developer-tests.yml

# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0

name: Developer Tests

on:
  pull_request:
    branches:
      - "**" # Run on PR open, update, or synchronize (i.e., any push to PR branch)

# Least-privilege default for the GITHUB_TOKEN. Without this, any job that
# omits its own `permissions:` block inherits the repository default, which can
# be write-all. Jobs that need more declare it themselves (see below), and this
# floor is what any future job gets until it does.
permissions:
  contents: read

# Global timeout for all jobs
# Note: GitHub Actions uses minutes, GitLab uses duration strings
jobs:
  developer_tests:
    name: Lint, Type Check, and Test
    runs-on: ubuntu-latest
    timeout-minutes: 120 # 2 hours
    
    permissions:
      contents: read
      issues: read
      checks: write
      # pull-requests: write - Not needed: PR comments are disabled (see line 115)

    # Use Python 3.13 to match GitLab configuration
    container:
      image: python:3.13-bookworm

    steps:
      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
        with:
          fetch-depth: 0 # Fetch all history for git diff in typecheck-pr

      - name: Set up Git safe directory
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"

      # `github.base_ref` is attacker-controllable (a fork can name its branch
      # anything), so it must never be interpolated straight into `run:` where
      # the shell would evaluate it. Pass it through `env:` and quote the
      # expansion instead.
      - name: Fetch base branch
        env:
          BASE_REF: ${{ github.base_ref || 'main' }}
        run: |
          git fetch origin "${BASE_REF}:refs/remotes/origin/${BASE_REF}"
          git branch -a

      - name: Set up environment
        run: |
          python --version
          apt-get update -y
          apt-get install make curl -y

      # Use the first-party pinned action rather than
      # `curl -LsSf https://astral.sh/uv/install.sh | sh`: piping a remote
      # script into a shell executes whatever the endpoint serves, and the
      # pipeline also hid failures (it exited with sh's status, not curl's).
      # The action also puts uv on PATH itself — the old step appended a
      # `$HOME/.cargo/bin` that recent uv installers no longer use.
      - name: Install uv
        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.3.1

      - name: Create virtual environment
        run: |
          uv venv .venv
          echo "$GITHUB_WORKSPACE/.venv/bin" >> $GITHUB_PATH

      # Node 22 is needed for the UI unit tests and for basedpyright. Use the
      # first-party setup-node action (as deploy-docs.yml already does) rather
      # than piping NodeSource's installer into bash: that pipeline swallowed a
      # failed download (`curl ... | bash -` exits with bash's status, not
      # curl's), so a NodeSource 403 silently left the repo unregistered, the
      # following apt-get installed Debian's own nodejs 18 — which ships no npm
      # — and the job failed several steps later with a bare `npm: not found`.
      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
        with:
          node-version: 22

      - name: Install basedpyright
        run: npm install -g basedpyright

      - name: Install Python dependencies
        run: |
          uv pip install 'ruff==0.15.13'
          uv pip install typer rich boto3
          # ALL first-party packages in a single pip pass. They depend on each
          # other by bare name and those names are squatted on public PyPI, so a
          # split install would resolve a sibling from PyPI — see the
          # FIRST_PARTY_EDITABLES note in the Makefile. The target also runs
          # scripts/check_first_party_deps.py, which fails if any of them did.
          # Previously CI installed only idp_common_pkg, so the package/Lambda
          # suites could not even import idp_sdk.
          make install-first-party PIP="uv pip"

      - name: Run linting checks
        run: make lint-cicd

      - name: Run type checking
        env:
          BASE_REF: ${{ github.base_ref }}
        run: |
          TARGET_BRANCH="$BASE_REF"
          echo "=== Type Checking Configuration ==="
          echo "PR target branch (github.base_ref): $TARGET_BRANCH"
          echo "Comparing: origin/$TARGET_BRANCH...HEAD"
          echo "===================================="
          echo ""

          make typecheck-pr TARGET_BRANCH="$TARGET_BRANCH"

      - name: Run tests
        id: run-tests
        run: make test-cicd -C lib/idp_common_pkg
        continue-on-error: false

      # `make test-cicd -C lib/idp_common_pkg` above covers only idp_common_pkg.
      # This target covers the package/Lambda suites it does not: idp_cli, idp_sdk,
      # idp_feature_sdk, the feature-platform resolvers, the seller entitlement
      # service (including its template-security assertions and payload-robustness
      # fuzz corpus), and the SDLC harness suite (deployment-variant probes, the
      # API security cases, and the IAM trust-policy partition guards that keep a
      # GovCloud-only principal out of a commercial trust policy — see issue #632).
      # All offline — no AWS, no credentials.
      # These were previously ungated: ~400 tests, including ones that have caught
      # real security bugs, ran only on developers' machines.
      - name: Run package and Lambda test suites
        id: run-package-tests
        run: make test-packages-cicd
        continue-on-error: false

      - name: Run UI unit tests
        id: run-ui-tests
        # Vitest + jsdom (no browser). Node 22 comes from setup-node above.
        run: cd src/ui && npm ci --prefer-offline --no-audit && npx vitest run
        continue-on-error: false

      - name: Upload coverage reports
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
        if: always() && steps.run-tests.outcome != 'skipped'
        with:
          name: test-reports
          path: |
            lib/idp_common_pkg/test-reports/coverage.xml
            lib/idp_common_pkg/test-reports/test-results.xml
          retention-days: 7

      - name: Publish test results
        uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040  # v2.23.0
        if: always() && hashFiles('lib/idp_common_pkg/test-reports/test-results.xml') != ''
        with:
          files: lib/idp_common_pkg/test-reports/test-results.xml
          check_name: Test Results
          comment_mode: off  # Disable PR comments to avoid permission issues on fork PRs

      - name: Code Coverage Report
        uses: irongut/CodeCoverageSummary@51cc3a756ddcd398d447c044c02cb6aa83fdae95  # v1.3.0
        if: always() && hashFiles('lib/idp_common_pkg/test-reports/coverage.xml') != ''
        with:
          filename: lib/idp_common_pkg/test-reports/coverage.xml
          badge: true
          fail_below_min: false
          format: markdown
          hide_branch_rate: false
          hide_complexity: true
          indicators: true
          output: both
          thresholds: "60 80"

      # Note: PR comments disabled for fork PRs due to permission restrictions
      # Coverage results are available in:
      # 1. Workflow artifacts (test-reports)
      # 2. Job summary (automatically generated by CodeCoverageSummary)
      # 3. GitHub checks tab