visual-compare-rntester.yml

# Trusted half of RNTester visual regression testing. Runs from the default
# branch after Test All completes, including for pull requests from forks, and
# compares whatever visual-capture-rntester.yml captured in that run. The
# capture artifacts are treated as inert data: they are validated before any
# image is decoded, and nothing in them is executed.
#
# Pull requests: compare with the baseline for the base commit (or its
#   nearest ancestor with one), upload a report, and set check runs.
# Pushes to the default branch: as above, then publish the captures as the
#   immutable baseline for that commit.
name: Visual Compare RNTester

on:
  workflow_run:
    workflows: [Test All]
    types: [completed]

permissions:
  contents: read

concurrency:
  # Serializes baseline publication on the default branch.
  group: ${{ github.workflow }}-${{ github.event.workflow_run.event == 'push' && 'main' || github.event.workflow_run.id }}
  cancel-in-progress: false

env:
  OUT_DIR: /tmp/visual-out
  VISUAL_ARTIFACTS_DIR: /tmp/visual-artifacts
  VISUAL_BUCKET: ${{ vars.VISUAL_BUCKET }}
  VISUAL_PUBLIC_BASE_URL: ${{ vars.VISUAL_PUBLIC_BASE_URL }}
  VISUAL_CONFIG: packages/rn-tester/visual-tests/config.json

jobs:
  find_captures:
    # Test All can fail for reasons unrelated to rendering, so a failed run is
    # still compared. A platform with no capture is reported as such. Pushes
    # to other branches have no baseline to compare with or publish. Pull
    # requests into other branches are skipped in compare-run.js, because
    # workflow_run doesn't include the base branch of a pull request from a
    # fork. Nothing runs until the repository has GCP credentials configured.
    if: |
      vars.VISUAL_GCP_PROJECT != '' &&
      vars.VISUAL_WORKLOAD_IDENTITY_PROVIDER != '' &&
      contains(fromJSON('["success", "failure"]'), github.event.workflow_run.conclusion) &&
      (
        github.event.workflow_run.event == 'pull_request' ||
        (
          github.event.workflow_run.event == 'push' &&
          github.event.workflow_run.head_branch == github.event.repository.default_branch &&
          github.event.workflow_run.head_repository.full_name == github.repository
        )
      )
    runs-on: ubuntu-latest
    permissions:
      actions: read
    outputs:
      found: ${{ steps.find.outputs.found }}
      captures: ${{ steps.find.outputs.captures }}
    steps:
      - name: Find captures
        id: find
        env:
          GH_TOKEN: ${{ github.token }}
          RUN_ID: ${{ github.event.workflow_run.id }}
        run: |
          CAPTURES=$(gh api --paginate "repos/$GITHUB_REPOSITORY/actions/runs/$RUN_ID/artifacts" \
            --jq '.artifacts[] | select(.name | startswith("visual-capture-")) | .name' | tr '\n' ' ')
          echo "Captures: ${CAPTURES:-none}"
          echo "found=$([[ -n "$CAPTURES" ]] && echo true || echo false)" >> "$GITHUB_OUTPUT"
          echo "captures=$CAPTURES" >> "$GITHUB_OUTPUT"

  compare:
    needs: find_captures
    if: needs.find_captures.outputs.found == 'true'
    runs-on: ubuntu-latest
    permissions:
      actions: read
      checks: write
      contents: read
      id-token: write
      issues: write
      pull-requests: write
    steps:
      - name: Checkout default branch
        uses: actions/checkout@v6
        with:
          persist-credentials: false
      - name: Setup node.js
        uses: ./.github/actions/setup-node
      - name: Install node dependencies
        uses: ./.github/actions/yarn-install
      # Downloaded by name: a pattern that matches one artifact extracts it
      # without the per-artifact directory that compare-run.js reads.
      - name: Download Android capture
        if: contains(needs.find_captures.outputs.captures, 'visual-capture-android')
        uses: actions/download-artifact@v7
        with:
          name: visual-capture-android
          path: ${{ env.VISUAL_ARTIFACTS_DIR }}/visual-capture-android
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ github.token }}
      - name: Download iOS capture
        if: contains(needs.find_captures.outputs.captures, 'visual-capture-ios')
        uses: actions/download-artifact@v7
        with:
          name: visual-capture-ios
          path: ${{ env.VISUAL_ARTIFACTS_DIR }}/visual-capture-ios
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ github.token }}
      - name: Compare
        env:
          GITHUB_TOKEN: ${{ github.token }}
          CAPTURE_EVENT: ${{ github.event.workflow_run.event }}
          CAPTURE_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
          CAPTURE_HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
          CAPTURE_HEAD_REPOSITORY: ${{ github.event.workflow_run.head_repository.full_name }}
          CAPTURE_RUN_ID: ${{ github.event.workflow_run.id }}
          CAPTURE_RUN_ATTEMPT: ${{ github.event.workflow_run.run_attempt }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: node .github/workflow-scripts/visual/compare-run.js prepare
      - name: Check for files to upload
        id: staged
        run: |
          if [[ -d "$OUT_DIR/upload" ]]; then
            echo "upload=true" >> "$GITHUB_OUTPUT"
          fi
      - name: Authenticate to Google Cloud
        if: steps.staged.outputs.upload == 'true'
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          project_id: ${{ vars.VISUAL_GCP_PROJECT }}
          workload_identity_provider: ${{ vars.VISUAL_WORKLOAD_IDENTITY_PROVIDER }}
      - name: Setup gcloud
        if: steps.staged.outputs.upload == 'true'
        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
      - name: Upload report and baseline
        if: steps.staged.outputs.upload == 'true'
        run: |
          # Objects are write-once; --no-clobber makes a rerun skip what an
          # earlier attempt already uploaded.
          gcloud storage cp --recursive --no-clobber "$OUT_DIR/upload/*" "gs://$VISUAL_BUCKET/"
          if [[ -d "$OUT_DIR/baseline-images" ]]; then
            gcloud storage cp --recursive --no-clobber "$OUT_DIR/baseline-images/*" "gs://$VISUAL_BUCKET/"
            # A baseline exists once its manifest does, so the manifest goes last.
            gcloud storage cp --recursive --no-clobber "$OUT_DIR/baseline-manifests/*" "gs://$VISUAL_BUCKET/"
          fi
      - name: Report
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: node .github/workflow-scripts/visual/compare-run.js report