test-services.yaml

name: Services CCV Tests

on:
  merge_group:
  pull_request:
  push:
    branches:
      - main

defaults:
  run:
    working-directory: build/devenv

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  services-tests:
    permissions:
      id-token: write
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          # Full history so the change-detection step can diff against the PR base.
          fetch-depth: 0

      # This job intentionally has no `paths:` filter so it runs (and reports a status) on every
      # PR — a required check with a paths filter deadlocks PRs that don't touch the filtered
      # paths. Only the expensive steps below are gated on relevant service source changing.
      - name: Detect service changes
        id: changes
        shell: bash
        working-directory: .
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          set -euo pipefail
          # merge_group (the merge-queue gate) and push to main always run the full suite.
          if [[ "$EVENT_NAME" != "pull_request" ]]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          if git diff --name-only "${BASE_SHA}...HEAD" | grep -qE '^(build/devenv/|aggregator/|executor/|verifier/|indexer/|pricer/|protocol/|common/|pkg/|\.github/workflows/test-services\.yaml)'; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
          else
            echo "changed=false" >> "$GITHUB_OUTPUT"
            echo "No relevant service source changes; skipping services tests."
          fi

      - name: Setup GitHub Token
        if: steps.changes.outputs.changed == 'true'
        id: setup-github-token
        uses: smartcontractkit/.github/actions/setup-github-token@ef78fa97bf3c77de6563db1175422703e9e6674f # setup-github-token@0.2.1
        with:
          aws-role-arn: ${{ secrets.GATI_AWS_ROLE_ARN_CHAINLINK_READ_ONLY }}
          aws-lambda-url: ${{ secrets.GATI_LAMBDA_URL_RELENG }}
          aws-region: ${{ secrets.GATI_AWS_REGION }}
          set-git-config: true

      - name: Set up Docker Buildx
        if: steps.changes.outputs.changed == 'true'
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Install Just
        if: steps.changes.outputs.changed == 'true'
        uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
        with:
          just-version: '1.40.0'

      - name: Authenticate to AWS ECR
        if: steps.changes.outputs.changed == 'true'
        uses: ./.github/actions/aws-ecr-auth
        with:
          role-to-assume: ${{ secrets.CCV_IAM_ROLE }}
          aws-region: us-east-1
          registry-type: public

      - name: Set up Go
        if: steps.changes.outputs.changed == 'true'
        uses: actions/setup-go@v6 # v6
        env:
          GOPRIVATE: github.com/smartcontractkit/*
        with:
          cache: true
          go-version-file: build/devenv/go.mod
          cache-dependency-path: build/devenv/go.sum

      - name: Download Go dependencies
        if: steps.changes.outputs.changed == 'true'
        run: |
          go mod download

      - name: Build Docker Images
        if: steps.changes.outputs.changed == 'true'
        run: just build-docker-ci
        env:
          DOCKER_BUILDKIT: 1

      - name: Test Services
        if: steps.changes.outputs.changed == 'true'
        working-directory: build/devenv/tests/services
        run: |
          go test -v -run TestService