phpunit-feature.yml

name: PHPUnit Feature

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:
    inputs:
      corpus_base_ref:
        description: Full Git commit SHA to classify regression-corpus changes against
        required: true
        type: string

permissions:
  contents: read

jobs:
  structural:
    name: Candidate structure
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - name: Checkout server
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Validate release recovery tooling
        run: |
          python -m py_compile \
            scripts/ci/component-release-recovery.py \
            scripts/ci/release_recovery_consumer_conformance.py \
            scripts/ci/test-component-release-recovery.py
          arguments=()
          if [ -n "$CONFORMANCE_BASE_REF" ]; then
            arguments+=(--previous-ref "$CONFORMANCE_BASE_REF")
          fi
          python scripts/ci/release_recovery_consumer_conformance.py \
            --contract scripts/ci/release-recovery-consumer-contract.json \
            --adapter scripts/ci/release-recovery-consumer-adapter.json \
            "${arguments[@]}"
          python scripts/ci/test-component-release-recovery.py \
            ConsumerContractIdentityRegressionTest
        env:
          CONFORMANCE_BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}

      - name: Require durable codec evidence
        env:
          CORPUS_BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'push' && github.event.before || inputs.corpus_base_ref }}
        run: |
          set -euo pipefail
          if [[ ! "$CORPUS_BASE_REF" =~ ^[0-9a-f]{40}$ ]] || [[ "$CORPUS_BASE_REF" =~ ^0+$ ]]; then
            echo "Invalid regression corpus base revision: $CORPUS_BASE_REF" >&2
            exit 1
          fi
          git rev-parse --verify "$CORPUS_BASE_REF^{commit}"
          python scripts/ci/validate-regression-corpus.py --base-ref "$CORPUS_BASE_REF"

      - name: Prove corpus policy guards cannot be weakened
        run: python scripts/ci/test-regression-corpus-policy.py

  feature:
    name: PHPUnit feature suite
    if: ${{ github.server_url == 'https://github.com' }}
    runs-on: ubuntu-latest
    timeout-minutes: 25

    steps:
      - name: Checkout server
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Checkout workflow package from GitHub
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          repository: durable-workflow/workflow
          ref: dc7b98ebf811f30fcf43e1f1c7b66021a10878d0
          path: workflow-package
          persist-credentials: false

      - name: Verify workflow package source provenance
        shell: bash
        env:
          WORKFLOW_PACKAGE_REF: 2.0.0-rc.8
          WORKFLOW_PACKAGE_COMMIT: dc7b98ebf811f30fcf43e1f1c7b66021a10878d0
        run: |
          set -euo pipefail
          resolved_commit="$(git -C workflow-package rev-parse HEAD)"
          if [[ "$resolved_commit" != "$WORKFLOW_PACKAGE_COMMIT" ]]; then
            echo "Resolved Workflow commit $resolved_commit does not match $WORKFLOW_PACKAGE_COMMIT" >&2
            exit 1
          fi
          printf '%s\n' \
            'https://github.com/durable-workflow/workflow.git' \
            "$WORKFLOW_PACKAGE_REF" \
            "$resolved_commit" \
            > workflow-package/.package-provenance
          rm -rf workflow-package/.git

      - name: Run feature, Nexus, and regression corpus suites
        shell: bash
        env:
          CORPUS_BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'push' && github.event.before || inputs.corpus_base_ref }}
        run: |
          set -euo pipefail
          if [[ ! "$CORPUS_BASE_REF" =~ ^[0-9a-f]{40}$ ]] || [[ "$CORPUS_BASE_REF" =~ ^0+$ ]]; then
            echo "Invalid regression corpus base revision: $CORPUS_BASE_REF" >&2
            exit 1
          fi
          docker build --target base -t durable-workflow-server-phpunit-base .
          docker build -t durable-workflow-server-corpus-validator - <<'DOCKERFILE'
          FROM durable-workflow-server-phpunit-base
          RUN apt-get update \
              && apt-get install -y --no-install-recommends git \
              && rm -rf /var/lib/apt/lists/*
          DOCKERFILE
          tar \
            --exclude=vendor \
            --exclude='*/vendor' \
            --exclude=build \
            --exclude='*/build' \
            -cf - . \
            | docker run --rm -i -e CORPUS_BASE_REF -w /app --entrypoint sh durable-workflow-server-corpus-validator \
                -lc 'set -eu; tar --no-same-owner -xf - -C /app; cp -a /app/workflow-package /workflow; composer install --no-interaction --no-progress --prefer-dist; git --version; vendor/bin/phpunit --version; git rev-parse --verify "$CORPUS_BASE_REF^{commit}"; vendor/bin/phpunit tests/Feature tests/Unit/NexusContractTest.php tests/Unit/CodecRegressionCorpusTest.php tests/Unit/PhpunitFeatureWorkflowContractTest.php --no-progress --colors=never; python3 scripts/ci/validate-regression-corpus.py --base-ref "$CORPUS_BASE_REF" --verify-counterfactual'

  qualification:
    name: Feature source qualification
    needs: [structural, feature]
    if: ${{ always() }}
    runs-on: ubuntu-latest
    timeout-minutes: 2

    steps:
      - name: Require the intended qualification route
        env:
          ACTIONS_SERVER_URL: ${{ github.server_url }}
          STRUCTURAL_RESULT: ${{ needs.structural.result }}
          FEATURE_RESULT: ${{ needs.feature.result }}
        run: |
          set -euo pipefail
          test "$STRUCTURAL_RESULT" = success
          if [[ "$ACTIONS_SERVER_URL" == "https://github.com" ]]; then
            test "$FEATURE_RESULT" = success
            echo "Complete GitHub feature and Nexus contract qualification succeeded."
          else
            test "$FEATURE_RESULT" = skipped
            echo "Focused candidate structure qualification succeeded."
          fi