name: CI

on:
  merge_group:
  pull_request:

permissions:
  contents: read

env:
  # We run `playwright install` manually instead
  PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"

jobs:
  add-to-project:
    if: github.head_ref != 'changeset-release/main'
    concurrency:
      group: ${{ github.workflow }}-${{ github.ref }}-add-pr
      cancel-in-progress: ${{ github.head_ref != 'changeset-release/main' }}
    timeout-minutes: 30
    name: Add PR to project
    runs-on: ubuntu-latest
    steps:
      - run: curl -X POST https://devprod-status-bot.devprod.workers.dev/pr-project/workers-sdk/${{ github.event.number }}

  check:
    timeout-minutes: 30
    concurrency:
      group: ${{ github.workflow }}-${{ github.ref }}-checks
      cancel-in-progress: ${{ github.head_ref != 'changeset-release/main' }}

    name: "Checks"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install Dependencies
        uses: ./.github/actions/install-dependencies
        with:
          turbo-api: ${{ secrets.TURBO_API }}
          turbo-team: ${{ secrets.TURBO_TEAM }}
          turbo-token: ${{ secrets.TURBO_TOKEN }}
          turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}

      - name: Check the changesets
        run: node -r esbuild-register tools/deployments/validate-changesets.ts

      - name: Check for errors
        run: pnpm run check --summarize
        env:
          CI_OS: ${{ runner.os }}
          NODE_OPTIONS: "--max_old_space_size=8192"

      - name: Filter changed paths
        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: changes
        with:
          filters: |
            miniflare_openapi:
              - 'packages/miniflare/src/workers/local-explorer/openapi.local.json'
              - 'packages/miniflare/src/workers/local-explorer/generated/**'
              - 'packages/miniflare/scripts/openapi-filter-config.ts'
              - 'packages/miniflare/scripts/filter-openapi.ts'
              - 'packages/miniflare/scripts/check-generate-api.ts'
              - 'packages/miniflare/openapi-ts.config.ts'

      - name: Check generated OpenAPI types are up to date
        if: steps.changes.outputs.miniflare_openapi == 'true'
        run: pnpm -F miniflare check:generate-api

      # Check for old Node.js version warnings and errors
      - name: Use Node.js v20
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 20

      - name: Check for error message on Node.js < v22
        run: node packages/wrangler/src/__tests__/test-old-node-version.js error

  test:
    timeout-minutes: 30
    concurrency:
      group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.os }}-${{ matrix.suite }}-test
      cancel-in-progress: ${{ github.head_ref != 'changeset-release/main' }}

    name: ${{ format('Tests ({0}, {1})', matrix.description, matrix.suite) }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - macos-latest
          - ubuntu-latest
          - windows-latest
        suite:
          - packages-and-tools
          - fixtures
        include:
          - os: macos-latest
            description: macOS
          - os: ubuntu-latest
            description: Linux
          - os: windows-latest
            description: Windows

    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout Repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Filter changed paths
        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: changes
        with:
          filters: |
            everything_but_markdown:
              - '!**/*.md'

      - name: Install Dependencies
        if: steps.changes.outputs.everything_but_markdown == 'true'
        uses: ./.github/actions/install-dependencies
        with:
          turbo-api: ${{ secrets.TURBO_API }}
          turbo-team: ${{ secrets.TURBO_TEAM }}
          turbo-token: ${{ secrets.TURBO_TOKEN }}
          turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}

      # Browser Run tests in `packages/miniflare/test/plugins/browser/index.spec.ts`
      # and the `fixtures/browser-run` fixture use `@puppeteer/browsers` to
      # download Chrome into the global Wrangler cache. Caching that binary
      # across CI runs avoids ~150 MB of repeat downloads per run and reduces
      # the surface area for the intermittent partial-extraction race that
      # surfaces as `The browser folder (...) exists but the executable (...)
      # is missing` (see #13971, #13980).
      #
      # The Browser Run fixture is skipped on Ubuntu (AppArmor), but the
      # miniflare browser spec runs everywhere, so the cache is needed on all
      # three OSes for `packages-and-tools` and on Windows + macOS for
      # `fixtures`.
      - name: Restore Chrome browser cache (Browser Run)
        if: steps.changes.outputs.everything_but_markdown == 'true' && (matrix.suite == 'packages-and-tools' || (matrix.suite == 'fixtures' && matrix.os != 'ubuntu-latest'))
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          # The Chrome version lives in
          # `packages/miniflare/src/plugins/browser-rendering/browser-version.ts`.
          # Bumping that constant invalidates this cache automatically via
          # `hashFiles()` — a cache miss only triggers a fresh download, no
          # functional impact.
          key: chrome-${{ runner.os }}-${{ hashFiles('packages/miniflare/src/plugins/browser-rendering/browser-version.ts') }}
          path: |
            ~/.cache/.wrangler/chrome
            ~/Library/Caches/.wrangler/chrome
            ~/AppData/Local/xdg.cache/.wrangler/chrome

      - name: Run tests (tools only)
        # tools _only_ needs to be tested on Linux because they're only intended to run in CI
        if: steps.changes.outputs.everything_but_markdown == 'true' && matrix.suite == 'packages-and-tools' && matrix.os == 'ubuntu-latest'
        run: pnpm run test:ci --log-order=stream --filter="@cloudflare/tools"
        env:
          NODE_OPTIONS: "--max_old_space_size=8192"
          TEST_REPORT_PATH: ${{ runner.temp }}/test-report/tools/index.html
          CI_OS: ${{ matrix.description }}

      - name: Run tests (packages)
        if: steps.changes.outputs.everything_but_markdown == 'true' && matrix.suite == 'packages-and-tools'
        # We skip @cloudflare/vitest-pool-workers tests in CI on Windows because they're very flaky. We still run the vitest-pool-workers-examples fixture, which is a comprehensive set of example tests and gives us a lot of confidence.
        # The @cloudflare/vitest-pool-workers tests skipped are things like watch mode, which constantly times out probably due to the github runners in use.
        # Package tests are well-isolated (separate processes, temp dirs, random ports, MSW mocks) and can safely run in parallel.
        # Concurrency is capped at 3 to avoid CPU starvation on 4-vCPU CI runners when heavyweight suites
        # (wrangler/forks, miniflare/workerd, vitest-pool-workers/Verdaccio) overlap.
        run: pnpm run test:ci --log-order=stream --concurrency=3 --filter="./packages/*" ${{ matrix.os == 'windows-latest' && '--filter="!./packages/vitest-pool-workers"' || '' }}
        env:
          NODE_OPTIONS: "--max_old_space_size=8192"
          WRANGLER_LOG_PATH: ${{ runner.temp }}/wrangler-debug-logs/
          TEST_REPORT_PATH: ${{ runner.temp }}/test-report/packages/index.html
          CI_OS: ${{ matrix.description }}

      - name: Run tests (fixtures)
        if: steps.changes.outputs.everything_but_markdown == 'true' && matrix.suite == 'fixtures'
        # Browser Run fixture is disabled on Ubuntu because of https://pptr.dev/troubleshooting#issues-with-apparmor-on-ubuntu
        # Since the dev registry is now file-based (not network-based), fixture tests can safely run in parallel.
        # Concurrency is capped at 2 to avoid CPU starvation on CI runners when multiple fixtures
        # spawn workerd processes simultaneously (Windows runners are especially slow under load).
        run: pnpm run test:ci --concurrency=2 --log-order=stream --filter="./fixtures/*" ${{ matrix.os == 'ubuntu-latest' && '--filter="!./fixtures/browser-run"' || '' }}
        env:
          NODE_OPTIONS: "--max_old_space_size=8192"
          WRANGLER_LOG_PATH: ${{ runner.temp }}/wrangler-debug-logs/
          TEST_REPORT_PATH: ${{ runner.temp }}/test-report/index.html
          CI_OS: ${{ matrix.description }}

      - name: Upload turbo logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: turbo-runs-${{ matrix.os }}-${{ matrix.suite }}
          path: .turbo/runs