Runtime verification

name: Warpway verify
run-name: 'Warpway verify ${{ inputs.profile }} [${{ inputs.correlation_id }}]'

on:
  workflow_dispatch:
    inputs:
      profile:
        description: Approved verification profile to run
        required: true
        type: string
      sha:
        description: Full commit SHA to check out and verify
        required: true
        type: string
      correlation_id:
        description: Warpway correlation id (names the result artifact)
        required: true
        type: string
      review_run_id:
        description: Warpway review run id
        required: true
        type: string

permissions:
  contents: read

jobs:
  verify:
    name: Verify ${{ inputs.profile }}
    runs-on: ubuntu-latest
    timeout-minutes: 45
    defaults:
      run:
        shell: bash
    env:
      WARPWAY_PROFILE: ${{ inputs.profile }}
      WARPWAY_SHA: ${{ inputs.sha }}
      WARPWAY_CORRELATION_ID: ${{ inputs.correlation_id }}
      WARPWAY_REVIEW_RUN_ID: ${{ inputs.review_run_id }}
    steps:
      - name: Validate inputs
        id: validate
        run: |
          fail() { echo "::error::$1"; exit 1; }
          [[ "$WARPWAY_SHA" =~ ^[0-9a-f]{40}$ ]] || fail "Input sha must be a full 40-character lowercase commit SHA."
          [[ "$WARPWAY_CORRELATION_ID" =~ ^[A-Za-z0-9][A-Za-z0-9_-]{7,63}$ ]] || fail "Input correlation_id is malformed."
          [[ "$WARPWAY_PROFILE" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$ ]] || fail "Input profile is malformed."
          [[ "$WARPWAY_REVIEW_RUN_ID" =~ ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ ]] || fail "Input review_run_id is malformed."
          echo "started_at=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"

      - name: Check out the requested commit
        id: checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.sha }}
          persist-credentials: false

      - name: Verify the checked-out commit
        id: verify_sha
        run: |
          actual="$(git rev-parse HEAD)"
          if [ "$actual" != "$WARPWAY_SHA" ]; then
            echo "::error::The checked-out commit does not match the requested SHA."
            exit 1
          fi

      - name: Run approved profile
        id: profile
        timeout-minutes: 30
        env:
          # Approved commands, one per profile. Edit them through a normal pull request. Commands must not
          # contain GitHub expressions; read inputs from the WARPWAY_* environment variables instead.
          WARPWAY_COMMAND_UNIT: |-
            npm ci
            npm test
          WARPWAY_COMMAND_INTEGRATION: |-
            npm ci
            npm run test:integration
        run: |
          case "$WARPWAY_PROFILE" in
            unit) profile_command="$WARPWAY_COMMAND_UNIT" ;;
            integration) profile_command="$WARPWAY_COMMAND_INTEGRATION" ;;
            *)
              echo "approved=false" >> "$GITHUB_OUTPUT"
              echo "::error::The requested profile is not approved in this workflow."
              exit 64
              ;;
          esac
          echo "approved=true" >> "$GITHUB_OUTPUT"
          export WARPWAY_REPORT="$RUNNER_TEMP/warpway-report.json"
          rm -f "$WARPWAY_REPORT"
          set +e
          bash --noprofile --norc -eo pipefail -c "$profile_command"
          status=$?
          set -e
          echo "exit_code=$status" >> "$GITHUB_OUTPUT"
          exit "$status"

      - name: Write warpway-result.json
        if: always() && steps.validate.outcome == 'success'
        env:
          WARPWAY_STARTED_AT: ${{ steps.validate.outputs.started_at }}
          WARPWAY_CHECKOUT_OUTCOME: ${{ steps.checkout.outcome }}
          WARPWAY_VERIFY_OUTCOME: ${{ steps.verify_sha.outcome }}
          WARPWAY_PROFILE_OUTCOME: ${{ steps.profile.outcome }}
          WARPWAY_PROFILE_APPROVED: ${{ steps.profile.outputs.approved }}
          WARPWAY_EXIT_CODE: ${{ steps.profile.outputs.exit_code }}
        run: |
          : "${RUNNER_TEMP:?RUNNER_TEMP is not set}"
          result_dir="$RUNNER_TEMP/warpway-result"
          rm -rf "$result_dir"
          mkdir -p "$result_dir"
          result="$result_dir/warpway-result.json"
          finished_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          started_at="$WARPWAY_STARTED_AT"
          if ! [[ "$started_at" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]]; then started_at="$finished_at"; fi
          exit_code="$WARPWAY_EXIT_CODE"
          if ! [[ "$exit_code" =~ ^[0-9]{1,3}$ ]]; then exit_code=""; fi
          failures="[]"
          if [ "$WARPWAY_CHECKOUT_OUTCOME" != "success" ] || [ "$WARPWAY_VERIFY_OUTCOME" != "success" ]; then
            status="error"
            summary="Could not check out and verify commit $WARPWAY_SHA."
          elif [ "$WARPWAY_PROFILE_APPROVED" != "true" ]; then
            status="error"
            summary="Profile $WARPWAY_PROFILE is not approved in this workflow."
          elif [ "$WARPWAY_PROFILE_OUTCOME" = "success" ] && [ "$exit_code" = "0" ]; then
            status="passed"
            summary="Profile $WARPWAY_PROFILE passed."
          elif [ "$WARPWAY_PROFILE_OUTCOME" = "failure" ] && [ -n "$exit_code" ]; then
            status="failed"
            summary="Profile $WARPWAY_PROFILE failed with exit code $exit_code."
            failures="[{\"name\":\"$WARPWAY_PROFILE\",\"message\":\"Command exited with code $exit_code.\"}]"
          else
            status="error"
            summary="Profile $WARPWAY_PROFILE did not finish (it was cancelled or timed out)."
          fi
          exit_field=""
          if [ -n "$exit_code" ]; then exit_field=",\"exitCode\":$exit_code"; fi
          printf '{"schemaVersion":1,"profile":"%s","sha":"%s","correlationId":"%s","reviewRunId":"%s","status":"%s","summary":"%s","tests":{"passed":0,"failed":0,"skipped":0},"failures":%s,"startedAt":"%s","finishedAt":"%s"%s}\n' \
            "$WARPWAY_PROFILE" "$WARPWAY_SHA" "$WARPWAY_CORRELATION_ID" "$WARPWAY_REVIEW_RUN_ID" "$status" "$summary" \
            "$failures" "$started_at" "$finished_at" "$exit_field" > "$result"
          report="$RUNNER_TEMP/warpway-report.json"
          if [ -f "$report" ]; then
            merge='
          def count: if type == "number" and . >= 0 and . < 1000000000 then floor else 0 end;
          def text($n): (if type == "string" then . else tostring end) | .[0:$n];
          $report[0] as $r
          | if ($r | type) != "object" then error("the report must be a JSON object") else . end
          | if ($r.tests | type) == "object" then
              .tests = { passed: ($r.tests.passed | count), failed: ($r.tests.failed | count), skipped: ($r.tests.skipped | count) }
            else . end
          | if ($r.failures | type) == "array" and ($r.failures | length) > 0 then
              .failures = [ $r.failures[0:50][] | select(type == "object")
                | { name: ((.name // "unnamed") | text(200)), message: ((.message // "") | text(2000)) }
                  + (if (.file | type) == "string" and (.file | length) > 0 then { file: (.file | text(300)) } else {} end)
                  + (if (.line | type) == "number" and .line >= 1 and .line < 100000000 then { line: (.line | floor) } else {} end) ]
            else . end
            '
            if ! command -v jq > /dev/null 2>&1; then
              echo "::warning::The test report was ignored because jq is not installed on this runner."
            elif [ "$(wc -c < "$report" | tr -d ' ')" -gt 1048576 ]; then
              echo "::warning::The test report was ignored because it is larger than 1 MiB."
            elif jq -c --slurpfile report "$report" "$merge" "$result" > "$result.tmp" 2> /dev/null; then
              mv "$result.tmp" "$result"
            else
              rm -f "$result.tmp"
              echo "::warning::The test report was ignored because it is not a JSON object in the documented format."
            fi
          fi
          echo "Warpway result: $status"

      - name: Upload the result
        if: always() && steps.validate.outcome == 'success'
        uses: actions/upload-artifact@v4
        with:
          name: warpway-result-${{ inputs.correlation_id }}
          path: ${{ runner.temp }}/warpway-result/warpway-result.json
          retention-days: 7
          if-no-files-found: error
          overwrite: true

{
  "tests": { "passed": 120, "failed": 1, "skipped": 3 },
  "failures": [{ "name": "rejects expired tokens", "message": "expected 401", "file": "src/auth.test.ts", "line": 42 }]
}

version: 1
runtime:
  profiles:
    unit:
      workflow: warpway-verify.yml
      input: unit
      timeout_minutes: 20
      required_for_lenses:
        - testing
    integration:
      workflow: warpway-verify.yml
      input: integration
      timeout_minutes: 30
      required_for_lenses:
        - testing
      run_when:
        paths:
          - services/**