node-test.yml

name: CI Tests

on:
  pull_request:
    branches:
      - main
      - next
  push:
  merge_group:

env:
  CI: true
  NO_COLOR: true

permissions:
  contents: read

concurrency:
  # node-test-[pull_request|push]-[branch], typically. Will cancel previous runs that match!
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

jobs:
  lint:
    runs-on: ubuntu-latest
    if: contains(fromJSON('["pull_request", "merge_group"]'), github.event_name)
    strategy:
      matrix:
        node-version:
          - "24"
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
        with:
          fetch-depth: 0
          # Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
          persist-credentials: true # zizmor: ignore[artipacked]
      - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm
          cache-dependency-path: npm-shrinkwrap.json

      - run: npm i -g npm@9.5
      - run: npm ci
      - run: npm run lint:changed-files
      - run: npm run lint
        working-directory: firebase-vscode

  vscode_unit:
    runs-on: macos-latest
    strategy:
      matrix:
        node-version:
          - "22"
          - "24"
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
        with:
          # Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
          persist-credentials: true # zizmor: ignore[artipacked]
      - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm
          cache-dependency-path: firebase-vscode/package-lock.json

      - name: Cache VS Code test binary
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # ratchet:actions/cache@v4
        with:
          path: firebase-vscode/.vscode-test
          key: ${{ runner.os }}-vscode-test-${{ hashFiles('firebase-vscode/src/test/constants.ts') }}
          restore-keys: |
            ${{ runner.os }}-vscode-test-
        continue-on-error: true

      - run: npm i -g npm@9.5
      - run: npm ci
      - run: npm install
        working-directory: firebase-vscode
      - run: npm run build
        working-directory: firebase-vscode
      - run: npm run test:unit
        working-directory: firebase-vscode
      - uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # ratchet:codecov/codecov-action@v5
        if: matrix.node-version == '24'

  # vscode_integration:
  #   runs-on: macos-latest
  #   strategy:
  #     matrix:
  #       node-version:
  #         - "24.18"

  #   env:
  #     FIREBASE_EMULATORS_PATH: ${{ github.workspace }}/emulator-cache
  #     FIREBASE_BINARY: firebase

  #   steps:
  #     - name: Setup Java JDK
  #       uses: actions/setup-java@v3.3.0
  #       with:
  #         java-version: 21
  #         distribution: temurin

  #     - uses: actions/checkout@v4
  #     - name: Setup Chrome
  #       uses: browser-actions/setup-chrome@v1.7.2
  #       with:
  #         install-dependencies: true
  #         install-chromedriver: true
  #     - uses: actions/setup-node@v3
  #       with:
  #         node-version: ${{ matrix.node-version }}
  #         cache: npm
  #         cache-dependency-path: firebase-vscode/package-lock.json

  #       # TODO temporary workaround for GitHub Actions CI issue:
  #       # npm ERR! Your cache folder contains root-owned files, due to a bug in
  #       # npm ERR! previous versions of npm which has since been addressed.
  #     - run: sudo chown -R 501:20 "/Users/runner/.npm" || exit 1
  #     - run: npm ci
  #     - run: npm install
  #       working-directory: firebase-vscode
  #     - run: npm run build
  #       working-directory: firebase-vscode

  #     - run: npm i -g firebase-tools@latest

  #     - uses: GabrielBB/xvfb-action@v1
  #       with:
  #         run: npm run test:e2e
  #         working-directory: firebase-vscode

  #     - uses: actions/upload-artifact@v4
  #       if: failure()
  #       with:
  #         name: screenshots
  #         path: firebase-vscode/src/test/screenshots

  #     - uses: codecov/codecov-action@v5
  #       if: matrix.node-version == '24.18'

  unit:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version:
          - "22"
          - "24"
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
        with:
          # Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
          persist-credentials: true # zizmor: ignore[artipacked]
      - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm
          cache-dependency-path: npm-shrinkwrap.json

      - run: npm i -g npm@9.5
      - run: npm ci
      - run: npm test -- -- --forbid-only
        if: matrix.node-version == '24'
      - run: npm run mocha:fast -- --forbid-only
        if: matrix.node-version != '24'

      - uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # ratchet:codecov/codecov-action@v5
        if: matrix.node-version == '24'
        with:
          files: ./.coverage/lcov.info

  integration:
    needs: unit
    if: contains(fromJSON('["push", "merge_group"]'), github.event_name) || (github.event_name == 'pull_request' && github.base_ref == 'next')
    runs-on: ubuntu-22.04

    env:
      FIREBASE_EMULATORS_PATH: ${{ github.workspace }}/emulator-cache
      COMMIT_SHA: ${{ github.sha }}
      CI_JOB_ID: ${{ github.action }}
      FBTOOLS_TARGET_PROJECT: ${{ secrets.FBTOOLS_TARGET_PROJECT }}
      FBTOOLS_CLIENT_INTEGRATION_SITE: ${{ secrets.FBTOOLS_CLIENT_INTEGRATION_SITE }}
      CI_RUN_ID: ${{ github.run_id }}
      CI_RUN_ATTEMPT: ${{ github.run_attempt }}

    strategy:
      fail-fast: false
      matrix:
        node-version:
          - "24.18"
        script:
          - npm run test:client-integration
          - npm run test:emulator
          - npm run test:extensions-emulator
          - npm run test:frameworks
          - npm run test:hosting
          # - npm run test:hosting-rewrites # Long-running test that might conflict across test runs. Run this manually.
          - npm run test:import-export
          - npm run test:storage-deploy
          - npm run test:triggers-end-to-end
          - npm run test:triggers-end-to-end:inspect
          # - npm run test:dataconnect-deploy
          - npm run test:dataconnect-emulator
          - npm run test:functions-discover
        include:
          - node-version: "22"
            script: "npm run test:storage-emulator-integration"
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
        with:
          # Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
          persist-credentials: true # zizmor: ignore[artipacked]
      - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm
          cache-dependency-path: npm-shrinkwrap.json
      - name: Setup Java JDK
        uses: actions/setup-java@860f60056505705214d223b91ed7a30f173f6142 # ratchet:actions/setup-java@v3.3.0
        with:
          java-version: 21
          distribution: temurin
      - name: Setup Chrome
        if: matrix.script == 'npm run test:storage-emulator-integration'
        uses: browser-actions/setup-chrome@facf10a55b9caf92e0cc749b4f82bf8220989148 # ratchet:browser-actions/setup-chrome@v1.7.2
        with:
          install-dependencies: true
          install-chromedriver: true
      - name: Cache firebase emulators
        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # ratchet:actions/cache@v3
        with:
          path: ${{ env.FIREBASE_EMULATORS_PATH }}
          key: ${{ runner.os }}-firebase-emulators-${{ hashFiles('emulator-cache/**') }}
        continue-on-error: true

      - run: npm i -g npm@9.5
      - run: npm ci
      - run: echo ${{ secrets.service_account_json_base64 }} | base64 -d > ./scripts/service-account.json
      - run: ${{ matrix.script }}

      - name: Print debug logs
        if: failure()
        run: find . -type f -name "*debug.log" | xargs cat

  integration-windows:
    needs: unit
    if: contains(fromJSON('["push", "merge_group"]'), github.event_name) || (github.event_name == 'pull_request' && github.base_ref == 'next')
    runs-on: windows-latest
    timeout-minutes: 35

    env:
      FIREBASE_EMULATORS_PATH: ${{ github.workspace }}/emulator-cache
      COMMIT_SHA: ${{ github.sha }}
      CI_JOB_ID: ${{ github.action }}
      FBTOOLS_TARGET_PROJECT: ${{ secrets.FBTOOLS_TARGET_PROJECT }}
      FBTOOLS_CLIENT_INTEGRATION_SITE: ${{ secrets.FBTOOLS_CLIENT_INTEGRATION_SITE }}
      CI_RUN_ID: ${{ github.run_id }}
      CI_RUN_ATTEMPT: ${{ github.run_attempt }}

    strategy:
      fail-fast: false
      matrix:
        node-version:
          - "24.18"
        script:
          - npm run test:hosting
          # - npm run test:hosting-rewrites # Long-running test that might conflict across test runs. Run this manually.
          - npm run test:client-integration
          - npm run test:emulator
          # - npm run test:import-export # Fails becuase port 4000 is taken after first run - hub not shutting down?
          # - npm run test:extensions-emulator # Fails due to cannot find module sharp (not waiting for npm install?)
          # - npm run test:triggers-end-to-end
          - npm run test:triggers-end-to-end:inspect
          - npm run test:storage-deploy
          # - npm run test:storage-emulator-integration
          # - npm run test:dataconnect-deploy #  TODO (joehanley): Reenable this - it should be safe to run in parallel
          # - npm run test:dataconnect-emulator # TODO (joehanley): Figure out why this is failing
          # - npm run test:frameworks
        include:
          - node-version: "24.18"
            script: "npm run test:functions-discover"
    steps:
      # Disable real-time monitoring and exclude workspace, npm cache, and temp dirs from Windows Defender scanning.
      # Windows Defender locks files during rapid disk operations (npm ci, binary/emulator extraction),
      # which causes intermittent EPERM errors and test runner deadlocks on Windows runners.
      - name: Disable Windows Defender for workspace
        run: |
          Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue
          Add-MpPreference -ExclusionProcess @("node.exe") -ErrorAction SilentlyContinue
          Add-MpPreference -ExclusionPath @("${{ github.workspace }}", "C:\npm\cache", "$env:TEMP") -ErrorAction SilentlyContinue
        shell: powershell

      - name: Setup Java JDK
        uses: actions/setup-java@860f60056505705214d223b91ed7a30f173f6142 # ratchet:actions/setup-java@v3.3.0
        with:
          java-version: 21
          distribution: temurin

      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
        with:
          # Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
          persist-credentials: true # zizmor: ignore[artipacked]
      - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm
          cache-dependency-path: npm-shrinkwrap.json

      - name: Cache firebase emulators
        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # ratchet:actions/cache@v3
        with:
          path: ${{ env.FIREBASE_EMULATORS_PATH }}
          key: ${{ runner.os }}-firebase-emulators-${{ hashFiles('emulator-cache/**') }}
        continue-on-error: true

      - run: echo ${{ secrets.service_account_json_base64 }} > tmp.txt
      - run: certutil -decode tmp.txt scripts/service-account.json
      - run: npm ci --prefer-offline --no-audit
        timeout-minutes: 10
      - run: ${{ matrix.script }}
        timeout-minutes: 20
      - name: Print debug logs
        if: failure()
        timeout-minutes: 2
        run: |
          Get-ChildItem -Path . -Filter "*debug.log" -File -ErrorAction SilentlyContinue | ForEach-Object { Write-Host "`n=== $($_.FullName) ==="; Get-Content $_.FullName -ErrorAction SilentlyContinue }
          Get-ChildItem -Path . -Directory -Exclude "node_modules", ".git" | Get-ChildItem -Filter "*debug.log" -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object { Write-Host "`n=== $($_.FullName) ==="; Get-Content $_.FullName -ErrorAction SilentlyContinue }

  check-package-lock:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version:
          - "24"

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
        with:
          # Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
          persist-credentials: true # zizmor: ignore[artipacked]
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
        with:
          node-version: ${{ matrix.node-version }}
      - run: npm i -g npm@11.17
      # --ignore-scripts prevents the `prepare` script from being run.
      - run: npm install --package-lock-only --ignore-scripts
      - run: npm run sanitize:lockfile
      - run: "git diff --exit-code -- npm-shrinkwrap.json || (echo 'Error: npm-shrinkwrap.json is changed during npm install! Please make sure to use npm >= 11.10, run npm run sanitize:lockfile, and commit npm-shrinkwrap.json.' && false)"

  check-package-lock-vsce:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version:
          - "24"

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
        with:
          # Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
          persist-credentials: true # zizmor: ignore[artipacked]
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
        with:
          node-version: ${{ matrix.node-version }}
      - run: npm i -g npm@11.17
      # --ignore-scripts prevents the `prepare` script from being run.
      - run: "(cd firebase-vscode && npm install --package-lock-only --ignore-scripts)"
      - run: npm run sanitize:lockfile
      - run: "git diff --exit-code -- firebase-vscode/package-lock.json || (echo 'Error: firebase-vscode/package-lock.json is changed during npm install! Please make sure to use npm >= 11.10, run npm run sanitize:lockfile, and commit firebase-vscode/package-lock.json.' && false)"

  check-json-schema:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version:
          - "24"

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
        with:
          # Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
          persist-credentials: true # zizmor: ignore[artipacked]
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm
          cache-dependency-path: npm-shrinkwrap.json
      - run: npm install
      - run: npm run generate:json-schema
      - run: "git diff --exit-code -- schema/*.json || (echo 'Error: JSON schema is changed! Please run npm run generate:json-schema and commit the results.' && false)"