windmill/.github/workflows/git-sync-test.yml

name: Git Sync Integration Tests

on:
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - "backend/windmill-git-sync/**"
      - "backend/windmill-api-integration-tests/tests/git_sync*"
      - "backend/ee-repo-ref.txt"
      - "backend/windmill-common/src/workspaces.rs"
      - "backend/windmill-worker/src/result_processor.rs"
      - "backend/windmill-api-workspaces/**"
      - "cli/src/commands/sync/**"
      - "cli/src/utils/git.ts"
      - "integration_tests/test/git_sync_test.py"
      - ".github/workflows/git-sync-test.yml"
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - "backend/windmill-git-sync/**"
      - "backend/windmill-api-integration-tests/tests/git_sync*"
      - "backend/ee-repo-ref.txt"
      - "backend/windmill-common/src/workspaces.rs"
      - "backend/windmill-worker/src/result_processor.rs"
      - "backend/windmill-api-workspaces/**"
      - "cli/src/commands/sync/**"
      - "cli/src/utils/git.ts"
      - "integration_tests/test/git_sync_test.py"
      - ".github/workflows/git-sync-test.yml"

concurrency:
  group: git-sync-test-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check-relevance:
    runs-on: ubuntu-latest
    outputs:
      should_run: ${{ steps.check.outputs.should_run }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Check if git sync related files changed
        id: check
        env:
          WINDMILL_EE_PRIVATE_ACCESS: ${{ secrets.WINDMILL_EE_PRIVATE_ACCESS }}
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            BASE=${{ github.event.pull_request.base.sha }}
          else
            BASE=${{ github.event.before }}
          fi

          CHANGED_FILES=$(git diff --name-only "$BASE"..HEAD 2>/dev/null || echo "")
          echo "Changed files:"
          echo "$CHANGED_FILES"

          # Direct git sync file changes — always relevant.
          if echo "$CHANGED_FILES" | grep -qE '^(backend/windmill-git-sync/|backend/windmill-worker/src/result_processor\.rs|backend/windmill-api-workspaces/|backend/windmill-api-integration-tests/tests/git_sync|backend/windmill-common/src/workspaces\.rs|cli/src/commands/sync/|cli/src/utils/git\.ts|integration_tests/test/git_sync|\.github/workflows/git-sync-test\.yml)'; then
            echo "should_run=true" >> "$GITHUB_OUTPUT"
            echo "Relevant: direct git sync file changes"
            exit 0
          fi

          # If ee-repo-ref.txt changed, check if the EE diff touches windmill-git-sync/
          if echo "$CHANGED_FILES" | grep -q '^backend/ee-repo-ref.txt$'; then
            NEW_REF=$(cat backend/ee-repo-ref.txt)
            OLD_REF=$(git show "$BASE:backend/ee-repo-ref.txt" 2>/dev/null || echo "")

            if [ -n "$OLD_REF" ] && [ "$OLD_REF" != "$NEW_REF" ]; then
              # Clone EE repo and check diff
              git clone --bare "https://x-access-token:${WINDMILL_EE_PRIVATE_ACCESS}@github.com/windmill-labs/windmill-ee-private.git" /tmp/ee-repo 2>/dev/null
              EE_CHANGED=$(git -C /tmp/ee-repo diff --name-only "$OLD_REF".."$NEW_REF" 2>/dev/null || echo "")
              echo "EE changed files:"
              echo "$EE_CHANGED"

              if echo "$EE_CHANGED" | grep -q '^windmill-git-sync/'; then
                echo "should_run=true" >> "$GITHUB_OUTPUT"
                echo "Relevant: EE git sync files changed"
                exit 0
              fi
            fi
          fi

          echo "should_run=false" >> "$GITHUB_OUTPUT"
          echo "No git sync relevant changes detected, skipping tests"

  git_sync_e2e:
    needs: [check-relevance]
    if: needs.check-relevance.outputs.should_run == 'true'
    runs-on: ubicloud-standard-16
    services:
      postgres:
        image: postgres:14
        ports:
          - 5432:5432
        env:
          POSTGRES_DB: windmill
          POSTGRES_PASSWORD: changeme
        options: >-
          --health-cmd pg_isready --health-interval 10s --health-timeout 5s
          --health-retries 5

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}
          fetch-depth: 0

      - name: Read EE repo commit hash
        run: |
          echo "ee_repo_ref=$(cat ./backend/ee-repo-ref.txt)" >> "$GITHUB_ENV"

      - uses: actions/checkout@v4
        with:
          repository: windmill-labs/windmill-ee-private
          path: ./windmill-ee-private
          ref: ${{ env.ee_repo_ref }}
          token: ${{ secrets.WINDMILL_EE_PRIVATE_ACCESS }}
          fetch-depth: 0

      - name: Substitute EE code
        run: |
          cd backend && ./substitute_ee_code.sh --copy --dir ./windmill-ee-private

      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          cache-workspaces: backend
          toolchain: 1.97.0

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.10

      - uses: denoland/setup-deno@v2
        with:
          deno-version: v2.x

      - uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install wmill CLI
        run: |
          cd cli && bash gen_wm_client.sh && bun install
          mkdir -p "$HOME/.local/bin"
          printf '#!/bin/sh\nexec bun run "%s/cli/src/main.ts" "$@"\n' "$GITHUB_WORKSPACE" > "$HOME/.local/bin/wmill"
          chmod +x "$HOME/.local/bin/wmill"
          echo "$HOME/.local/bin" >> $GITHUB_PATH

      - name: Build Windmill
        working-directory: ./backend
        env:
          SQLX_OFFLINE: true
          CARGO_BUILD_JOBS: 12
          RUSTFLAGS: ""
        run: |
          cargo build --features enterprise,private,license,zip

      - name: Start Gitea
        run: |
          docker run -d --name gitea \
            -e GITEA__database__DB_TYPE=sqlite3 \
            -e GITEA__security__INSTALL_LOCK=true \
            -e GITEA__server__HTTP_PORT=3000 \
            -e GITEA__server__ROOT_URL=http://localhost:3000 \
            -e GITEA__service__DISABLE_REGISTRATION=false \
            -p 3000:3000 \
            gitea/gitea:1.22-rootless
          echo "Waiting for Gitea to be ready..."
          for i in $(seq 1 30); do
            if curl -sf http://localhost:3000/api/v1/version > /dev/null 2>&1; then
              echo "Gitea is ready"
              break
            fi
            sleep 2
          done
          curl -sf http://localhost:3000/api/v1/version > /dev/null || { echo "Gitea failed to start"; exit 1; }

      - name: Start Windmill
        working-directory: ./backend
        env:
          DATABASE_URL: postgres://postgres:changeme@localhost:5432/windmill
          LICENSE_KEY: ${{ secrets.WM_LICENSE_KEY_CI }}
          DENO_PATH: deno
          BUN_PATH: bun
          NODE_BIN_PATH: node
          # The auto-pull poller's SSRF guard rejects localhost git remotes;
          # the tests' Gitea runs on localhost.
          ALLOW_LOCAL_GIT_REMOTES: "true"
        run: |
          ./target/debug/windmill &
          echo "Waiting for Windmill to be ready..."
          for i in $(seq 1 60); do
            if curl -sf http://localhost:8000/api/version > /dev/null 2>&1; then
              echo "Windmill is ready"
              break
            fi
            sleep 2
          done
          curl -sf http://localhost:8000/api/version > /dev/null || { echo "Windmill failed to start"; exit 1; }

      - name: Run git sync E2E tests
        timeout-minutes: 10
        env:
          GITEA_DOCKER_URL: http://localhost:3000
          LICENSE_KEY: ${{ secrets.WM_LICENSE_KEY_CI }}
        run: |
          python3 -m venv .venv
          .venv/bin/pip install -r integration_tests/requirements.txt
          cd integration_tests && ../.venv/bin/python -m unittest -v test.git_sync_test

      - name: Archive logs
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: Git Sync Integration Tests Logs
          path: |
            integration_tests/logs