_python-react-tests.yml

name: Reusable Python+React Test Suite

# Internal building block: the backend/frontend/e2e/api-freshness matrix
# shared by python-react-ci.yml and python-react-publish.yml. Consumers
# don't call this directly — the CI and publish workflows wrap it. The
# leading underscore marks it internal.
#
# python-react-ci.yml and python-react-publish.yml call this with a full
# owner/repo path pinned to their own release tag, NOT a `./` local path:
# a `./` reference inside a cross-repo-called reusable workflow resolves
# against the CONSUMER's repository (no such file) and 0s startup_failures.
# That @ref must be bumped on every release to stay in lockstep.

on:
  workflow_call:
    inputs:
      python-version:
        type: string
        default: "3.14"
      bun-version-file:
        type: string
        default: ".bun-version"
      bun-version:
        # Escape hatch — leave empty to use bun-version-file.
        type: string
        default: ""
      enable-e2e:
        type: boolean
        default: true
      enable-translations:
        type: boolean
        default: false
      enable-bootstrap-token:
        type: boolean
        default: false
      enable-api-freshness-check:
        type: boolean
        default: true
      runner-os:
        type: string
        default: ubuntu-latest
      security-tripwire-script:
        type: string
        default: ""

permissions:
  contents: read

jobs:
  test-backend:
    name: Backend Tests
    runs-on: ${{ inputs.runner-os }}
    timeout-minutes: 25

    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: ${{ inputs.python-version }}

      - name: Install uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8
        with:
          enable-cache: true
          cache-dependency-glob: 'backend/uv.lock'

      - name: Install dependencies
        run: |
          cd backend
          uv sync --frozen --all-extras

      - name: Run ruff linter
        run: cd backend && uv run ruff check .

      - name: Run ruff formatter check
        run: cd backend && uv run ruff format --check .

      - name: Run pyright type checking
        run: cd backend && PYTHONPATH=. uv run pyright

      - name: Security tripwire
        if: inputs.security-tripwire-script != ''
        run: bash "${{ inputs.security-tripwire-script }}"

      - name: Run pytest
        run: |
          cd backend
          timeout 20m uv run pytest tests/ -v --tb=short

  test-frontend:
    name: Frontend Tests
    runs-on: ${{ inputs.runner-os }}
    timeout-minutes: 15

    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Set up Bun (from version-file)
        if: inputs.bun-version == ''
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version-file: ${{ inputs.bun-version-file }}

      - name: Set up Bun (from explicit override)
        if: inputs.bun-version != ''
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: ${{ inputs.bun-version }}

      - name: Install dependencies
        run: |
          cd frontend
          if [ "$GITHUB_ACTOR" = "dependabot[bot]" ]; then bun install; else bun install --frozen-lockfile; fi

      - name: Run TypeScript type checking
        run: cd frontend && bun run type-check

      - name: Run linter
        run: cd frontend && bun run lint

      - name: Validate translation keys
        if: inputs.enable-translations
        run: cd frontend && bun run validate:translations

      - name: Run tests
        run: cd frontend && bun run test:run

  test-e2e:
    name: E2E Tests
    if: inputs.enable-e2e
    runs-on: ${{ inputs.runner-os }}
    timeout-minutes: 20
    needs: [test-backend, test-frontend]

    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: ${{ inputs.python-version }}

      - name: Install uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8
        with:
          enable-cache: true
          cache-dependency-glob: 'backend/uv.lock'

      - name: Install backend dependencies
        run: cd backend && uv sync --frozen --all-extras

      - name: Set up Bun (from version-file)
        if: inputs.bun-version == ''
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version-file: ${{ inputs.bun-version-file }}

      - name: Set up Bun (from explicit override)
        if: inputs.bun-version != ''
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: ${{ inputs.bun-version }}

      - name: Install frontend dependencies
        run: |
          cd frontend
          if [ "$GITHUB_ACTOR" = "dependabot[bot]" ]; then bun install; else bun install --frozen-lockfile; fi

      - name: Install Playwright browsers
        run: cd frontend && bunx playwright install chromium --with-deps

      - name: Run E2E tests
        run: cd frontend && bun run e2e
        env:
          CI: true
          VULNFORGE_BOOTSTRAP_TOKEN: ${{ inputs.enable-bootstrap-token && 'e2e-ci-test-token' || '' }}

      - name: Upload Playwright report
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: ${{ !cancelled() }}
        with:
          name: playwright-report
          path: frontend/playwright-report/
          retention-days: 14

      - name: Upload test results
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: ${{ !cancelled() }}
        with:
          name: playwright-results
          path: frontend/test-results/
          retention-days: 7

  api-types-freshness:
    name: API Types Freshness
    if: inputs.enable-api-freshness-check
    runs-on: ${{ inputs.runner-os }}
    timeout-minutes: 15
    needs: [test-backend]

    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: ${{ inputs.python-version }}

      - name: Install uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8
        with:
          enable-cache: true
          cache-dependency-glob: 'backend/uv.lock'

      - name: Install backend dependencies
        run: cd backend && uv sync --frozen --all-extras

      - name: Set up Bun (from version-file)
        if: inputs.bun-version == ''
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version-file: ${{ inputs.bun-version-file }}

      - name: Set up Bun (from explicit override)
        if: inputs.bun-version != ''
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: ${{ inputs.bun-version }}

      - name: Install frontend dependencies
        run: |
          cd frontend
          if [ "$GITHUB_ACTOR" = "dependabot[bot]" ]; then bun install; else bun install --frozen-lockfile; fi

      - name: Check API types freshness
        run: cd frontend && bun run check:api-freshness