test.yml

name: Tests

# PER-8195: explicitly use `pull_request` only. `pull_request_target` is
# forbidden — it checks out attacker-controlled code with full secret access.
on: [push, pull_request]

# Limit GITHUB_TOKEN to read-only (CodeQL: workflow-does-not-contain-permissions)
permissions:
  contents: read

jobs:
  basic:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: 3.4
          bundler-cache: true
      - uses: actions/cache@v4
        with:
          path: "./vendor/bundle"
          key: v1/${{ runner.os }}/ruby-3.4/${{ hashFiles('**/Gemfile.lock') }}
          restore-keys: v1/${{ runner.os }}/ruby-3.4/
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - uses: actions/cache@v4
        with:
          path: ~/.npm
          key: v1/${{ runner.os }}/node-20/${{ hashFiles('**/package-lock.json') }}
          restore-keys: v1/${{ runner.os }}/node-20/
      - run: make test
        env:
          PERCY_TOKEN: ${{ secrets.PERCY_TOKEN }}

  advanced:
    # PER-8195 advanced example. Runs the advanced suite the same way the
    # basic job runs its suite — under Percy with the repo's PERCY_TOKEN.
    # No testing-mode coverage gate or external assertion helper (matches master).
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: advanced
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: 3.4
          bundler-cache: false
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - name: Install advanced/ dependencies
        run: make install
      - name: Run advanced tests
        env:
          PERCY_TOKEN: ${{ secrets.PERCY_TOKEN }}
        run: make test-advanced