name: Cloud Tests

# Runs cloud's lint/typecheck/unit/integration/playwright suite when cloud-* packages or tests change.
# Source: cloud/.github/workflows/tests.yml in the original elizaOS/cloud repo.

on:
  workflow_dispatch:
  pull_request:
    branches: [develop, main]
    paths:
      - ".github/actions/cloud-setup-test-env/**"
      - ".github/workflows/cloud-tests.yml"
      - "packages/cloud/api/**"
      - "packages/cloud/shared/**"
      - "packages/cloud/sdk/**"
      - "packages/cloud/services/**"
      - "packages/cloud/routing/**"
      - "packages/cloud/infra/**"
      - "packages/scripts/cloud/**"
      - "packages/scripts/test-cloud-run.mjs"
      - "packages/scripts/test-cloud-run-helpers.mjs"
      - "packages/scripts/test-cloud-run-flush.self-test.mjs"
      - "packages/scripts/test-cloud-run-helpers.self-test.mjs"
      - "package.json"
      - "bun.lock"
      - ".github/workflows/cloud-tests.yml"
      - ".github/actions/cloud-setup-test-env/**"
  push:
    branches: [develop, main]
    paths:
      - "packages/cloud/api/**"
      - "packages/cloud/shared/**"
      - "packages/cloud/sdk/**"
      - "packages/cloud/services/**"
      - "packages/cloud/routing/**"
      - "packages/cloud/infra/**"
      - "packages/scripts/cloud/**"
      - "packages/scripts/test-cloud-run.mjs"
      - "packages/scripts/test-cloud-run-helpers.mjs"
      - "packages/scripts/test-cloud-run-flush.self-test.mjs"
      - "packages/scripts/test-cloud-run-helpers.self-test.mjs"
      - "package.json"
      - "bun.lock"
      - ".github/workflows/cloud-tests.yml"
      - ".github/actions/cloud-setup-test-env/**"

# CI fan-out fix: the PR-scoped concurrency from #14069 fell back to
# github.run_id on push, so every develop push got a unique group and
# nothing ever superseded. A 37-merge wave queued thousands of push runs
# and starved the self-hosted fleet. Fall back to github.ref (all develop
# pushes share a group) and cancel superseded runs on push too. PR behavior
# is unchanged (pull_request.number still wins the key); merge_group and
# schedule events are not in the cancel set, so the merge queue and nightly
# runs always complete.
concurrency:
  group: cloud-tests-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}

env:
  DATABASE_URL: postgresql://postgres@127.0.0.1:5432/postgres
  TEST_DATABASE_URL: postgresql://postgres@127.0.0.1:5432/postgres
  CACHE_BACKEND: wadis
  CACHE_ENABLED: "false"
  NODE_OPTIONS: --max-old-space-size=4096

# Default to least privilege. Override per-job where needed.
permissions:
  contents: read

jobs:
  lint-and-types:
    runs-on: ${{ fromJSON(vars.HETZNER_FLEET_ONLINE == 'false' && '["ubuntu-24.04"]' || '["self-hosted","hetzner-robot"]') }}
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
      - uses: ./.github/actions/cloud-setup-test-env
      - name: Lint and typecheck cloud workspaces
        run: bun run verify:cloud

      - name: Tenant-scope gate (no unscoped pk-only reads of apps data-plane) (#9853)
        run: bun run --cwd packages/cloud/shared check:tenant-scope

  # NOTE: the Worker bundle stub-drift gate (#14422) runs inside
  # `lint-and-types` above — packages/cloud/api chains `check:worker-bundle`
  # (wrangler deploy --dry-run) into its `typecheck`, so `verify:cloud` covers
  # it. Do not re-add a standalone dry-run job: #14474 + #14504 briefly ran it
  # twice per PR on the saturated runner fleet.

  unit-tests:
    runs-on: ${{ fromJSON(vars.HETZNER_FLEET_ONLINE == 'false' && '["ubuntu-24.04"]' || '["self-hosted","hetzner-robot"]') }}
    # Cloud unit tests can run past 25m on saturated self-hosted runners while still passing.
    timeout-minutes: 40
    env:
      NODE_ENV: test
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
      - uses: ./.github/actions/cloud-setup-test-env
      # Guards the batch runner's output-flush contract: a failing batch must
      # surface its diagnostic instead of being swallowed by a process.exit()
      # that truncates buffered stdout (the #16062 silent exit-1 regression).
      - name: Batch runner flush-integrity self-test
        run: node packages/scripts/test-cloud-run-flush.self-test.mjs
      - name: Batch runner helper self-test
        run: node packages/scripts/test-cloud-run-helpers.self-test.mjs
      - name: Run cloud unit tests
        run: bun run test:cloud

      # The bun `test:cloud` lane skips suites that need the Vitest-only module
      # mock API (`vi.mock` + `vi.importActual`) — see `SUPPORTS_VITEST_MOCK_API`.
      # Run those under Vitest here so the direct-wallet payer/state-machine proof
      # (33 tests, in-process PGlite) actually executes instead of vacuously
      # skipping. Uses pglite://memory — no DB service required.
      - name: Run cloud vitest-only suites
        run: bun run --cwd packages/cloud/shared test:vitest

  integration-tests:
    runs-on: ${{ fromJSON(vars.HETZNER_FLEET_ONLINE == 'false' && '["ubuntu-24.04"]' || '["self-hosted","hetzner-robot"]') }}
    timeout-minutes: 25
    env:
      NODE_ENV: test
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
      - uses: ./.github/actions/cloud-setup-test-env
        with:
          setup-db: "true"
          db-backend: "pglite"
      - name: Run cloud integration tests
        run: bun run test:cloud:integration

  e2e-tests:
    runs-on: ${{ fromJSON(vars.HETZNER_FLEET_ONLINE == 'false' && '["ubuntu-24.04"]' || '["self-hosted","hetzner-robot"]') }}
    timeout-minutes: 35
    needs: [lint-and-types]
    env:
      NODE_ENV: test
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
      - uses: ./.github/actions/cloud-setup-test-env
        with:
          setup-db: "true"
      - name: Run cloud e2e tests
        run: bun run test:cloud:e2e