orca/.github/workflows/node-server-tests.yml

name: Headless Node server

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    paths:
      - 'src/**'
      - 'config/**'
      - 'native/**'
      - 'tests/**'
      - 'resources/**'
      - 'package.json'
      - 'pnpm-lock.yaml'
      - 'pnpm-workspace.yaml'
      - 'tsconfig.json'
      - '.npmrc'
      - '.pnpmfile.cjs'
      - '.github/actions/install-node-dependencies/**'
      - '.github/workflows/node-server-tests.yml'
  # The pull request qualifies one platform for an unflavoured change; this is where all six
  # are re-qualified, so a platform break surfaces minutes after merge instead of next cron.
  push:
    branches: [main]
    paths:
      - 'src/**'
      - 'config/**'
      - 'native/**'
      - 'tests/**'
      - 'resources/**'
      - 'package.json'
      - 'pnpm-lock.yaml'
      - 'pnpm-workspace.yaml'
      - 'tsconfig.json'
      - '.npmrc'
      - '.pnpmfile.cjs'
      - '.github/actions/install-node-dependencies/**'
      - '.github/workflows/node-server-tests.yml'
  workflow_dispatch:
  schedule:
    - cron: '30 11 * * *'

permissions:
  contents: read

concurrency:
  group: node-server-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      should_run: ${{ steps.scope.outputs.should_run }}
      qualification: ${{ steps.scope.outputs.qualification }}
      runners: ${{ steps.scope.outputs.runners }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 2
          persist-credentials: false
      - uses: ./.github/actions/install-node-dependencies
      - name: Detect headless-server build and test inputs
        id: scope
        shell: bash
        run: |
          # Compare the tested merge with its base, retaining both sides of renames.
          if git diff --name-only --no-renames -z HEAD^1 HEAD > "$RUNNER_TEMP/node-server-changes"; then
            node config/scripts/node-server-change-scope.mjs "$RUNNER_TEMP/node-server-changes"
          else
            echo 'should_run=true' >> "$GITHUB_OUTPUT"
          fi

  persistence:
    needs: changes
    # Missing/failed detection runs the full matrix; manual runs remain unconditional.
    # A draft carries no platform verdict; readiness re-triggers this workflow. Spelled against
    # the event name so the push and schedule paths do not rest on a null property comparison.
    if: >-
      ${{ !cancelled() && needs.changes.outputs.should_run != 'false' &&
      (github.event_name != 'pull_request' || github.event.pull_request.draft != true) }}
    strategy:
      fail-fast: false
      matrix:
        os: ${{ fromJSON(needs.changes.outputs.runners || '["ubuntu-22.04","ubuntu-24.04-arm","macos-14","macos-15-intel","windows-2022","windows-11-arm"]') }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    env:
      ORCA_BACKGROUND_LAUNCH: '1'
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: ./.github/actions/install-node-dependencies
        with:
          native-runtime: ${{ runner.os == 'Windows' && 'node' || 'none' }}
      # Before setup-node 18: the scripts import the TypeScript runtime pin.
      # Linux release slots come from the Ubuntu 20.04 and Alpine lanes below, where their libc
      # floors live; this runner's slot only packages orcad for its own tests.
      - name: Build and smoke this runner's node-pty prebuild slot under the pinned Node
        shell: bash
        run: |
          pnpm build:orcad-prebuilds
          pnpm build:orcad-prebuilds --require-slots "$(node config/scripts/build-orcad-prebuilds.mjs --print-slot)"
          pnpm build:orcad-prebuilds --smoke
      - run: pnpm build:orcad
      # Design D7 upgrade and rollback: the last Bun orcad, built from a main commit that shipped
      # it at this PROTOCOL_VERSION, beside this checkout's Node slot. Same lockfile, so its build
      # reuses this checkout's node_modules.
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        if: runner.os == 'Linux'
        with:
          bun-version: 1.4.2
      - name: Build the last Bun orcad for the cross-runtime tests
        if: runner.os == 'Linux'
        shell: bash
        env:
          BUN_ORCAD_COMMIT: f4092c06d639ee13ad446261dcabc78b27a21fbc
        run: |
          git fetch --no-tags --depth=1 origin "$BUN_ORCAD_COMMIT"
          git worktree add --detach "$RUNNER_TEMP/bun-orcad-source" "$BUN_ORCAD_COMMIT"
          ln -s "$GITHUB_WORKSPACE/node_modules" "$RUNNER_TEMP/bun-orcad-source/node_modules"
          node "$RUNNER_TEMP/bun-orcad-source/config/scripts/build-orcad-bun.mjs" --out-dir "$RUNNER_TEMP/bun-orcad"
          echo "ORCA_BUN_ORCAD_SLOT=$RUNNER_TEMP/bun-orcad" >> "$GITHUB_ENV"
          echo "BUN_EXECUTABLE=$(command -v bun)" >> "$GITHUB_ENV"
      - run: pnpm test:node-server --artifact ${{ runner.os == 'Linux' && '--cross-runtime' || '' }}
      - uses: actions/setup-node@v6
        if: runner.arch == 'X64'
        with:
          node-version: '18'
      - name: Verify Node 18 loads and hands off to the pinned Node
        if: runner.arch == 'X64'
        shell: bash
        run: |
          node out/orcad/orcad.js --orcad-smoke-load-check
          node out/orcad/orcad.js --orcad-profile-state-preflight 00000000-0000-4000-8000-000000000018 | tee "$RUNNER_TEMP/preflight.json"
          node -e "const r=JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'));if(r.runtime!=='node'||!/^24\./.test(r.runtimeVersion))process.exit(1)" "$RUNNER_TEMP/preflight.json"

  linux_glibc_floor:
    needs: [changes, persistence]
    # A failed smoke already blocks qualification; missing scope still selects every platform.
    if: >-
      ${{ !cancelled() && needs.persistence.result == 'success' &&
      needs.changes.outputs.should_run != 'false' &&
      needs.changes.outputs.qualification != 'false' }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04, ubuntu-24.04-arm]
        # Design D6: server glibc slots are built and gated on glibc 2.28, where the pinned Node's
        # own floor is; the desktop keeps its Ubuntu 20.04 gate. gcc-toolset-14 supplies C++20 and
        # links newer libstdc++ symbols statically, so the slot needs only RHEL 8's GLIBCXX_3.4.25.
        include:
          - os: ubuntu-22.04
            image: quay.io/pypa/manylinux_2_28_x86_64@sha256:407f771c51a2c3e83ebe5a7970b4289ead3a6db21d9b9c089168775cad11d328
          - os: ubuntu-24.04-arm
            image: quay.io/pypa/manylinux_2_28_aarch64@sha256:c22ffd129ac99a8a42d1f2c2f4e88a9089288dd9ee987a7092da1c7dc48f27a9
    runs-on: ${{ matrix.os }}
    container: ${{ matrix.image }}
    timeout-minutes: 25
    env:
      ORCA_BACKGROUND_LAUNCH: '1'
      # The image puts /opt/clang first on PATH; the slot is built with its gcc-toolset.
      CC: gcc
      CXX: g++
      PYTHON: /opt/python/cp312-cp312/bin/python3
    steps:
      - name: Install glibc 2.28 prerequisites
        run: dnf install -y git procps-ng unzip which xz
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - name: Trust the checked-out workspace
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - uses: ./.github/actions/install-node-dependencies
      - name: Build and smoke this runner's node-pty prebuild slot under the pinned Node
        run: |
          pnpm build:orcad-prebuilds
          pnpm build:orcad-prebuilds --require-slots "$(node config/scripts/build-orcad-prebuilds.mjs --print-slot)"
          pnpm build:orcad-prebuilds --smoke
      - run: pnpm build:orcad
      - run: pnpm test:node-server --artifact

  linux_glibc217_compat:
    needs: [changes, persistence]
    # A failed smoke already blocks qualification; missing scope still selects every platform.
    if: >-
      ${{ !cancelled() && needs.persistence.result == 'success' &&
      needs.changes.outputs.should_run != 'false' &&
      needs.changes.outputs.qualification != 'false' }}
    runs-on: ubuntu-22.04
    timeout-minutes: 20
    env:
      ORCA_BACKGROUND_LAUNCH: '1'
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: ./.github/actions/install-node-dependencies
      # Design D6 rung B: the opt-in linux-x64-glibc217 slot beside the unofficial glibc-217 Node.
      # Why docker run and not container: the runner's own Node for JS actions needs glibc 2.28,
      # so the host installs and fetches the pinned Node, and the glibc 2.17 image only builds and
      # smokes with that Node. devtoolset-10 supplies C++20; the slot links libstdc++ statically.
      - name: Build and smoke the glibc 2.17 compat slot under the glibc-217 Node
        run: |
          compat_node="$(node config/scripts/build-orcad-prebuilds.mjs --slot=linux-x64-glibc217 --print-runtime)"
          case "$compat_node" in
            "$GITHUB_WORKSPACE"/*) ;;
            *) echo "glibc-217 Node cached outside the workspace: $compat_node" >&2; exit 1 ;;
          esac
          docker run --rm --init -i \
            -e ORCA_BACKGROUND_LAUNCH=1 \
            -e COMPAT_NODE="/work/${compat_node#"$GITHUB_WORKSPACE"/}" \
            -e CC=gcc -e CXX=g++ \
            -e PYTHON=/opt/python/cp312-cp312/bin/python3 \
            -v "$GITHUB_WORKSPACE:/work" -w /work \
            quay.io/pypa/manylinux2014_x86_64@sha256:6f74cabeac2432570aa4bfdb29f7c1f30313d4d6654d764c44e574b6ffdd4ed5 bash -s <<'GLIBC217_COMPAT_SLOT'
          set -eu
          export PATH="$(dirname "$COMPAT_NODE"):$PATH"
          node config/scripts/build-orcad-prebuilds.mjs --slot=linux-x64-glibc217
          node config/scripts/build-orcad-prebuilds.mjs --require-slots linux-x64-glibc217
          # The image's devtoolset LD_LIBRARY_PATH must not stand in for a host C++ runtime.
          env -u LD_LIBRARY_PATH node config/scripts/build-orcad-prebuilds.mjs --slot=linux-x64-glibc217 --smoke
          GLIBC217_COMPAT_SLOT

  linux_musl:
    needs: [changes, persistence]
    # A failed smoke already blocks qualification; missing scope still selects every platform.
    if: >-
      ${{ !cancelled() && needs.persistence.result == 'success' &&
      needs.changes.outputs.should_run != 'false' &&
      needs.changes.outputs.qualification != 'false' }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04, ubuntu-24.04-arm]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    env:
      ORCA_BACKGROUND_LAUNCH: '1'
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - name: Verify native Alpine artifact and persistence
        run: |
          # Multi-arch index digest of the tag; re-resolve it whenever NODE_RUNTIME_PIN moves.
          docker run --rm --init -i \
            -e ORCA_BACKGROUND_LAUNCH=1 \
            -v "$GITHUB_WORKSPACE:/work" -w /work \
            node:24.21.0-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 sh -s <<'NODE_SERVER_QUALIFICATION'
          set -eu
          apk add --no-cache bash git libstdc++ python3 make g++
          git config --global --add safe.directory /work
          npm install -g "$(node -p "require('./package.json').packageManager.split('+')[0]")"
          pnpm install --frozen-lockfile --ignore-scripts
          pnpm build:orcad-prebuilds
          pnpm build:orcad-prebuilds --require-slots "$(node config/scripts/build-orcad-prebuilds.mjs --print-slot)"
          pnpm build:orcad-prebuilds --smoke
          pnpm build:orcad
          pnpm test:node-server --artifact
          NODE_SERVER_QUALIFICATION