tests.yml

# run test suites

name: Tests
on:
  - pull_request
  - push
  - release
  - workflow_dispatch

# cancel the current workflow if another commit was pushed on the same PR or reference
# uses the GitHub workflow name to avoid collision with other workflows running on the same PR/reference
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  # see: https://github.com/fkirc/skip-duplicate-actions
  skip_duplicate:
    continue-on-error: true
    runs-on: ubuntu-latest
    outputs:
      should_skip: ${{ steps.skip_check.outputs.should_skip }}
    steps:
      - id: skip_check
        uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf  # v5.4.0
        with:
          concurrent_skipping: "same_content_newer"
          skip_after_successful_duplicate: "true"
          cancel_others: "true"
          do_not_skip: '["workflow_dispatch", "schedule", "release"]'

  # see: https://github.com/actions/setup-python
  tests:
    needs: skip_duplicate
    if: ${{ needs.skip_duplicate.outputs.should_skip != 'true' || contains(github.ref, 'refs/tags') || contains(github.ref, 'refs/heads/master') }}
    runs-on: ${{ matrix.os }}
    continue-on-error: ${{ matrix.allow-failure }}
    permissions:
      contents: read           # read repository contents and checkout code
      pull-requests: write     # post coverage comments on PRs
      statuses: write          # update commit status checks (required by codecov on protected branches)
    env:
      # override make command to install directly in active python
      CONDA_CMD: ""
      DOCKER_TEST_EXEC_ARGS: "-T"
      # globally excluded 'checks', to be re-executed by dedicated job
      CHECKS_EXCLUDE: "links"
    services:
      # Label used to access the service container
      mongodb:
        image: mongo:7.0  # DockerHub
        ports:
          - "27017:27017"
    strategy:
      matrix:
        os: [ubuntu-latest]
        python-version: ["3.10", "3.11", "3.12", "3.13"]
        allow-failure: [false]
        test-server: [false]
        test-case: [test-unit-only, test-func-only]
        include:
          # experimental python
          # not yet ready due to pywps->fiona dependency missing (https://github.com/Toblerity/Fiona/issues/1504)
          #- os: ubuntu-latest
          #  python-version: "3.14"
          #  allow-failure: true
          #  test-case: test-unit-only
          #- os: ubuntu-latest
          #  python-version: "3.14"
          #  allow-failure: true
          #  test-case: test-func-only
          # linter tests
          # performs all 'check' targets except the 'CHECKS_EXCLUDE' ones (that should be defined by dedicated jobs)
          - os: ubuntu-latest
            python-version: "3.12"
            allow-failure: false
            test-case: check-only
          # check links separately as they tend to sporadically fail from external factors (timeout, ssl, down, etc.)
          # avoid wasting a lot of CI test time because one of them doesn't respond
          - os: ubuntu-latest
            python-version: "3.12"
            allow-failure: true
            test-case: check-links-only
          # documentation build
          - os: ubuntu-latest
            python-version: "3.12"
            allow-failure: false
            test-case: docs
          # coverage test
          - os: ubuntu-latest
            python-version: "3.12"
            allow-failure: false
            test-case: test-coverage-only
          # smoke test of Docker image
          - os: ubuntu-latest
            python-version: "3.12"  # doesn't matter which one (defined in docker), use only to report matching version
            allow-failure: false
            test-case: test-docker
          # EMS end-2-end Workflow tests
          - os: ubuntu-latest
            python-version: "3.12"
            allow-failure: false
            test-case: test-workflow-only
          # OGC Code-Sprint tests
          - os: ubuntu-latest
            python-version: "3.12"
            allow-failure: false
            test-case: test-code-sprint-only
            test-server: true
    steps:
      # Early detection: skip coverage test entirely for Dependabot PRs to save CI time (since it is much longer)
      # Because we always perform a second pass of test with the latest state on master after merge,
      # we can be more lenient on the coverage test for Dependabot PRs to accelerate CI/CD feedback loop.
      # Always run coverage on push to master/tags regardless of actor to validate the final result
      - name: Check if should skip
        id: should_skip_test
        run: |
          if [[ "${{ matrix.test-case }}" == "test-coverage-only" && \
                "${{ github.actor }}" == "dependabot[bot]" && \
                "${{ github.event_name }}" == "pull_request" ]]; then
            echo "skip=true" >> $GITHUB_OUTPUT
            echo "Coverage test skipped for Dependabot PR to save CI time"
          else
            echo "skip=false" >> $GITHUB_OUTPUT
          fi
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        if: ${{ steps.should_skip_test.outputs.skip != 'true' }}
        with:
          fetch-depth: "0"
      - name: Setup Python
        # skip python setup if running with docker or if test should be skipped
        if: ${{ steps.should_skip_test.outputs.skip != 'true' && matrix.test-case != 'test-docker' }}
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.0.0
        with:
          python-version: "${{ matrix.python-version }}"
          cache: 'pip'
      - name: Parse Python Version
        if: ${{ steps.should_skip_test.outputs.skip != 'true' }}
        id: python-semver
        run: |
          echo "::set-output name=major:$(echo ${{ matrix.python-version }} | cut -d '.' -f 1)"
          echo "::set-output name=minor:$(echo ${{ matrix.python-version }} | cut -d '.' -f 2)"
      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.2.2
        if: ${{ steps.should_skip_test.outputs.skip != 'true' }}
        name: Check Proj Lib Pre-Built in Cache
        id: cache-proj
        with:
          # note: '22' is v8, '21' is v7
          path: /tmp/proj-8.2.1/install
          key: ${{ runner.os }}-python${{ matrix.python-version }}-proj
      - name: Install Dependencies
        # skip python setup if running with docker or if test should be skipped
        if: ${{ steps.should_skip_test.outputs.skip != 'true' && matrix.test-case != 'test-docker' }}
        # install package and dependencies directly,
        # skip sys/conda setup to use active python
        run: make install-sys install-pkg install-pip install-raw install-dev install-dev-npm
      - name: Display Packages
        # skip python setup if running with docker or if test should be skipped
        if: ${{ steps.should_skip_test.outputs.skip != 'true' && matrix.test-case != 'test-docker' }}
        run: |
          pip freeze
          npm list
          make version
      - name: Display Environment Variables
        if: ${{ steps.should_skip_test.outputs.skip != 'true' }}
        run: |
          hash -r
          env | sort

      - name: Display Applicable Checks
        if: ${{ steps.should_skip_test.outputs.skip != 'true' && startsWith(matrix.test-case, 'check') }}
        run: make check-info
      - name: Env Test Setup
        if: ${{ steps.should_skip_test.outputs.skip != 'true' && matrix.test-server == true }}
        uses: falti/dotenv-action@73fafca04177425fd3e0a0849257015ae9d42034  # v1.2.0
        with:
          path: ./tests/functional/code_sprint/test-servers/weaver-localhost/test.env
          ensure-exists: true
          export-variables: true
          log-variables: true
          keys-case: bypass
      - name: Start Test Instance
        if: ${{ steps.should_skip_test.outputs.skip != 'true' && matrix.test-server == true }}
        run: |
          make stop start-only
          sleep 10
      - name: Run Tests
        if: ${{ steps.should_skip_test.outputs.skip != 'true' }}
        run: make ${{ matrix.test-case }}
      - name: Display Test Logs (failure)
        if: ${{ steps.should_skip_test.outputs.skip != 'true' && failure() && matrix.test-server == true }}
        run: |
          echo "=== Weaver Manager Logs ==="
          cat /tmp/weaver-manager.log
          echo "=== Weaver Worker Logs ==="
          cat /tmp/weaver-worker.log

      # manually invoke reporting in case of test failure to still generate them
      # otherwise, they would have been generated automatically following the successful coverage run
      - name: Handle Failed Coverage Report
        if: ${{ steps.should_skip_test.outputs.skip != 'true' && failure() && matrix.test-case == 'test-coverage-only' }}
        run: make coverage-reports
      # flaky test analysis, which includes failed tests if applicable
      - name: Upload test results to Codecov
        if: ${{ steps.should_skip_test.outputs.skip != 'true' && !cancelled() && matrix.test-case == 'test-coverage-only' }}
        uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3  # v1.2.1
        with:
          files: reports/coverage-junit.xml,!./cache
          flags: ${{ matrix.python-version }}
          token: ${{ secrets.CODECOV_TOKEN }}
      # coverage test analysis
      - name: Upload coverage report
        if: ${{ steps.should_skip_test.outputs.skip != 'true' && success() && matrix.test-case == 'test-coverage-only' }}
        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2  # v6.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./reports/coverage.xml
          fail_ci_if_error: true
          verbose: true
      # Provide success status when test was skipped (e.g., coverage on Dependabot PRs)
      - name: Skipped Test Placeholder
        if: ${{ steps.should_skip_test.outputs.skip == 'true' }}
        run: echo "Test skipped based on conditional criteria"

  # PyPI requires that all packages are distributed in PyPI.
  # Because we have multiple patched/forked dependencies, we cannot use them directly for PyPI releases.
  # (i.e.: all packages referenced as '<pacakge> @ git+https://github.com/projects/<package>.git@<ref>)
  # pypi-publish:
  #   name: Upload release to PyPI
  #   runs-on: ubuntu-latest
  #   needs: tests
  #   if: ${{ success() && (contains(github.ref, 'refs/tags') || github.ref == 'refs/heads/master') }}
  #   environment:
  #     name: pypi
  #     url: https://pypi.org/p/crim-weaver
  #   permissions:
  #     id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
  #   steps:
  #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.2.2
  #       with:
  #         fetch-depth: "0"
  #     - name: Set up Python
  #       uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.3.0
  #       with:
  #         python-version: "3.12"
  #     - name: Build Distribution Package
  #       run: make dist-pypi
  #     - name: Publish package distributions to PyPI
  #       uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1
  #       with:
  #         user: __token__
  #         password: ${{ secrets.PYPI_API_TOKEN }}
  #         verbose: true

  deploy-docker:
    needs: tests
    if: ${{ success() && (contains(github.ref, 'refs/tags') || github.ref == 'refs/heads/master') }}
    runs-on: ubuntu-latest
    env:
      # enabled provenance attestation during build/push (see Makefile for details)
      DOCKER_PROV: "true"
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          fetch-depth: "0"
      - name: Get Tag Version
        id: version
        shell: bash
        run: |
          if [[ "${GITHUB_REF}" == "refs/heads/master" ]]; then
            echo "::set-output name=TAG_VERSION::latest"
          else
            echo "::set-output name=TAG_VERSION::${GITHUB_REF##*/}"
          fi
      - name: Login to DockerHub
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Build Docker
        run: |
          make DOCKER_REPO=pavics/weaver APP_VERSION=${{ steps.version.outputs.TAG_VERSION }} docker-info docker-build
      - name: Push to DockerHub
        # push does not apply if built with provenance since the build itself already pushes the layers
        # the referenced repository and tagged version will not be available locally for push
        if: ${{ env.DOCKER_PROV != 'true' }}
        run: |
          make DOCKER_REPO=pavics/weaver APP_VERSION=${{ steps.version.outputs.TAG_VERSION }} docker-push