test.yml

name: test

on:
  pull_request:
    branches:
      - master
  push:
    branches:
      - master

# Cancel a currently running workflow from the same PR/branch/tag
# when a new workflow is triggered. A release commit (`chore: release ...`)
# gets a group of its own on push so it never cancels its parent's
# still-running checks: when it only bumps the version
# (.github/actions/version-only), its native jobs skip and publish.yml relies
# on the parent's native-required.
concurrency:
  group: "${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && startsWith(github.event.head_commit.message, 'chore: release ') && github.sha) || github.ref }}"
  cancel-in-progress: true

jobs:
  # The native jobs below only run when their inputs change. A job skipped by
  # its `if:` still reports success, so required checks and native-gate (which
  # looks at the workflow conclusion) are satisfied on unrelated changes.
  # package.json is a cpp input for its `files` list, but a version-only
  # release commit (.github/actions/version-only) leaves it as tested on the
  # parent, so cpp-test skips that one too; js-test always runs.
  changes:
    name: Detect changed native inputs
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
      pull-requests: read
      statuses: write  # native-inherited
    outputs:
      cpp: ${{ steps.filter.outputs.cpp == 'true' && steps.version-only.outputs.native == 'true' }}
      ios: ${{ steps.filter.outputs.ios }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 2
      - id: version-only
        uses: ./.github/actions/version-only
      - id: filter
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        with:
          filters: |
            cpp:
              - '.github/workflows/test.yml'
              - '.gitmodules'
              - 'cpp/**'
              - 'android/jni/**'
              # The release flag sets test-core-platform-flags.sh mirrors.
              - 'react-native-update.podspec'
              - 'harmony/pushy/src/main/cpp/CMakeLists.txt'
              - 'scripts/test-*'
              - 'scripts/lib/**'
              # package.json `files` lists the submodule sources that ship.
              - 'package.json'
              - 'scripts/check-packlist.js'
              # TS reference the C++ golden vectors are generated from.
              - 'src/updateFlowCore.ts'
              - 'scripts/generate-flow-vectors.ts'
            ios:
              - '.github/workflows/test.yml'
              - 'ios/**'
              - 'cpp/**'
              - 'scripts/test-ios-purge-restore.sh'
              - 'scripts/tests/ios-purge-restore/**'

  js-test:
    name: JS Unit Tests
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.4.0

      - name: Install Dependencies
        run: bun install --frozen-lockfile

      - name: Run Tests
        run: bun test src/__tests__

  cpp-test:
    name: C++ Unit Tests
    needs: changes
    if: needs.changes.outputs.cpp == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive

      # Before anything builds inside the submodules: the published package
      # lists the HDiffPatch / lzma sources and headers one by one, so a
      # header missing from package.json `files` would only surface in a
      # consumer's pod install. Packs the real tarball and compiles from it.
      - name: Packed native sources compile on their own
        run: node scripts/check-packlist.js --compile

      - name: Install build dependencies
        # clang (+ libFuzzer runtime) is for the bounded fuzz step below.
        run: sudo apt-get update && sudo apt-get install -y zlib1g-dev libbz2-dev clang

      - name: Build HDiffPatch library
        working-directory: android/jni/HDiffPatch
        run: make LZMA=0 DIR_DIFF=0

      - name: Build and run unit_test
        working-directory: android/jni/HDiffPatch
        run: |
          g++ -O2 test/unit_test.cpp libhdiffpatch.a \
            -D_IS_NEED_ALL_CompressPlugin=0 \
            -D_IS_NEED_DEFAULT_CompressPlugin=0 \
            -D_IS_NEED_DIR_DIFF_PATCH=0 \
            -lpthread \
            -o unit_test
          ./unit_test

      # Golden-vector parity between src/updateFlowCore.ts (reference) and
      # the cpp/update_flow_core port. The vectors themselves are kept in
      # sync with the TS side by src/__tests__/flowVectors.test.ts (js-test).
      - name: Replay flow golden vectors against the C++ port
        run: SANITIZE=1 ./scripts/test-update-flow-core.sh

      # patch_core consumes the untrusted bytes (archives, manifests, HBC
      # patches); it must run under ASan/UBSan on every change.
      - name: Run patch_core unit tests (sanitized)
        run: SANITIZE=1 ./scripts/test-patch-core.sh

      # The tests above build the cores one way; the shipped binaries build
      # them with three other flag sets (no RTTI on Android, C++20 on iOS).
      - name: Shared cores compile with every platform's release flags
        run: ./scripts/test-core-platform-flags.sh

      # Short bounded fuzz pass over the two untrusted-input parsers
      # (flow_json, hbc_transform_wire). Skips with a notice when clang or
      # libFuzzer is unavailable on the runner.
      - name: Fuzz parsers (bounded)
        run: |
          FUZZ=1 ./scripts/test-update-flow-core.sh
          FUZZ=1 ./scripts/test-patch-core.sh

  ios-purge-restore-test:
    name: Native purge-restore ordering
    needs: changes
    if: needs.changes.outputs.ios == 'true'
    runs-on: macos-latest
    timeout-minutes: 5

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      # Foundation-only executable: exercises the production tvOS Release
      # methods without RN, CocoaPods, a simulator, or real network delays.
      - name: Run deterministic native ordering tests and negative controls
        run: SANITIZE=1 VERIFY_REGRESSIONS=1 bash scripts/test-ios-purge-restore.sh