test.yml

name: Test

# Release-notes PRs (head ref `release-notes/*`) only add markdown under
# `release-notes/` and are published via approval — skip the full CI suite.
on:
  pull_request:
    types:
      - opened
      - synchronize
      - reopened
      - ready_for_review
    branches:
      - develop
  merge_group:
    types:
      - checks_requested
    branches:
      - develop

permissions:
  contents: read
  actions: read

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  check:
    if: |
      !startsWith(github.head_ref, 'release-notes/') &&
      (github.event_name == 'merge_group' ||
        github.event.pull_request.draft == false)
    name: Check code quality
    runs-on: blacksmith-8vcpu-ubuntu-2404
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup
        uses: ./.github/actions/setup
      - name: Setup Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: apps/cli-go/go.mod
          cache-dependency-path: apps/cli-go/go.sum
      - name: Install golangci-lint
        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest &&
          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
      - name: Unlock keyring (for cli-go keyring tests)
        uses: t1m0thyj/unlock-keyring@cbcf205c879ebd86add70bab3a6abfcce59a5cae # v1.2.0

      - name: Check code quality
        run: pnpm run check:all

  test-core:
    if: |
      !startsWith(github.head_ref, 'release-notes/') &&
      (github.event_name == 'merge_group' ||
        github.event.pull_request.draft == false)
    name: Run unit and integration tests
    runs-on: blacksmith-8vcpu-ubuntu-2404
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup
        uses: ./.github/actions/setup
      - name: Setup Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: apps/cli-go/go.mod
          cache-dependency-path: apps/cli-go/go.sum
      - name: Install golangci-lint
        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest &&
          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
      - name: Unlock keyring (for cli-go keyring tests)
        uses: t1m0thyj/unlock-keyring@cbcf205c879ebd86add70bab3a6abfcce59a5cae # v1.2.0

      - name: Run unit and integration tests
        run: pnpm run test:core

  test-e2e:
    if: |
      !startsWith(github.head_ref, 'release-notes/') &&
      (github.event_name == 'merge_group' ||
        github.event.pull_request.draft == false)
    name: Run end-to-end tests (shard ${{ matrix.shard }}/3)
    runs-on: blacksmith-8vcpu-ubuntu-2404
    strategy:
      fail-fast: false
      matrix:
        shard: [ 1, 2, 3 ]
    steps:
      - name: Checkout
        uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1.0.0-beta
        with:
          fetch-depth: 0

      - name: Set base and head SHAs for affected
        if: github.event_name == 'pull_request'
        uses: nrwl/nx-set-shas@afb73a62d26e41464e9254689e1fd6122ee683c1 # v5.0.1

      - name: Set base and head SHAs for merge queue affected
        if: github.event_name == 'merge_group'
        run: |
          echo "NX_BASE=${{ github.event.merge_group.base_sha }}" >> "$GITHUB_ENV"
          echo "NX_HEAD=${{ github.event.merge_group.head_sha }}" >> "$GITHUB_ENV"

      - name: Setup
        uses: ./.github/actions/setup

      # Detect which e2e suites should run. On PR and merge queue runs we
      # honour `nx affected` using the event-specific base and head SHAs.
      - name: Detect affected e2e projects
        id: detect
        run: |
          affected=$(pnpm exec nx show projects --affected --withTarget test:e2e --json | jq -r '.[]')
          echo "Affected e2e projects:"
          echo "$affected"
          cli=false
          other=false
          if echo "$affected" | grep -qx '@supabase/cli-e2e'; then cli=true; fi
          if echo "$affected" | grep -vx '@supabase/cli-e2e' | grep -q .; then other=true; fi
          echo "cli_e2e=$cli" >> "$GITHUB_OUTPUT"
          echo "other=$other" >> "$GITHUB_OUTPUT"

      - name: Cache Go CLI binary
        if: steps.detect.outputs.cli_e2e == 'true'
        id: cache-go-binary
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: apps/cli-go/supabase-go
          key: go-cli-${{ runner.os }}-${{ hashFiles('apps/cli-go/**/*.go',
            'apps/cli-go/go.mod', 'apps/cli-go/go.sum') }}

      - name: Setup Go
        if: steps.detect.outputs.cli_e2e == 'true' &&
          steps.cache-go-binary.outputs.cache-hit != 'true'
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: apps/cli-go/go.mod
          cache-dependency-path: apps/cli-go/go.sum

      - name: Build Go CLI
        if: steps.detect.outputs.cli_e2e == 'true' &&
          steps.cache-go-binary.outputs.cache-hit != 'true'
        run: go build -o supabase-go .
        working-directory: apps/cli-go

      # The ts-legacy/ts-next harnesses invoke `node apps/cli/dist/supabase.js`
      # with `SUPABASE_CLI_BINARY_OVERRIDE` pointing at the compiled per-shell
      # binary in `apps/cli/dist/`. The `nx run @supabase/cli-e2e:test:e2e`
      # target normally builds the supabase umbrella via `dependsOn`, but we
      # bypass nx for sharding so we build it explicitly.
      - name: Build CLI
        if: steps.detect.outputs.cli_e2e == 'true'
        run: pnpm exec nx run supabase:build

      # Sharding for cli-e2e (the heavy suite) per
      # https://vitest.dev/guide/improving-performance.html#sharding.  We invoke
      # vitest directly because routing `--shard` through `pnpm run / nx run-many
      # -- --shard=N/3` introduces a stray `--` that vitest treats as a
      # positional-argument terminator, defeating the shard flag.  Other e2e
      # suites (process-compose) run unsharded on shard 1.
      - name: Run cli-e2e end-to-end tests
        if: steps.detect.outputs.cli_e2e == 'true'
        run: pnpm --filter @supabase/cli-e2e exec bun --bun vitest run --shard=${{
          matrix.shard }}/3
        env:
          CLI_HARNESS_TARGET: ts-legacy
          SUPABASE_GO_BINARY: ${{ github.workspace }}/apps/cli-go/supabase-go

      - name: Run other e2e tests (shard 1 only)
        if: matrix.shard == 1 && steps.detect.outputs.other == 'true'
        run: pnpm exec nx run-many -t test:e2e --exclude=@supabase/cli-e2e
        env:
          SUPABASE_GO_BINARY: ${{ github.workspace }}/apps/cli-go/supabase-go

  # Summary job that gates branch protection.  The matrix `test-e2e` job
  # produces per-shard check names (`Run end-to-end tests (shard N/3)`), so
  # this job preserves the original `Run end-to-end tests` check name that
  # branch protection rules already require.  It succeeds iff every shard
  # succeeded (or skipped — `success()` is true for skipped jobs).
  test-e2e-summary:
    if: |
      always() &&
      !startsWith(github.head_ref, 'release-notes/') &&
      (github.event_name == 'merge_group' ||
        github.event.pull_request.draft == false)
    name: Run end-to-end tests
    needs: test-e2e
    runs-on: ubuntu-latest
    steps:
      - name: Verify all shards succeeded
        run: |
          if [ "${{ needs.test-e2e.result }}" = "failure" ] || [ "${{ needs.test-e2e.result }}" = "cancelled" ]; then
            echo "::error ::One or more e2e shards failed: ${{ needs.test-e2e.result }}"
            exit 1
          fi
          echo "All e2e shards reported: ${{ needs.test-e2e.result }}"