test-suite.yml

name: Test Suite
on:
  workflow_dispatch:
  push:
    branches:
      - main
      - kyoto
  pull_request:
    branches:
      - main
      - kyoto

concurrency:
  group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && github.run_id || github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  PANDOC_VERSION: "3.12.1"
  # Typst — the Pandoc-hybrid typst leg's `L`-tier tests (typst_compile.rs)
  # require a real `typst` binary on PATH (TYPST_VERSION_FLOOR is 0.8+).
  TYPST_VERSION: "0.15.1"
  CARGO_INCREMENTAL: "0"
  CARGO_TERM_COLOR: always

jobs:
  test-suite:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    
    name: Run test suite
    if: github.repository == 'quarto-dev/q2'
    
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v6

      # Fix mtimes IMMEDIATELY after checkout, before anything else
      - name: Restore file modification times
        shell: bash
        run: |
          git ls-files | while read file; do
            time=$(git log -1 --format='@%ct' -- "$file" 2>/dev/null || echo '@0')
            [ "$time" != "@0" ] && touch -d "$time" "$file" 2>/dev/null || true
          done

      - name: Set up Homebrew
        if: runner.os == 'macOS'
        id: set-up-homebrew
        uses: Homebrew/actions/setup-homebrew@main

      # Consistent Rust setup for both platforms: install the toolchain pinned
      # in rust-toolchain.toml, the only one the build uses, and remove the
      # rest. rust-cache hashes every installed toolchain into its key, so an
      # unused stable on the runner image changed the key and missed the cache
      # (bd-ejomahfu). Don't use add-rust-environment-hash-key: false for this:
      # it also drops the lockfile hash, and the cache then never updates.
      - name: Set up pinned Rust toolchain
        shell: bash
        run: |
          rustup toolchain install --no-self-update
          active=$(rustup show active-toolchain | cut -d' ' -f1)
          for t in $(rustup toolchain list | cut -d' ' -f1); do
            [ "$t" = "$active" ] || rustup toolchain uninstall "$t"
          done
          rustup --version
          rustc --version

      # Cache Rust AFTER toolchain is set up
      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
          # cache-bin: false avoids clobbering the freshly-installed
          # ~/.cargo/bin/{cargo,rustup,...} with stale proxies from a
          # previous run. Intermittently broke macOS CI on 2026-05-14
          # with `cargo xtask … → rustup-init: unexpected argument`.
          # cargo-nextest / cargo-insta re-install via taiki-e/install-
          # action's prebuilts each run, which is cheap (~1-2s).
          cache-bin: false
          shared-key: "rust-test-suite"

      # Cache cargo-nextest and insta separately to avoid reinstalling
      - name: Install nextest
        uses: taiki-e/install-action@nextest

      - name: Install cargo-insta
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-insta

      # Pandoc setup (pinned to match Quarto 1.9)
      - name: Set up Pandoc (Linux)
        if: runner.os == 'Linux'
        run: |
          curl -LO "https://github.com/jgm/pandoc/releases/download/${PANDOC_VERSION}/pandoc-${PANDOC_VERSION}-1-amd64.deb"
          sudo dpkg -i "pandoc-${PANDOC_VERSION}-1-amd64.deb"
        shell: bash

      - name: Set up Pandoc (macOS)
        if: runner.os == 'macOS'
        run: |
          curl -LO "https://github.com/jgm/pandoc/releases/download/${PANDOC_VERSION}/pandoc-${PANDOC_VERSION}-arm64-macOS.pkg"
          sudo installer -pkg "pandoc-${PANDOC_VERSION}-arm64-macOS.pkg" -target /
        shell: bash

      # Typst setup — the docx/pptx Pandoc-hybrid leg also has a typst
      # backend whose `L`-tier tests require a real binary (see TYPST_VERSION above).
      - name: Set up Typst (Linux)
        if: runner.os == 'Linux'
        run: |
          curl -LO "https://github.com/typst/typst/releases/download/v${TYPST_VERSION}/typst-x86_64-unknown-linux-musl.tar.xz"
          tar -xf "typst-x86_64-unknown-linux-musl.tar.xz"
          sudo mv "typst-x86_64-unknown-linux-musl/typst" /usr/local/bin/typst
        shell: bash

      - name: Set up Typst (macOS)
        if: runner.os == 'macOS'
        run: brew install typst
        shell: bash

      # tree-sitter setup
      - name: Set up tree-sitter CLI (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libc6-dev gcc-multilib
          curl -LO https://github.com/tree-sitter/tree-sitter/releases/download/v0.25.8/tree-sitter-linux-x86.gz
          gunzip tree-sitter-linux-x86.gz
          chmod +x tree-sitter-linux-x86
          sudo mv tree-sitter-linux-x86 /usr/local/bin/tree-sitter
    
      - name: Set up tree-sitter CLI (macOS)
        if: runner.os == 'macOS'
        run: brew install tree-sitter-cli

      # The installer test suite (crates/quarto/tests/integration/
      # bootstrap_sh.rs) REQUIRES minisign — signature verification is
      # part of the release-artifact contract and absence fails loudly
      # rather than skipping (bd-c6l13j79).
      - name: Set up minisign (Linux)
        if: runner.os == 'Linux'
        run: sudo apt-get install -y minisign

      - name: Set up minisign (macOS)
        if: runner.os == 'macOS'
        run: brew install minisign

      # Free disk space on Linux runners (14 GB SSD is tight for Rust monorepo).
      # `remove_tool_cache: true` is safe — no step in this job uses /opt/hostedtoolcache/
      # (setup-node runs after this step). See claude-notes/2026-04-28-ci-disk-space-and-profile-ci.md.
      - name: Free disk space
        if: runner.os == 'Linux'
        uses: endersonmenezes/free-disk-space@7901478139cff6e9d44df5972fd8ab8fcade4db1 # v3
        with:
          remove_android: true
          remove_dotnet: true
          remove_haskell: true
          remove_tool_cache: true

      - name: Prune Docker images
        if: runner.os == 'Linux'
        shell: bash
        run: |
          sudo docker image prune --all --force
          sudo docker builder prune -a --force

      # Node 24 + `npm ci`: `q2 call build-ts-extension` (used by the engine
      # tests to rebuild the hermetic fixture bundles) runs its embedded rollup
      # driver under Node, the engine tests run the bundles under Node, and the
      # TS packages the fixtures import need their npm deps. After "Free disk space" on purpose:
      # that step removes the tool cache setup-node populates.
      - name: Set up Node
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: npm

      - name: Install npm dependencies
        shell: bash
        run: npm ci

      # Formatting gate (before build to fail fast). rustfmt and clippy are
      # orthogonal — clippy can pass on code rustfmt would rewrite — so a fmt
      # check is needed to stop external PRs landing unformatted code. No
      # `rustfmt.toml` in-tree → nightly defaults (the toolchain set up above),
      # matching the local `cargo fmt` post-edit hook. Linux-only: formatting is
      # platform-independent, so running it once is enough.
      - name: Rustfmt (check)
        if: runner.os == 'Linux'
        shell: bash
        run: cargo fmt --all -- --check

      # Custom lint checks (before build to fail fast)
      - name: Run custom lints
        shell: bash
        run: cargo xtask lint
        env:
          # Must match the later xtask steps: RUSTFLAGS is part of cargo's
          # fingerprint, so without it they build xtask a second time.
          RUSTFLAGS: "-D warnings"

      # Clippy gate: the workspace clippy policy lives in the root Cargo.toml
      # `[workspace.lints.clippy]` table (architectural lints allowed, the rest
      # warned); `-D warnings` makes any remaining lint a hard failure. Keep
      # this green by fixing lints or adding a justified `#[allow]`.
      - name: Clippy (deny warnings)
        shell: bash
        run: cargo clippy --workspace --all-targets --profile ci -- -D warnings
        env:
          RUSTFLAGS: "-D warnings"

      # The wasm crates build pampa with `default-features = false` outside
      # the workspace, so neither Clippy nor the tests compile their feature
      # sets. This checks pampa natively under every such set (derived from
      # the consumers' manifests), so a feature-gating mistake fails here
      # instead of in the nightly/release wasm build (bd-yt3x1gwk).
      - name: Check pampa consumer feature sets
        shell: bash
        run: cargo xtask check-feature-sets --profile ci
        env:
          RUSTFLAGS: "-D warnings"

      - name: Test block tree-sitter grammar
        shell: bash
        run: |
          cd crates/tree-sitter-qmd/tree-sitter-markdown
          tree-sitter test

      # `ci` profile + `--tests` makes a separate `cargo build` redundant.
      # `--tests` (not `--all-targets`) excludes benches — `quarto-yaml` declares
      # `harness = false` benches that nextest can't enumerate as tests.
      # See claude-notes/2026-04-28-ci-disk-space-and-profile-ci.md.
      - name: Test Rust code
        shell: bash
        run: cargo nextest run --tests --cargo-profile ci
        env:
          RUSTFLAGS: "-D warnings"
          # Turns the silent Node-skip in node_available_when_quarto_ci (and the
          # node_available_for_tests() gates) into a hard failure if the
          # "Set up Node" step above regresses.
          QUARTO_CI: "1"

      # Cross-uid UDS accept-check test (bd-m49e3s5o): the peer-uid
      # rejection test re-execs the integration binary as `nobody`, so it
      # needs root. Reuse the already-built test binary (no rebuild —
      # root-owned files in target/ would break later steps) and run just
      # this test under sudo with the gate enabled; it skips loudly
      # everywhere else. jq extracts the binary's path from cargo's
      # --no-run artifact output. Select the same targets as nextest above:
      # `-p quarto-hub` resolves dependency features differently, which
      # recompiles part of the tree.
      - name: Test UDS cross-uid accept check (root)
        if: matrix.os == 'ubuntu-latest'
        shell: bash
        env:
          RUSTFLAGS: "-D warnings"
        run: |
          # The JSON stream carries every crate's artifacts — select
          # quarto-hub's integration test binary by manifest and target name,
          # or sudo runs the wrong binary and fails on --exact.
          BIN=$(cargo test --tests --profile ci --no-run --message-format json \
            | jq -rs '[.[] | select(.executable != null and .target.name == "integration" and (.manifest_path | endswith("/crates/quarto-hub/Cargo.toml")))] | .[0].executable // empty')
          test -n "$BIN" || { echo "integration test binary not found" >&2; exit 1; }
          sudo Q2_TEST_SETUID=1 "$BIN" --exact uds_server::unix_imp::peer_cred_other_uid_rejected_unless_allowlisted --nocapture

      # claude-notes/ is a Quarto 2 website (claude-notes/_quarto.yml; epic
      # bd-uk8zgkha), brought to a clean render in PR #807. This keeps it
      # there (bd-7v3trpxn): `--strict` promotes warnings to errors and
      # exits 1 on any diagnostic, so a note that fails to parse or warns
      # fails the job, with the same report `q2 render` prints locally.
      # Per-document `diagnostics:` opt-outs in front matter are applied
      # before the promotion and stay suppressed.
      #
      # It lives here, after nextest, rather than in its own workflow so
      # the q2 binary is reused: the crates/quarto integration tests run
      # it via CARGO_BIN_EXE_q2, so `--tests --cargo-profile ci` has
      # already built target/ci/q2. Run that binary directly: `cargo run
      # --bin q2` resolves dependency features without the test build's
      # dev-dependencies, which recompiled 135 crates (about 6 min). The
      # render needs nothing on PATH. Built from the branch, it also catches
      # a parser change that breaks the notes — ~1,450 documents of qmd
      # corpus.
      # Linux-only: parsing is platform-independent. `!cancelled()` so a
      # red test does not hide a bad note, or the other way round.
      # Guidance for notes that pass: claude-notes/instructions/writing-notes.md.
      # `cargo xtask verify` runs the same render after its Rust build
      # (bd-zn87vwi8); a test in crates/xtask/src/verify.rs fails if this
      # line's q2 args and verify's CLAUDE_NOTES_RENDER_ARGS diverge. The
      # step fails with "No such file" if nextest could not build q2.
      - name: Render claude-notes (warnings are errors)
        if: runner.os == 'Linux' && !cancelled()
        shell: bash
        run: ./target/ci/q2 render --strict claude-notes

      # A second build must compile nothing. A build script that watches a
      # missing path (or is otherwise always stale) makes every `cargo run
      # --bin q2` rebuild quarto-preview + quarto, which made
      # `build-agents-docs` pay ~16s per example project (GH #870,
      # bd-7xlph6ki). `--tests` selects the same targets as nextest above,
      # so the tree is already built. `cargo xtask verify` runs the check on
      # `--bin q2` after its Rust build.
      - name: Check no-op rebuild of q2
        if: runner.os == 'Linux' && !cancelled()
        shell: bash
        run: cargo xtask check-noop-rebuild --tests --profile ci
        env:
          # Must match the steps above: RUSTFLAGS is part of cargo's
          # fingerprint, so a different value rebuilds the entire tree
          # (836 crates, 12 min, in PR #809) and xtask too.
          RUSTFLAGS: "-D warnings"

  # Windows clippy-only leg (no tests): the same gate as the matrix job's
  # "Clippy (deny warnings)" step, on windows-latest. Compile-only —
  # --all-targets also compiles test code, which is where Unix-only APIs
  # (std::os::unix, OsStringExt::from_vec, ...) and asymmetric #[cfg] gates
  # hide; Linux/macOS clippy cannot see them (.claude/rules/cross-platform.md).
  # Needs none of the matrix job's pandoc/typst/tree-sitter/node setup:
  # verified green on a fresh Windows checkout. A full Windows test leg is
  # deliberately out of scope here.
  windows-clippy:
    name: Clippy (Windows)
    runs-on: windows-latest
    if: github.repository == 'quarto-dev/q2'
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v6

      - name: Set up pinned Rust toolchain
        shell: bash
        run: |
          rustup toolchain install --no-self-update
          active=$(rustup show active-toolchain | cut -d' ' -f1)
          for t in $(rustup toolchain list | cut -d' ' -f1); do
            [ "$t" = "$active" ] || rustup toolchain uninstall "$t"
          done

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true
          # See the matrix job: don't clobber ~/.cargo/bin with stale proxies.
          cache-bin: false
          shared-key: "rust-test-suite"

      - name: Clippy (deny warnings)
        shell: bash
        run: cargo clippy --workspace --all-targets --profile ci -- -D warnings
        env:
          RUSTFLAGS: "-D warnings"

  wasm-tests:
    name: WASM Tests
    runs-on: ubuntu-latest
    # Uses the pinned toolchain from rust-toolchain.toml, which is already a
    # nightly with rust-src (required by -Zbuild-std) and the wasm32 target.
    # Do NOT override with latest nightly: bd-at72 pinned the toolchain because
    # newer nightlies SIGSEGV in LLVM ThinLTO when building this workspace for
    # wasm32-unknown-unknown. (The E0152 duplicate-lang-item conflict between
    # the prebuilt wasm32 sysroot and -Zbuild-std that this job originally
    # worked around no longer reproduces on the pinned toolchain.)
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Set up Clang
        uses: egor-tensin/setup-clang@v1
        with:
          version: latest
          platform: x64

      # See the matrix job: rust-cache hashes every installed toolchain.
      - name: Set up pinned Rust toolchain
        shell: bash
        run: |
          rustup toolchain install --no-self-update
          active=$(rustup show active-toolchain | cut -d' ' -f1)
          for t in $(rustup toolchain list | cut -d' ' -f1); do
            [ "$t" = "$active" ] || rustup toolchain uninstall "$t"
          done

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: rust-wasm-tests

      - name: Install wasm-bindgen-cli
        run: cargo xtask dev-setup

      - name: Run WASM tests
        run: |
          CC_wasm32_unknown_unknown=clang \
          CFLAGS_wasm32_unknown_unknown="-isystem ${{ github.workspace }}/crates/wasm-quarto-hub-client/wasm-sysroot -fno-builtin" \
          cargo test -p pampa --test wasm_lua --target wasm32-unknown-unknown \
            --no-default-features --features lua-filter -Zbuild-std=std,panic_unwind,panic_abort