max-web: "5"

  post-suite-web-preview-link:
    if: github.repository == 'trezor/trezor-suite' && github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    concurrency:
      group: post-suite-web-preview-link-${{ github.event.pull_request.number }}
      cancel-in-progress: false
    needs:
      - build-web
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
      - name: Generate GitHub App token
        id: trezor-bot-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          client-id: ${{ secrets.TREZOR_BOT_APP_ID }}
          private-key: ${{ secrets.TREZOR_BOT_PRIVATE_KEY }}
      - name: Post Suite Web preview link
        uses: ./.github/actions/post-suite-web-preview-link
        with:
          github_token: ${{ steps.trezor-bot-token.outputs.token }}
          dev-server-url: ${{ env.DEV_SERVER_URL }}

  post-currents-pr-info-web:
    if: github.repository == 'trezor/trezor-suite' && github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    concurrency:
      group: post-currents-pr-info-web-${{ github.event.pull_request.number }}
      cancel-in-progress: false
    needs:
      - build-web
      - build-connect
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
      - name: Install Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version-file: ".nvmrc"
      - name: Generate GitHub App token
        id: trezor-bot-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          client-id: ${{ secrets.TREZOR_BOT_APP_ID }}
          private-key: ${{ secrets.TREZOR_BOT_PRIVATE_KEY }}
      - name: Post Currents link
        uses: ./.github/actions/post-currents-link
        with:
          github_token: ${{ steps.trezor-bot-token.outputs.token }}
          project: "web"
          currents-project-id: "Og0NOQ"
      - name: Post quarantine list
        uses: ./.github/actions/post-quarantine-list
        with:
          github_token: ${{ steps.trezor-bot-token.outputs.token }}
          currents_api_key: ${{ secrets.CURRENTS_API_KEY }}
          project_name: "web"

  run-e2e-suite-web-tests:
    if: |
      always() &&
      github.repository == 'trezor/trezor-suite' &&
      needs.build-web.result == 'success' &&
      needs.build-connect.result == 'success' &&
      needs.resolve-spec-list.result == 'success'
    needs:
      - build-web
      - build-connect
      - resolve-spec-list
    strategy:
      fail-fast: false
      matrix:
        TEST_GROUP: ${{ fromJSON(needs.resolve-spec-list.outputs.matrix-web) }}
    uses: ./.github/workflows/template-suite-run-e2e.yml
    with:
      target: "web"
      pw-config: ${{ needs.resolve-spec-list.outputs.spec-list != '' && './playwright-config/playwright-web-pr-all.config.ts' || './playwright-config/playwright-web-pr.config.ts' }}
      test-group: ${{ matrix.TEST_GROUP }}
      fail-fast: "7"
      currents-project-id: "Og0NOQ"
      download-artifact-name: "connect-explorer-webextension-dev.suite.sldev.cz"
      spec-list: ${{ needs.resolve-spec-list.outputs.spec-list }}
    secrets:
      currents-record-key: ${{ secrets.CURRENTS_RECORD_KEY }}
      e2e-passphrase: ${{ secrets.E2E_TEST_PASSPHRASE }}
      e2e-passphrase-live: ${{ secrets.E2E_TEST_PASSPHRASE_LIVE }}