/.github/workflows/run-tests.yml

name: Compile and run tests

permissions: read-all

on:
  merge_group:
  push:
    branches:
      - main
  pull_request:

jobs:
  run-tests:
    name: Tests on ${{ matrix.os }} with node ${{ matrix.node }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - windows-latest
          - macos-latest
        node:
          - 20
          - 22
          - 23
          - 24
    steps:
      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 2

      - name: Set up Node.js
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          cache: npm
          node-version: 22 # build works only with 22+.

      - name: Install dependencies
        shell: bash
        run: npm ci

      - name: Build
        run: npm run bundle
        env:
          NODE_OPTIONS: '--max_old_space_size=4096'

      - name: Set up Node.js
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          cache: npm
          node-version: ${{ matrix.node }}

      - name: Disable AppArmor
        if: ${{ matrix.os == 'ubuntu-latest' }}
        shell: bash
        run: echo 0 | sudo tee /proc/sys/kernel/apparmor_restrict_unprivileged_userns

      - name: Run tests
        shell: bash
        # Retry tests if they fail in the merge queue.
        run: npm run test:no-build -- ${{ github.event_name == 'merge_group' && '--retry' || '' }}

  # Gating job for branch protection.
  test-success:
    name: '[Required] Tests passed'
    runs-on: ubuntu-latest
    needs: run-tests
    if: ${{ !cancelled() }}
    steps:
      - if: ${{ needs.run-tests.result != 'success' }}
        run: 'exit 1'
      - run: 'exit 0'