test.yml

name: Test

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Minimal-by-default GITHUB_TOKEN scope. The test workflow only reads
# the checked-out tree — it doesn't open issues, push commits, or
# publish artifacts. Explicit `contents: read` defuses CodeQL's
# `actions/missing-workflow-permissions` rule and means anything
# added later has to opt in to extra scopes deliberately.
permissions:
  contents: read

# Cancel older test runs on the same ref when a newer commit lands.
# Per-ref grouping means PRs cancel each other independently, and
# rapid pushes to main only keep the latest run. Keyed on `head_ref`
# for PRs (so re-pushes cancel the previous test) and on `ref` for
# branch pushes. Saves substantial runner time during active iteration.
concurrency:
  group: test-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version: "22"
          cache: npm

      # Shared install + fetch + parse prefix with three caches
      # (node_modules, vendor/, build/). See
      # .github/actions/build-spec-data/action.yml for the cache-key
      # strategy and per-step gating.
      - uses: ./.github/actions/build-spec-data

      - name: Verify npm registry signatures (root)
        # Verifies every package in package-lock.json against npm's
        # registry-side signatures. Catches registry tampering, mirror
        # compromise, and unsigned packages slipping into the tree.
        # Works off the lockfile + registry API — installation is not
        # required, but we run after build-spec-data so the cache is
        # already warm if anything later wants node_modules.
        run: npm audit signatures

      - name: Type-check
        run: npm run typecheck

      - name: Run tests
        run: npm test

      - name: Build dist
        run: npm run build

      # Worker has its own node_modules under worker/. Cache it
      # separately so a root-only lockfile change doesn't invalidate
      # the worker install (and vice versa).
      - name: Cache worker/node_modules
        id: cache-worker-node-modules
        uses: actions/cache@v6
        with:
          path: worker/node_modules
          key: worker-nm-v1-${{ runner.os }}-node22-${{ hashFiles('worker/package-lock.json') }}

      - name: Install worker dependencies
        if: steps.cache-worker-node-modules.outputs.cache-hit != 'true'
        working-directory: worker
        run: npm install

      - name: Verify npm registry signatures (worker)
        # Same registry-signature check as the root tree, against
        # worker/package-lock.json. Run as its own step so a worker-only
        # dep change can be triaged without re-reading the root output.
        working-directory: worker
        run: npm audit signatures

      - name: Worker type-check
        working-directory: worker
        run: npm run typecheck

      - name: Worker tests
        working-directory: worker
        run: npm test

      - name: Smoke-test bin entry (local dist)
        run: |
          echo '' | timeout 2 node dist/mcp/server.js >/dev/null 2>&1 || [ $? -eq 124 ]

      # npm pack also writes the tarball — `--dry-run` afterward
      # would just re-do the work without producing anything new, so
      # we drop it.
      - name: npm pack
        run: npm pack

      - name: E2E smoke (install + MCP roundtrip)
        # Installs the tarball into a scratch dir, spawns the bin,
        # speaks MCP, verifies initialize / tools/list / spec.about /
        # clause.get. Catches packaging breakage that unit tests can't.
        run: node scripts/smoke-stdio.mjs ./tc39-mcp-*.tgz