name: Unit tests

on:
  # Kept as the Rust cache writer on main: caches saved from merge-queue refs are never restored by PRs.
  push:
    branches:
      - "main"
  pull_request:
    branches:
      - "**"
    # labeled/unlabeled so 'ready-for-ci' gates CI; only a new commit cancels an in-flight run (see concurrency); a draft starts no paid CI (an in-flight run still finishes).
    types: [opened, reopened, synchronize, labeled, unlabeled, ready_for_review, converted_to_draft]
  merge_group:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.merge_group.head_ref || github.ref }}
  # Only a new commit cancels: a cancelled same-SHA run leaves a failed required summary that a newer run cannot clear.
  cancel-in-progress: ${{ github.event_name != 'pull_request' || github.event.action == 'synchronize' }}

env:
  COLUMNS: 150
  ZO_RESULT_CACHE_ENABLED: true
  # coverage mapping needs no DWARF; dropping debuginfo (test inherits dev) cuts compile and link time
  CARGO_PROFILE_DEV_DEBUG: "0"

jobs:
  check_changes:
    # Paid CI runs only on PRs carrying the 'ready-for-ci' label; the merge queue runs unit tests on the merged code.
    if: ${{ github.event_name != 'pull_request' || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && github.event.pull_request.draft == false) }}
    name: check_changes
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      has_backend_changes: ${{ steps.check.outputs.has_backend_changes }}
      has_ui_changes: ${{ steps.check.outputs.has_ui_changes }}
    steps:
      # Debounce: a push inside this window cancels the run (concurrency) before anything paid starts.
      - if: github.event_name == 'pull_request'
        run: sleep 60
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      # One shared classification for every suite (see .github/actions/classify-changes); a change to
      # this workflow file re-tests itself on top of it.
      - uses: ./.github/actions/classify-changes
        id: classify
      - id: check
        env:
          HAS_BACKEND_CHANGES: ${{ steps.classify.outputs.run_unit_backend }}
          HAS_UI_CHANGES: ${{ steps.classify.outputs.run_unit_ui }}
          CHANGED_WORKFLOWS: ${{ steps.classify.outputs.changed_workflows }}
        run: |
          if [ "$HAS_BACKEND_CHANGES" = "true" ] || echo " $CHANGED_WORKFLOWS " | grep -q ' unit-tests.yml '; then
            echo "has_backend_changes=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_backend_changes=false" >> "$GITHUB_OUTPUT"
          fi
          if [ "$HAS_UI_CHANGES" = "true" ] || echo " $CHANGED_WORKFLOWS " | grep -q ' unit-tests.yml '; then
            echo "has_ui_changes=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_ui_changes=false" >> "$GITHUB_OUTPUT"
          fi

  backend_static_checks:
    needs: [check_changes]
    if: needs.check_changes.outputs.has_backend_changes == 'true'
    runs-on:
      labels: eks-openobserve-standard-8
    permissions:
      contents: read
    steps:
      - name: Clone the current repo
        uses: actions/checkout@v5

      - uses: ./.github/actions/github-auth
      - name: Setup Rust Toolchain
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: nightly-2026-10-24
          targets: x86_64-unknown-linux-gnu

      # Own cache: the unit-tests cache holds coverage-instrumented builds that clippy cannot reuse.
      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          cache-on-failure: true
          shared-key: clippy
          # main only: merge-queue ref caches are invisible to PRs and would only crowd the repo cache cap
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Install Protoc
        run: bash ./.github/protoc.sh

      # The EKS runner image has no libclang, which bindgen needs to build custom-labels.
      - name: Install libclang
        run: sudo apt-get update && sudo apt-get install -y libclang-dev

      - name: Simulate building frontend code
        run: mkdir -p web/dist && touch web/dist/index.html

      - name: Print rustc cfg
        run: rustc -C target-cpu=native --print cfg

      - name: Check code formatting
        run: cargo fmt --all -- --check

      - name: Run clippy
        run: cargo --config net.git-fetch-with-cli=true clippy --workspace --all-targets -- -W clippy::too_many_lines -W clippy::cognitive_complexity -W clippy::excessive_nesting -D warnings

  backend_unit_tests_postgres:
    needs: [check_changes]
    if: needs.check_changes.outputs.has_backend_changes == 'true'
    runs-on:
      labels: ubicloud-standard-8
    permissions:
      contents: read
    env:
      ZO_INTERNAL_GRPC_TOKEN: fake
      ZO_TEXT_DATA_TYPE: text
      ZO_META_STORE: postgres
      ZO_META_POSTGRES_DSN: postgres://postgres:password@localhost:5432/postgres
    services:
      postgres:
        image: postgres:17.5-alpine3.22
        env:
          POSTGRES_PASSWORD: password
          POSTGRES_USER: postgres
          POSTGRES_DB: postgres
        ports:
          - 5432:5432
        options: --health-cmd "pg_isready -U postgres" --health-interval 10s --health-timeout 5s --health-retries 10
    steps:
      - name: Clone the current repo
        uses: actions/checkout@v5
        with:
          # config::VERSION needs tags from git describe, which a shallow clone lacks; old blobs are not needed
          fetch-depth: 0
          filter: blob:none

      - uses: ./.github/actions/github-auth
      - name: Setup Rust Toolchain
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: nightly-2026-10-24
          targets: x86_64-unknown-linux-gnu

      - uses: taiki-e/install-action@1919c4a95903d2c33e4a221102edca87309fc14b # v2.89.0
        env:
          GITHUB_TOKEN: ${{ github.token }}
        with:
          tool: nextest,cargo-llvm-cov

      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          cache-on-failure: true
          shared-key: unit-tests
          # merge_group so an evicted cache self-heals from the next queue run, not only main pushes
          save-if: ${{ github.event_name == 'merge_group' || github.ref == 'refs/heads/main' }}

      - name: Install Protoc
        run: bash ./.github/protoc.sh

      - name: Simulate building frontend code
        run: mkdir -p web/dist && touch web/dist/index.html

      - name: Wait for PostgreSQL to be ready
        run: |
          echo "Waiting for PostgreSQL to be fully ready..."
          for i in {1..30}; do
            if PGPASSWORD=password psql -h localhost -U postgres -d postgres -c "SELECT 1" > /dev/null 2>&1; then
              echo "PostgreSQL is ready!"
              break
            fi
            echo "Waiting for PostgreSQL... attempt $i/30"
            sleep 2
          done

      - name: Run PostgreSQL unit tests
        run: ./coverage.sh run-cov
        env:
          ZO_DATA_DIR: ${{ runner.temp }}/openobserve-postgres/
          # The PR run already gated coverage; the queue only needs pass/fail.
          COVERAGE_NO_REPORT: ${{ github.event_name == 'merge_group' }}

      - name: Check PostgreSQL coverage
        if: github.event_name != 'merge_group'
        run: ./coverage.sh check

  backend_unit_tests_sqlite:
    needs: [check_changes]
    if: needs.check_changes.outputs.has_backend_changes == 'true'
    runs-on:
      labels: ubicloud-standard-8
    permissions:
      contents: read
    env:
      ZO_INTERNAL_GRPC_TOKEN: fake
      ZO_TEXT_DATA_TYPE: text
      ZO_META_STORE: sqlite
      ZO_META_POSTGRES_DSN: ""
    steps:
      - name: Clone the current repo
        uses: actions/checkout@v5
        with:
          # config::VERSION needs tags from git describe, which a shallow clone lacks; old blobs are not needed
          fetch-depth: 0
          filter: blob:none

      - uses: ./.github/actions/github-auth
      - name: Setup Rust Toolchain
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
        with:
          toolchain: nightly-2026-10-24
          targets: x86_64-unknown-linux-gnu

      - uses: taiki-e/install-action@1919c4a95903d2c33e4a221102edca87309fc14b # v2.89.0
        env:
          GITHUB_TOKEN: ${{ github.token }}
        with:
          tool: nextest,cargo-llvm-cov

      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          cache-on-failure: true
          shared-key: unit-tests
          save-if: false

      - name: Install Protoc
        run: bash ./.github/protoc.sh

      - name: Simulate building frontend code
        run: mkdir -p web/dist && touch web/dist/index.html

      - name: Run SQLite unit tests
        run: ./coverage.sh run-cov
        env:
          ZO_DATA_DIR: ${{ runner.temp }}/openobserve-sqlite/
          # The PR run already gated coverage; the queue only needs pass/fail.
          COVERAGE_NO_REPORT: ${{ github.event_name == 'merge_group' }}

      - name: Check SQLite coverage
        if: github.event_name != 'merge_group'
        run: ./coverage.sh check

  backend_unit_tests:
    name: backend_unit_tests
    runs-on: ubuntu-latest
    permissions: {}
    needs:
      - check_changes
      - backend_static_checks
      - backend_unit_tests_postgres
      - backend_unit_tests_sqlite
    if: always() && needs.check_changes.outputs.has_backend_changes == 'true'
    steps:
      - name: Check backend test results
        run: |
          for result in \
            "${{ needs.backend_static_checks.result }}" \
            "${{ needs.backend_unit_tests_postgres.result }}" \
            "${{ needs.backend_unit_tests_sqlite.result }}"; do
            if [ "$result" != "success" ]; then
              echo "A backend check failed or was skipped: $result"
              exit 1
            fi
          done
          echo "All backend checks completed successfully"

  ui_unit_test_shards:
    needs: [check_changes]
    if: needs.check_changes.outputs.has_ui_changes == 'true'
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]
    runs-on:
      labels: eks-openobserve-standard-8
    permissions:
      contents: read

    steps:
      - name: Clone the current repo
        uses: actions/checkout@v5

      - uses: ./.github/actions/github-auth
      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: 'npm'
          cache-dependency-path: web/package-lock.json

      - name: Restore node_modules
        id: nm
        uses: actions/cache/restore@v6
        with:
          path: web/node_modules
          key: node-modules-${{ runner.os }}-node24-${{ hashFiles('web/package-lock.json', 'web/package.json', 'web/patches/**') }}

      - name: Install dependencies
        if: steps.nm.outputs.cache-hit != 'true'
        working-directory: web
        timeout-minutes: 5
        run: npm ci

      # Only main saves it: a PR-saved cache is visible to that PR alone and fills the 10 GB repo cache.
      - name: Save node_modules
        if: github.ref == 'refs/heads/main' && steps.nm.outputs.cache-hit != 'true'
        uses: actions/cache/save@v6
        with:
          path: web/node_modules
          key: node-modules-${{ runner.os }}-node24-${{ hashFiles('web/package-lock.json', 'web/package.json', 'web/patches/**') }}

      - name: Run this shard with coverage
        working-directory: web
        env:
          UI_SHARD_BALANCE: '1'
        run: |
          npx vitest run --coverage --shard=${{ matrix.shard }}/4 --reporter=default --reporter=blob \
            --coverage.reportOnFailure --coverage.reporter=json \
            --coverage.thresholds.lines=0 --coverage.thresholds.functions=0 \
            --coverage.thresholds.branches=0 --coverage.thresholds.statements=0

      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: ui-unit-blob-${{ matrix.shard }}
          path: web/.vitest-reports
          include-hidden-files: true
          retention-days: 1
          compression-level: 1

  # Keeps the required-check name `ui_unit_tests` while the work runs in shards.
  ui_unit_tests:
    needs: [check_changes, ui_unit_test_shards]
    if: always() && needs.check_changes.outputs.has_ui_changes == 'true'
    timeout-minutes: 20
    runs-on:
      labels: eks-openobserve-standard-4
    permissions:
      contents: read

    steps:
      - name: Require every shard to pass
        run: |
          [ "${{ needs.ui_unit_test_shards.result }}" = "success" ] || { echo "shards: ${{ needs.ui_unit_test_shards.result }}"; exit 1; }

      - name: Clone the current repo
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: 'npm'
          cache-dependency-path: web/package-lock.json

      - name: Restore node_modules
        id: nm
        uses: actions/cache/restore@v6
        with:
          path: web/node_modules
          key: node-modules-${{ runner.os }}-node24-${{ hashFiles('web/package-lock.json', 'web/package.json', 'web/patches/**') }}

      - name: Install dependencies
        if: steps.nm.outputs.cache-hit != 'true'
        working-directory: web
        timeout-minutes: 5
        run: npm ci

      - uses: actions/download-artifact@v4
        with:
          pattern: ui-unit-blob-*
          path: web/.vitest-reports
          merge-multiple: true

      - name: Merge shard coverage and check thresholds
        working-directory: web
        run: ./coverage.sh merge

  ui_code_quality:
    needs: [check_changes]
    if: needs.check_changes.outputs.has_ui_changes == 'true'
    runs-on:
      labels: eks-openobserve-standard-8
    permissions:
      contents: read

    steps:
      - name: Clone the current repo
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 24
          cache: 'npm'
          cache-dependency-path: web/package-lock.json

      - name: Install dependencies
        working-directory: web
        run: npm ci

      # Cheapest first, so a failure skips the slower steps.
      - name: Check token-file purity (token files contain tokens only)
        working-directory: web
        run: npm run lint:token-purity

      - name: Check for undefined CSS custom properties
        working-directory: web
        run: npm run lint:tokens

      - name: Lint styles (stylelint — bans legacy --o2-* tokens)
        working-directory: web
        run: npm run lint:styles

      - name: Check design-consistency ratchet (strict — hardcoded/arbitrary/raw-token, no slack)
        working-directory: web
        run: npm run lint:design:strict

      - name: Lint frontend code
        working-directory: web
        run: npm run lint:ci

      - name: Prettier format check (any unformatted file fails)
        working-directory: web
        run: npm run format:check

      - name: Type-check (any error fails)
        working-directory: web
        env:
          # vue-tsc peaks around 3GB on this project; the runner's default heap
          # ceiling is ~4GB, which OOMs (exit 134) instead of reporting errors.
          NODE_OPTIONS: "--max-old-space-size=8192"
        run: npm run type-check:app

  unit_tests_summary:
    runs-on: ubuntu-latest
    permissions: {}
    needs: [check_changes, backend_unit_tests, ui_unit_tests, ui_code_quality]
    if: always() && (github.event_name != 'pull_request' || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && github.event.pull_request.draft == false))
    steps:
      - name: Check test results
        run: |
          if [ "${{ needs.check_changes.result }}" != "success" ]; then
            echo "check_changes job did not succeed: ${{ needs.check_changes.result }}"
            exit 1
          fi

          if [ "${{ needs.backend_unit_tests.result }}" == "success" ] || [ "${{ needs.backend_unit_tests.result }}" == "skipped" ]; then
            echo "Backend tests passed or skipped"
          else
            echo "Backend tests failed"
            exit 1
          fi

          if [ "${{ needs.ui_unit_tests.result }}" == "success" ] || [ "${{ needs.ui_unit_tests.result }}" == "skipped" ]; then
            echo "UI tests passed or skipped"
          else
            echo "UI tests failed"
            exit 1
          fi

          if [ "${{ needs.ui_code_quality.result }}" == "success" ] || [ "${{ needs.ui_code_quality.result }}" == "skipped" ]; then
            echo "UI code quality passed or skipped"
          else
            echo "UI code quality failed"
            exit 1
          fi

          echo "All tests completed successfully"