unit-tests-webapp.yml

name: "🧪 Unit Tests: Webapp"

permissions:
  contents: read

on:
  workflow_call:
    secrets:
      DOCKERHUB_USERNAME:
        required: false
      DOCKERHUB_TOKEN:
        required: false

jobs:
  unitTests:
    name: "🧪 Unit Tests: Webapp"
    runs-on: ubuntu-latest
    strategy:
      # one flaky shard shouldn't cancel its siblings - lets us re-run only the failed shard
      fail-fast: false
      matrix:
        shardIndex: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
        shardTotal: [10]
    env:
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      SHARD_INDEX: ${{ matrix.shardIndex }}
      SHARD_TOTAL: ${{ matrix.shardTotal }}
    steps:
      - name: 🔧 Disable IPv6
        run: |
          sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
          sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
          sudo sysctl -w net.ipv6.conf.lo.disable_ipv6=1

      - name: 🔧 Configure docker address pool
        run: |
          CONFIG='{
            "default-address-pools" : [
              {
                "base" : "172.17.0.0/12",
                "size" : 20
              },
              {
                "base" : "192.168.0.0/16",
                "size" : 24
              }
            ]
          }'
          mkdir -p /etc/docker
          echo "$CONFIG" | sudo tee /etc/docker/daemon.json

      - name: 🔧 Restart docker daemon
        run: sudo systemctl restart docker

      - name: ⬇️ Checkout repo
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
        with:
          version: 10.33.2

      - name: ⎔ Setup node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 20.20.2
          cache: "pnpm"

      # ..to avoid rate limits when pulling images
      - name: 🐳 Login to DockerHub
        if: ${{ env.DOCKERHUB_USERNAME }}
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: 🐳 Skipping DockerHub login (no secrets available)
        if: ${{ !env.DOCKERHUB_USERNAME }}
        run: echo "DockerHub login skipped because secrets are not available."

      - name: 🐳 Pre-pull testcontainer images
        if: ${{ env.DOCKERHUB_USERNAME }}
        run: |
          # Retry each pull - DockerHub registry timeouts are a recurring transient CI flake.
          pull() {
            for attempt in 1 2 3; do
              docker pull "$1" && return 0
              echo "::warning::docker pull $1 failed (attempt ${attempt}/3); retrying in 10s"
              sleep 10
            done
            echo "::error::docker pull $1 failed after 3 attempts"
            return 1
          }
          echo "Pre-pulling Docker images with authenticated session..."
          pull postgres:14
          pull clickhouse/clickhouse-server:25.4-alpine
          pull redis:7.2
          pull testcontainers/ryuk:0.14.0
          pull electricsql/electric:1.2.4
          pull minio/minio:latest
          echo "Image pre-pull complete"

      - name: 📥 Download deps
        run: pnpm install --frozen-lockfile

      - name: 📀 Generate Prisma Client
        run: pnpm run generate

      - name: 🧪 Run Webapp Unit Tests
        run: pnpm run test:webapp --reporter=default --reporter=blob --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }} --passWithNoTests
        env:
          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
          DIRECT_URL: postgresql://postgres:postgres@localhost:5432/postgres
          SESSION_SECRET: "secret"
          MAGIC_LINK_SECRET: "secret"
          ENCRYPTION_KEY: "dummy-encryption-keeeey-32-bytes"
          DEPLOY_REGISTRY_HOST: "docker.io"
          CLICKHOUSE_URL: "http://default:password@localhost:8123"

      - name: Gather all reports
        if: ${{ !cancelled() }}
        run: |
          mkdir -p .vitest-reports
          find . -type f -path '*/.vitest-reports/blob-*.json' \
            -exec bash -c 'src="$1"; basename=$(basename "$src"); pkg=$(dirname "$src" | sed "s|^\./||;s|/\.vitest-reports$||;s|/|_|g"); cp "$src" ".vitest-reports/${pkg}-${basename}"' _ {} \;

      - name: Upload blob reports to GitHub Actions Artifacts
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: webapp-blob-report-${{ matrix.shardIndex }}
          path: .vitest-reports/*
          include-hidden-files: true
          retention-days: 1

  merge-reports:
    name: "📊 Merge Reports"
    if: ${{ !cancelled() }}
    needs: [unitTests]
    runs-on: ubuntu-latest
    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
        with:
          version: 10.33.2

      - name: ⎔ Setup node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 20.20.2
          # no cache enabled, we're not installing deps

      - name: Download blob reports from GitHub Actions Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: .vitest-reports
          pattern: webapp-blob-report-*
          merge-multiple: true

      - name: Merge reports
        run: pnpm dlx vitest@4.1.7 run --merge-reports --pass-with-no-tests