test.yml

name: Test scripts

on:
  push:
  pull_request:

jobs:
  structure:
    name: Structure of every script
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install PyYAML
        run: pip install pyyaml
      - name: Check format, uniqueness and shell syntax
        run: python3 ci/check_structure.py

  discover:
    name: Find runnable service scripts
    runs-on: ubuntu-latest
    needs: structure
    outputs:
      services: ${{ steps.list.outputs.services }}
    steps:
      - uses: actions/checkout@v4
      - id: list
        # Only Docker service scripts are safe to run on a shared runner.
        run: |
          services=$(for d in scripts/*/; do
            name=$(basename "$d")
            grep -q -- '--name wslm-' "$d/script.noshell" && echo "$name"
          done | jq -R -s -c 'split("\n") | map(select(length > 0))')
          echo "services=$services" >> "$GITHUB_OUTPUT"
          echo "Runnable services: $services"

  service-works:
    name: ${{ matrix.script }} works
    runs-on: ubuntu-latest
    needs: discover
    strategy:
      fail-fast: false
      matrix:
        script: ${{ fromJson(needs.discover.outputs.services) }}
    steps:
      - uses: actions/checkout@v4
      - name: Run the script and probe its service
        run: ci/run_service_test.sh "${{ matrix.script }}"

  runner-linux:
    name: ${{ matrix.script }} on ${{ matrix.image }}
    runs-on: ubuntu-latest
    needs: structure
    strategy:
      fail-fast: false
      matrix:
        script: [github-runner, gitlab-runner]
        # Alpine included on purpose: github-runner has to refuse it.
        image: ['debian:stable-slim', 'ubuntu:24.04', 'fedora:latest', 'archlinux:latest', 'alpine:latest']
    steps:
      - uses: actions/checkout@v4
      # A fresh container stands in for a fresh WSL distro. Nothing gets
      # registered: the script only meets a made-up token. GITHUB_TOKEN goes
      # in because github-runner asks api.github.com for the latest release,
      # and the 60-an-hour unauthenticated budget is shared with every other
      # job on this runner's IP address.
      - name: Install, re-run, and reject a made-up token
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: docker run --rm -e GITHUB_TOKEN -v "$PWD:/repo:ro" "${{ matrix.image }}" sh /repo/ci/run_runner_test.sh "${{ matrix.script }}"

  runner-macos:
    name: ${{ matrix.script }} on macOS
    runs-on: macos-latest
    needs: structure
    strategy:
      fail-fast: false
      matrix:
        script: [github-runner-macos, gitlab-runner-macos]
    steps:
      - uses: actions/checkout@v4
      # The macOS runners share a far smaller pool of IP addresses than the
      # Linux ones, so the unauthenticated rate limit is reliably gone here.
      - name: Install, re-run, and reject a made-up token
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: sh ci/run_runner_test.sh "${{ matrix.script }}"