pull-request.yml

name: Pull Request CI
run-name: ${{ github.actor }} is running Pull Request CI

on:
  pull_request_target:
    types: [opened, labeled, reopened]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  rid: ${{ github.run_id }}-${{ github.run_number }}
  PW_SANDBOX_PASSWORD: ${{ secrets.PW_SANDBOX_PASSWORD }}
  PW_SENDER_EMAIL_PASSWORD: ${{ secrets.PW_SENDER_EMAIL_PASSWORD }}
  PW_SANDBOX: ${{ secrets.PW_SANDBOX }}
  PW_ENTRY_POINT1: ${{ secrets.PW_ENTRY_POINT1 }}
  PW_ENTRY_POINT2: ${{ secrets.PW_ENTRY_POINT2 }}
  PW_ENTRY_POINT3: ${{ secrets.PW_ENTRY_POINT3 }}
  PW_ENTRY_POINT4: ${{ secrets.PW_ENTRY_POINT4 }}
  PW_ENTRY_POINT5: ${{ secrets.PW_ENTRY_POINT5 }}
  PW_ENTRY_POINT6: ${{ secrets.PW_ENTRY_POINT6 }}
  PW_ENTRY_POINT7: ${{ secrets.PW_ENTRY_POINT7 }}
  PW_ENTRY_POINT8: ${{ secrets.PW_ENTRY_POINT8 }}
  PW_ENTRY_POINT9: ${{ secrets.PW_ENTRY_POINT9 }}
  PW_ENTRY_POINT10: ${{ secrets.PW_ENTRY_POINT10 }}
  PW_ENTRY_POINT11: ${{ secrets.PW_ENTRY_POINT11 }}
  PW_ENTRY_POINT12: ${{ secrets.PW_ENTRY_POINT12 }}
  PW_SENDER_EMAIL: ${{ secrets.PW_SENDER_EMAIL }}
  PW_CHAT_URL: ${{ secrets.PW_CHAT_URL }}
  PW_DIAL_NUMBER_LOGIN_USERNAME: ${{ secrets.PW_DIAL_NUMBER_LOGIN_USERNAME }}
  PW_DIAL_NUMBER_LOGIN_PASSWORD: ${{ secrets.PW_DIAL_NUMBER_LOGIN_PASSWORD }}
  PW_DIAL_NUMBER: ${{ secrets.PW_DIAL_NUMBER }}
  PW_DIAL_NUMBER_NAME: ${{ secrets.PW_DIAL_NUMBER_NAME }}
  PW_ENTRYPOINT_NAME: ${{ secrets.PW_ENTRYPOINT_NAME }}
  PW_MEETING_USERID: ${{ secrets.PW_MEETING_USERID }}
  PW_MEETING_PASSWORD: ${{ secrets.PW_MEETING_PASSWORD }}
  PW_MEETING_DESTINATION: ${{ secrets.PW_MEETING_DESTINATION}}

jobs:
  validate:
    name: Validate Pull Request
    runs-on: ubuntu-latest

    steps:
      - name: Validate Labels
        run: |
          HEAD_REPO=${{ github.event.pull_request.head.repo.full_name }}
          BASE_REPO=${{ github.event.pull_request.base.repo.full_name }}
          FROM_BASE=0; [ "$HEAD_REPO" == "$BASE_REPO" ] && FROM_BASE=1

          HAS_VALIDATED_LABEL=${{ contains(github.event.pull_request.labels.*.name, 'validated') }}
          VALIDATED=0; [ "$HAS_VALIDATED_LABEL" == "true" ] && VALIDATED=1

          echo from base $FROM_BASE
          echo validated $VALIDATED

          if [[ $FROM_BASE == 1 || $VALIDATED == 1 ]]
          then
            echo 'pull request is validated, running tests'
            exit 0
          else
            echo 'pull request is not validated, exiting'
            exit 1
          fi

      - name: Validate PR title safely
        uses: actions/github-script@v8
        with:
          script: |
            const title = (context.payload.pull_request?.title ?? "").normalize("NFC");

            // 1) Required
            if (!title.length) {
              core.setFailed("PR title is empty.");
              return;
            }

            // 2) Length guard
            if (title.length > 200) {
              core.setFailed("PR title is too long (max 200 chars).");
              return;
            }

            // 3) Hardened control-char guard (all Unicode control/invisible chars)
            if (/[\p{C}]/u.test(title)) {
              core.setFailed("PR title contains disallowed control/invisible characters.");
              return;
            }

            // 4) Enforce convention (scope is optional)
            const regex = /^(fix|feat|chore|docs)(\([^()\s][^()]{0,78}[^()\s]?\))?: [^\s].*$/u;
            if (!regex.test(title)) {
              core.setFailed("PR title must follow: fix|feat|chore|docs(scope): description OR fix|feat|chore|docs: description");
              return;
            }

            core.info(`PR title is valid: "${title}"`);

  linter:
    runs-on: ubuntu-latest
    needs: validate
    steps:
      - name: Checkout Project
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          registry-url: 'https://registry.npmjs.org'
          cache: 'yarn'

      - name: Restore Dependencies
        uses: actions/cache/restore@v5
        with:
          path: '**/node_modules'
          key: node-modules-${{ hashFiles('./yarn.lock') }}

      - name: Install Dependencies
        run: yarn

      - name: Test linting in meetings widget
        run: yarn workspace @webex/widgets run test:eslint

      - name: Test linting in cc widgets
        run: yarn run test:styles

  e2e_test_meetings:
    timeout-minutes: 10
    runs-on: ubuntu-latest
    continue-on-error: true
    needs: validate
    if: contains(toJson(github.event.pull_request.labels), 'run_e2e')
    concurrency:
      group: e2e-meetings
      cancel-in-progress: false

    steps:
      - name: Checkout Project
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          registry-url: 'https://registry.npmjs.org'
          cache: 'yarn'

      - name: Restore Dependencies
        uses: actions/cache/restore@v5
        with:
          path: '**/node_modules'
          key: node-modules-${{ hashFiles('./yarn.lock') }}

      - name: Install Dependencies
        run: yarn

      - name: Build meetings widget
        run: yarn workspace @webex/widgets run build:src

      - name: Build cc widgets
        run: yarn run build

      - name: Install Playwright Browsers
        run: npx playwright install --with-deps

      - name: Test E2E
        run: yarn run test:e2e:meetings

      - uses: actions/upload-artifact@v7
        if: ${{ !cancelled() }}
        with:
          name: meetings-report
          path: |
            **/playwright-report/**
            **/test-results/**
          retention-days: 10

  e2e_test_cc_widgets:
    timeout-minutes: 50
    runs-on: ubuntu-latest
    needs: validate
    if: contains(toJson(github.event.pull_request.labels), 'run_e2e')
    concurrency:
      group: e2e-cc-widgets
      cancel-in-progress: false

    steps:
      - name: Checkout Project
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          registry-url: 'https://registry.npmjs.org'
          cache: 'yarn'

      - name: Restore Dependencies
        uses: actions/cache/restore@v5
        with:
          path: '**/node_modules'
          key: node-modules-${{ hashFiles('./yarn.lock') }}

      - name: Install Dependencies
        run: yarn

      - name: Build meetings widget
        run: yarn workspace @webex/widgets run build:src

      - name: Build cc widgets
        run: yarn run build

      - name: Install Playwright Browsers
        run: npx playwright install --with-deps

      - name: Write Environment Variables
        run: |
          touch ./.env
            echo "PLAYWRIGHT_USERNAME=\"${{ secrets.PLAYWRIGHT_USERNAME }}\"" >> ./.env
            echo "PLAYWRIGHT_PASSWORD=\"${{ secrets.PLAYWRIGHT_PASSWORD }}\"" >> ./.env

      - name: Run Playwright tests
        run: yarn run test:e2e:cc

      - uses: actions/upload-artifact@v7
        if: ${{ !cancelled() }}
        with:
          name: playwright-report
          path: |
            **/playwright-report/**
            **/test-results/**
          retention-days: 10

  unit_tests:
    runs-on: ubuntu-latest
    needs: validate
    steps:
      - name: Checkout Project
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          registry-url: 'https://registry.npmjs.org'
          cache: 'yarn'

      - name: Restore Dependencies
        uses: actions/cache/restore@v5
        with:
          path: '**/node_modules'
          key: node-modules-${{ hashFiles('./yarn.lock') }}

      - name: Install Dependencies
        run: yarn

      - name: Build meetings widget
        run: yarn workspace @webex/widgets run build:src

      - name: Build cc widgets
        run: yarn run build

      - name: Test Tooling
        run: yarn run test:tooling

      - name: Test CC Widgets
        run: yarn run test:cc-widgets

      - name: Test Meetings Widget
        run: yarn run test:meetings-widget