wc-acceptance-test.yml

---
name: Acceptance Test

on:
  workflow_call:
    inputs:
      image-basename:
        required: true
        type: string
      devcontainer-file:
        required: true
        type: string
      acceptance-test-path:
        required: true
        type: string
    secrets:
      TEST_GITHUB_TOKEN:
        required: true
      TEST_GITHUB_USER:
        required: true
      TEST_GITHUB_PASSWORD:
        required: true
      TEST_GITHUB_TOTP_SECRET:
        required: true

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  test:
    name: Acceptance Test
    runs-on: ubuntu-latest
    environment: acceptance-testing
    steps:
      - uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
        with:
          disable-sudo: false # Playwright requires root privileges to install browsers
          egress-policy: audit
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      # Create a GitHub Codespace and communicate the image version via a Codespace secret (should be a Codespace environment variable).
      # This secret is used by devcontainer.json, as such it is a resource that should not be used concurrently.
      - name: Start Codespace
        run: |
          set -Eeuo pipefail

          if [[ "${EVENT_NAME}" == "pull_request" ]]; then
            gh secret set -a codespaces IMAGE_VERSION --body "pr-${PR_NUMBER}"
          elif [[ "${EVENT_NAME}" == "push" && "${REF_STARTS_WITH_TAG}" == "true" ]]; then
            gh secret set -a codespaces IMAGE_VERSION --body "${GITHUB_REF#refs/tags/}"
          else
            gh secret set -a codespaces IMAGE_VERSION --body "edge"
          fi

          echo CODESPACE_NAME="$(gh codespace create -R "${GITHUB_REPOSITORY}" -b "${HEAD_REF}" -m basicLinux32gb --devcontainer-path "${DEVCONTAINER_FILE}" --idle-timeout 10m --retention-period 1h)" >> "$GITHUB_ENV"
        env:
          REF_STARTS_WITH_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
          DEVCONTAINER_FILE: ${{ inputs.devcontainer-file }}
          EVENT_NAME: ${{ github.event_name }}
          GH_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
          HEAD_REF: ${{ github.head_ref }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: 24.8.0
      - run: npm ci
      - run: npx playwright install --with-deps
      - name: Wait for Codespace to be active
        run: |
          set -Eeuo pipefail

          MAX_WAIT_SECONDS=$((3 * 60))
          SECONDS_ELAPSED=0

          while true; do
            STATE=$(gh codespace list --json name,state --jq ".[] | select(.name == \"${CODESPACE_NAME}\") | .state")
            echo "Current state: $STATE"
            if [ "$STATE" == "Available" ]; then
              echo "Codespace is active!"
              break
            fi
            if [ $SECONDS_ELAPSED -ge $MAX_WAIT_SECONDS ]; then
              echo "Timeout reached. Codespace is not active."
              exit 1
            fi
            sleep 5
            SECONDS_ELAPSED=$((SECONDS_ELAPSED + 5))
          done
        env:
          GH_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
      - run: cd "${ACCEPTANCE_TEST_PATH}" && npm test
        env:
          ACCEPTANCE_TEST_PATH: ${{ inputs.acceptance-test-path }}
          GITHUB_USER: ${{ secrets.TEST_GITHUB_USER }}
          GITHUB_PASSWORD: ${{ secrets.TEST_GITHUB_PASSWORD }}
          GITHUB_TOTP_SECRET: ${{ secrets.TEST_GITHUB_TOTP_SECRET }}
          PLAYWRIGHT_JUNIT_OUTPUT_NAME: ${{ github.workspace }}/test-report-acceptance-${{ inputs.image-basename }}.xml
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ !cancelled() }}
        with:
          name: test-results-acceptance-${{ inputs.image-basename }}
          path: |
            test-report-*.xml
            test-results/
          retention-days: 10
      - run: |
          set -Eeuo pipefail
          gh codespace delete --force --codespace "${CODESPACE_NAME}"
          gh secret set -a codespaces IMAGE_VERSION --body "latest"
        if: always()
        env:
          GH_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}