test.yml

name: Tests

# Runs the Django test suite on every push to master (our test-server deploy
# trigger) and on every pull request. A failing run is a red ✗ + email — it
# reports status only and does not block the push or the deploy.
on:
  push:
    branches: [master]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest

    # Postgres service mirrors the local-dev / server `db` container
    # (postgres:16, makeability / admin / password).
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: makeability
          POSTGRES_USER: admin
          POSTGRES_PASSWORD: password
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U admin -d makeability"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    env:
      # settings_test.py reads these to reach the Postgres service above.
      DATABASE_HOST: localhost
      DATABASE_PORT: 5432
      DJANGO_ENV: DEBUG

    steps:
      - uses: actions/checkout@v4

      # Mirror the Dockerfile's system deps: ImageMagick + Ghostscript power the
      # PDF→thumbnail path that Artifact.save() runs (exercised by the Talk
      # fixtures); libpq-dev is needed to build psycopg2 from source.
      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends imagemagick ghostscript libpq-dev
          sudo cp imagemagick-policy.xml /etc/ImageMagick-6/policy.xml

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: pip

      - name: Install Python dependencies
        run: pip install -r requirements.txt

      # coverage.py is a test-only tool (lives in requirements-dev.txt) — install
      # it directly here rather than pulling all of requirements-dev.txt, which
      # would drag in Playwright. Keep this pin in sync with requirements-dev.txt.
      - name: Install coverage
        run: pip install coverage==7.14.1

      # `coverage run` wraps the same test command and propagates its exit code,
      # so a test failure still fails this step (red ✗ + email). Config is in
      # .coveragerc (measures the `website` app, branch coverage on).
      - name: Run tests with coverage
        run: coverage run manage.py test website --settings=makeabilitylab.settings_test --verbosity=2

      # Report-only: no --fail-under gate. Print to the log and also publish a
      # table to the run's Summary so the number is visible without opening logs.
      # Skipped automatically if the test step above failed.
      - name: Coverage report
        run: |
          coverage report
          {
            echo "## Coverage — website app"
            echo
            coverage report --format=markdown
          } >> "$GITHUB_STEP_SUMMARY"

  # Browser end-to-end tests (member-page "Load more"/"Load all", bio toggle,
  # section nav). Kept in a SEPARATE job from `test` so the fast unit/integration
  # signal stays fast and isolated — a slow or flaky browser run doesn't muddy
  # "did the logic break?". Like `test`, this is report-only (it doesn't block
  # the push or the deploy). Playwright + its browser live in requirements-dev.txt
  # only, never in the production image.
  e2e:
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: makeability
          POSTGRES_USER: admin
          POSTGRES_PASSWORD: password
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U admin -d makeability"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    env:
      DATABASE_HOST: localhost
      DATABASE_PORT: 5432
      DJANGO_ENV: DEBUG

    steps:
      - uses: actions/checkout@v4

      # Same ImageMagick/Ghostscript deps as `test` — the Talk fixtures the e2e
      # tests create run Artifact.save()'s PDF->thumbnail path.
      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends imagemagick ghostscript libpq-dev
          sudo cp imagemagick-policy.xml /etc/ImageMagick-6/policy.xml

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: pip

      - name: Install Python dependencies (incl. Playwright)
        run: pip install -r requirements-dev.txt

      # Cache the downloaded browser keyed on the pinned Playwright version, so
      # only the first run (or a version bump) pays the ~120 MB download.
      - name: Cache Playwright browser
        uses: actions/cache@v4
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ hashFiles('requirements-dev.txt') }}

      - name: Install Chromium for Playwright
        run: python -m playwright install --with-deps chromium

      - name: Run end-to-end tests
        run: python manage.py test website.tests.test_member_e2e --settings=makeabilitylab.settings_test --verbosity=2

  # Accessibility sweep (Pa11y + Axe, WCAG 2.0 AA). CONTRIBUTING requires Pa11y
  # on UI changes but nothing enforced it (#1278 item 6). This wires it in.
  #
  # Like `test` and `e2e`, it is REPORT-ONLY — it surfaces violations in the run
  # Summary but never fails the build (so a pre-existing violation doesn't sit
  # red next to every master deploy). Tighten to blocking later once the current
  # findings are triaged.
  #
  # The local `.pa11yci.json` targets the docker-compose host with the
  # maintainer's real DB snapshot; CI has no snapshot, so we build a fresh DB
  # from models, seed deterministic demo content (seed_demo_projects +
  # seed_demo_news), serve it with a native runserver, and scan the localhost
  # URLs in `.pa11yci.ci.json`.
  a11y:
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: makeability
          POSTGRES_USER: admin
          POSTGRES_PASSWORD: password
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U admin -d makeability"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    env:
      DATABASE_HOST: localhost
      DATABASE_PORT: 5432
      # DJANGO_ENV=DEBUG -> DEBUG=True, so the dev runserver serves media/static
      # and renders real error pages while pa11y scans.
      DJANGO_ENV: DEBUG
      DJANGO_SETTINGS_MODULE: makeabilitylab.settings_test

    steps:
      - uses: actions/checkout@v4

      # ImageMagick + Ghostscript power the PDF->thumbnail path the demo
      # publications hit on save; libpq-dev builds psycopg2.
      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends imagemagick ghostscript libpq-dev
          sudo cp imagemagick-policy.xml /etc/ImageMagick-6/policy.xml

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: pip

      - name: Install Python dependencies
        run: pip install -r requirements.txt

      # Build the website schema from models (migrations are gitignored;
      # settings_test sets MIGRATION_MODULES={'website': None}, so --run-syncdb
      # creates the tables directly) and seed deterministic demo content.
      - name: Build schema and seed demo data
        run: |
          python manage.py migrate --run-syncdb
          python manage.py seed_demo_projects
          python manage.py seed_demo_news

      - name: Start dev server
        run: |
          python manage.py runserver 0.0.0.0:8000 --noreload &
          echo "Waiting for the server to come up…"
          for i in $(seq 1 30); do
            if curl -sf -o /dev/null http://localhost:8000/; then
              echo "Server is up."; exit 0
            fi
            sleep 1
          done
          echo "Server did not start in time"; exit 1

      - name: Install pa11y-ci
        run: npm install -g pa11y-ci

      # Report-only: `|| true` so violations never fail the job. Output is teed
      # to the log and a trimmed tail posted to the run Summary.
      - name: Run Pa11y accessibility sweep
        run: |
          pa11y-ci --config .pa11yci.ci.json 2>&1 | tee pa11y-output.txt || true
          {
            echo "## Accessibility (Pa11y + Axe, WCAG2AA) — report-only"
            echo
            echo '```'
            tail -n 60 pa11y-output.txt
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"