jojo/.forgejo/workflows/testing.yml

name: testing
enable-email-notifications: true

on:
  pull_request:
  push:
    branches:
      - 'forgejo*'
      - 'v*/forgejo*'
  workflow_dispatch:

jobs:
  backend-checks:
    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
    runs-on: docker
    container:
      image: 'data.forgejo.org/oci/node:24-trixie'
      options: --tmpfs /tmp:exec,noatime
    steps:
      - name: event info
        run: |
          cat <<'EOF'
          ${{ toJSON(github) }}
          EOF
      - uses: https://data.forgejo.org/actions/checkout@v6
      - uses: ./.forgejo/workflows-composite/setup-env
      # DO NOT add checks here, but rather in the makefile
      - run: su forgejo -c './tools/cimake.sh pr-go'
      # this will re-run the backend target also contained in pr-go, but
      # a re-build is insignificant
      - uses: ./.forgejo/workflows-composite/build-backend
  frontend-checks:
    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
    runs-on: docker
    container:
      image: 'data.forgejo.org/oci/node:24-trixie'
      options: --tmpfs /tmp:exec,noatime
    steps:
      - uses: https://data.forgejo.org/actions/checkout@v6

      - uses: https://data.forgejo.org/actions/setup-node@v6
        with:
          node-version-file: .node-version

      - run: make deps-frontend
      - run: make lint-frontend
      - run: make checks-frontend
      - name: make test-frontend-coverage
        run: |
          # Usage of `dayjs` can be impacted by local system timezone and can be sensitive to DST differences; since
          # frontend tests are very short they're run twice with varying DST rules to reduce regression risk.
          TZ=Europe/Berlin make test-frontend-coverage
          TZ=America/Edmonton make test-frontend-coverage
      - run: make frontend
      - name: Install zstd for cache saving
        # works around https://github.com/actions/cache/issues/1169, because the
        # consuming job has zstd and doesn't restore the cache otherwise
        run: |
          apt-get update -qq
          apt-get -q install -qq -y zstd
      - name: 'Cache frontend build for playwright testing'
        uses: https://data.forgejo.org/actions/cache/save@v5
        with:
          path: ${{github.workspace}}/public/assets
          key: frontend-build-${{ github.sha }}
  test-unit:
    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
    runs-on: docker
    needs: [backend-checks, frontend-checks]
    container:
      image: 'data.forgejo.org/oci/node:24-trixie'
      options: --tmpfs /tmp:exec,noatime
    services:
      elasticsearch:
        image: data.forgejo.org/oci/bitnami/elasticsearch:7
        options: --tmpfs /bitnami/elasticsearch/data
        env:
          discovery.type: single-node
          ES_JAVA_OPTS: '-Xms512m -Xmx512m'
      minio:
        image: data.forgejo.org/oci/bitnami/minio:2024.8.17
        options: >-
          --hostname gitea.minio --tmpfs /bitnami/minio/data:noatime
        env:
          MINIO_DOMAIN: minio
          MINIO_ROOT_USER: 123456
          MINIO_ROOT_PASSWORD: 12345678
    steps:
      - uses: https://data.forgejo.org/actions/checkout@v6
      - uses: ./.forgejo/workflows-composite/setup-env
      - name: test release-notes-assistant.sh
        run: |
          apt-get -q install -qq -y jq
          ./release-notes-assistant.sh test_main
      - uses: ./.forgejo/workflows-composite/build-backend
      - run: |
          su forgejo -c 'make test-backend test-check'
        timeout-minutes: 120
        env:
          RACE_ENABLED: 'true'
          TAGS: bindata
          TEST_ELASTICSEARCH_URL: http://elasticsearch:9200
          TEST_MINIO_ENDPOINT: minio:9000
  test-e2e:
    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
    runs-on: docker
    needs: [backend-checks, frontend-checks]
    container:
      image: 'data.forgejo.org/oci/playwright:latest'
      options: --tmpfs /tmp:exec,noatime
    steps:
      - uses: https://data.forgejo.org/actions/checkout@v6
        with:
          fetch-depth: 20
      - uses: ./.forgejo/workflows-composite/setup-env
      - name: 'Restore frontend build'
        uses: https://data.forgejo.org/actions/cache/restore@v5
        id: cache-frontend
        with:
          path: ${{github.workspace}}/public/assets
          key: frontend-build-${{ github.sha }}
      - name: 'Build frontend (if not cached)'
        if: steps.cache-frontend.outputs.cache-hit != 'true'
        run: |
          su forgejo -c 'make deps-frontend frontend'
      - uses: ./.forgejo/workflows-composite/build-backend
      - name: Decide to run all tests
        id: run-all
        if: contains(github.event.pull_request.labels.*.name, 'run-all-playwright-tests') || contains(github.event.pull_request.title, 'playwright')
        run: |
          echo "all=1" >> "$GITHUB_OUTPUT"
      - name: Get changed files
        id: changed-files
        uses: https://data.forgejo.org/tj-actions/changed-files@v47
        with:
          separator: '\n'
      - run: |
          su forgejo -c 'make generate test-e2e-sqlite'
        timeout-minutes: 120
        env:
          USE_REPO_TEST_DIR: 1
          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
          CHANGED_FILES: ${{steps.changed-files.outputs.all_changed_files}}
          RUN_ALL: ${{steps.run-all.all}}
      - name: Upload test artifacts on failure
        if: failure()
        uses: https://data.forgejo.org/forgejo/upload-artifact@v5
        with:
          name: test-artifacts.zip
          path: tests/e2e/test-artifacts/
          retention-days: 3
  test-remote-cacher:
    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
    runs-on: docker
    needs: [backend-checks, frontend-checks, test-unit]
    container:
      image: 'data.forgejo.org/oci/node:24-trixie'
      options: --tmpfs /tmp:exec,noatime
    name: ${{ format('test-remote-cacher ({0})', matrix.cacher.name) }}
    strategy:
      matrix:
        cacher:
          - name: redis
            image: data.forgejo.org/oci/bitnami/redis:7.2
            options: --tmpfs /bitnami/redis/data:noatime
          - name: redict
            image: registry.redict.io/redict:7.3.0-scratch
            options: --tmpfs /data:noatime
          - name: valkey
            image: data.forgejo.org/oci/bitnami/valkey:7.2
            options: --tmpfs /bitnami/redis/data:noatime
          - name: garnet
            image: ghcr.io/microsoft/garnet-alpine:1.0.14
            options: --tmpfs /data:noatime
    services:
      cacher:
        image: ${{ matrix.cacher.image }}
        options: ${{ matrix.cacher.options }}
        env:
          ALLOW_EMPTY_PASSWORD: 'yes' # redis & valkey will immediately shutdown with no defined password unless overridden
    steps:
      - uses: https://data.forgejo.org/actions/checkout@v6
      - uses: ./.forgejo/workflows-composite/setup-env
      - uses: ./.forgejo/workflows-composite/build-backend
      - run: |
          su forgejo -c 'make test-remote-cacher test-check'
        timeout-minutes: 120
        env:
          RACE_ENABLED: 'true'
          TAGS: bindata
          TEST_REDIS_SERVER: cacher:6379
  test-mysql:
    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
    runs-on: docker
    needs: [backend-checks, frontend-checks]
    container:
      image: 'data.forgejo.org/oci/node:24-trixie'
      options: --tmpfs /tmp:exec,noatime
    services:
      mysql:
        image: 'data.forgejo.org/oci/bitnami/mysql:8.4'
        env:
          ALLOW_EMPTY_PASSWORD: yes
          MYSQL_DATABASE: testgitea
          #
          # See also https://codeberg.org/forgejo/forgejo/issues/976
          #
          MYSQL_EXTRA_FLAGS: --innodb-adaptive-flushing=OFF --innodb-buffer-pool-size=4G --innodb-log-buffer-size=128M --innodb-flush-log-at-trx-commit=0 --innodb-flush-log-at-timeout=30 --innodb-flush-method=nosync --innodb-fsync-threshold=1000000000 --disable-log-bin
        options: --tmpfs /bitnami/mysql/data:noatime
    steps:
      - uses: https://data.forgejo.org/actions/checkout@v6
      - uses: ./.forgejo/workflows-composite/setup-env
      - name: install dependencies
        run: apt-get update -qq && apt-get -q install -qq -y git-lfs
        env:
          DEBIAN_FRONTEND: noninteractive
      - uses: ./.forgejo/workflows-composite/build-backend
      - run: |
          su forgejo -c 'make test-mysql-migration test-mysql'
        timeout-minutes: 120
        env:
          USE_REPO_TEST_DIR: 1
  test-pgsql:
    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
    runs-on: docker
    needs: [backend-checks, frontend-checks]
    container:
      image: 'data.forgejo.org/oci/node:24-trixie'
      options: --tmpfs /tmp:exec,noatime
    services:
      minio:
        image: data.forgejo.org/oci/bitnami/minio:2024.8.17
        env:
          MINIO_ROOT_USER: 123456
          MINIO_ROOT_PASSWORD: 12345678
        options: --tmpfs /bitnami/minio/data
      ldap:
        image: data.forgejo.org/oci/forgejo-test-openldap:1
        options: --memory 500M
      pgsql:
        image: data.forgejo.org/oci/bitnami/postgresql:16
        env:
          POSTGRESQL_DATABASE: test
          POSTGRESQL_PASSWORD: postgres
          POSTGRESQL_FSYNC: off
          POSTGRESQL_EXTRA_FLAGS: -c full_page_writes=off
        options: --tmpfs /bitnami/postgresql
    steps:
      - uses: https://data.forgejo.org/actions/checkout@v6
      - uses: ./.forgejo/workflows-composite/setup-env
      - name: install dependencies
        run: apt-get update -qq && apt-get -q install -qq -y git-lfs
        env:
          DEBIAN_FRONTEND: noninteractive
      - uses: ./.forgejo/workflows-composite/build-backend
      - run: |
          su forgejo -c 'make test-pgsql-migration test-pgsql'
        timeout-minutes: 120
        env:
          RACE_ENABLED: true
          USE_REPO_TEST_DIR: 1
          TEST_LDAP: 1
  test-sqlite:
    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
    runs-on: docker
    needs: [backend-checks, frontend-checks]
    container:
      image: 'data.forgejo.org/oci/node:24-trixie'
      options: --tmpfs /tmp:exec,noatime
    steps:
      - uses: https://data.forgejo.org/actions/checkout@v6
      - uses: ./.forgejo/workflows-composite/setup-env
      - name: install dependencies
        run: apt-get update -qq && apt-get -q install -qq -y git-lfs
        env:
          DEBIAN_FRONTEND: noninteractive
      - uses: ./.forgejo/workflows-composite/build-backend
      - run: |
          su forgejo -c 'make test-sqlite-migration test-sqlite'
        timeout-minutes: 120
        env:
          TAGS: sqlite sqlite_unlock_notify
          RACE_ENABLED: true
          TEST_TAGS: sqlite sqlite_unlock_notify
          USE_REPO_TEST_DIR: 1
  security-check:
    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
    runs-on: docker
    needs:
      - test-sqlite
      - test-pgsql
      - test-mysql
      - test-remote-cacher
      - test-unit
    container:
      image: 'data.forgejo.org/oci/node:24-trixie'
      options: --tmpfs /tmp:exec,noatime
    steps:
      - uses: https://data.forgejo.org/actions/checkout@v6
      - uses: ./.forgejo/workflows-composite/setup-env
      - run: su forgejo -c 'make deps-backend deps-tools'
      - run: su forgejo -c 'make security-check'
  semgrep:
    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
    name: semgrep/ci
    runs-on: docker
    container:
      image: 'data.forgejo.org/oci/semgrep:latest'
    steps:
      - run: apk add nodejs # required for actions/checkout
      - uses: https://data.forgejo.org/actions/checkout@v6
      - name: self-check semgrep rules
        run: semgrep --test .semgrep/tests/ --config .semgrep/config/
      - name: semgrep ci
        run: semgrep ci --config .semgrep/config/ --metrics=off