wc-acceptance-test.yml

---
name: Acceptance Test

on:
  workflow_call:
    inputs:
      image-basename:
        required: true
        type: string
      devcontainer-file:
        required: true
        type: string
      acceptance-test-path:
        required: true
        type: string
    secrets:
      TEST_GITHUB_TOKEN:
        required: true
      TEST_GITHUB_USER:
        required: true
      TEST_GITHUB_PASSWORD:
        required: true
      TEST_GITHUB_TOTP_SECRET:
        required: true

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  test:
    name: Acceptance Test
    runs-on: ubuntu-latest
    steps:
      - uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          disable-sudo: false # Playwright requires root privileges to install browsers
          egress-policy: audit
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
      # Create a GitHub Codespace and communicate the image version via a Codespace secret (should be a Codespace environment variable).
      # This secret is used by devcontainer.json, as such it is a resource that should not be used concurrently.
      - name: Start Codespace
        run: |
          set -Eeuo pipefail

          if [[ "${EVENT_NAME}" == "pull_request" ]]; then
            gh secret set -a codespaces IMAGE_VERSION --body "pr-${{ github.event.pull_request.number }}"
          elif [[ "${EVENT_NAME}" == "push" && "${{ startsWith(github.ref, 'refs/tags/') }}" == "true" ]]; then
            gh secret set -a codespaces IMAGE_VERSION --body "${GITHUB_REF#refs/tags/}"
          else
            gh secret set -a codespaces IMAGE_VERSION --body "edge"
          fi

          echo CODESPACE_NAME="$(gh codespace create -R "${GITHUB_REPOSITORY}" -b "${HEAD_REF}" -m basicLinux32gb --devcontainer-path "${DEVCONTAINER_FILE}" --idle-timeout 10m --retention-period 1h)" >> "$GITHUB_ENV"
        env:
          DEVCONTAINER_FILE: ${{ inputs.devcontainer-file }}
          EVENT_NAME: ${{ github.event_name }}
          GH_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
          HEAD_REF: ${{ github.head_ref }}
      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: 24.8.0
      - run: npm ci
      - run: npx playwright install --with-deps
      - name: Wait for Codespace to be active
        run: |
          set -Eeuo pipefail

          MAX_WAIT_SECONDS=$((3 * 60))
          SECONDS_ELAPSED=0

          while true; do
            STATE=$(gh codespace list --json name,state --jq ".[] | select(.name == \"${CODESPACE_NAME}\") | .state")
            echo "Current state: $STATE"
            if [ "$STATE" == "Available" ]; then
              echo "Codespace is active!"
              break
            fi
            if [ $SECONDS_ELAPSED -ge $MAX_WAIT_SECONDS ]; then
              echo "Timeout reached. Codespace is not active."
              exit 1
            fi
            sleep 5
            SECONDS_ELAPSED=$((SECONDS_ELAPSED + 5))
          done
        env:
          GH_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
      - run: cd "${ACCEPTANCE_TEST_PATH}" && npm test
        env:
          ACCEPTANCE_TEST_PATH: ${{ inputs.acceptance-test-path }}
          GITHUB_USER: ${{ secrets.TEST_GITHUB_USER }}
          GITHUB_PASSWORD: ${{ secrets.TEST_GITHUB_PASSWORD }}
          GITHUB_TOTP_SECRET: ${{ secrets.TEST_GITHUB_TOTP_SECRET }}
          PLAYWRIGHT_JUNIT_OUTPUT_NAME: ${{ github.workspace }}/test-report-acceptance-${{ inputs.image-basename }}.xml
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: ${{ !cancelled() }}
        with:
          name: test-results-acceptance-${{ inputs.image-basename }}
          path: |
            test-report-*.xml
            test-results/
          retention-days: 10
      - run: |
          set -Eeuo pipefail
          gh codespace delete --force --codespace "${CODESPACE_NAME}"
          gh secret set -a codespaces IMAGE_VERSION --body "latest"
        if: always()
        env:
          GH_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}