phpunit-feature.yml

name: PHPUnit Feature

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:
    inputs:
      corpus_base_ref:
        description: Full Git commit SHA to classify regression-corpus changes against
        required: true
        type: string
      prepared_local_workflow_commit:
        description: Optional full Native commit for candidate prepared-local source qualification. Does not replace locked-package CI.
        required: false
        type: string

permissions:
  contents: read

jobs:
  action-policy:
    name: Central action policy preflight
    if: ${{ github.server_url == 'https://github.com' }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Check out candidate source
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          persist-credentials: false
      - name: Check out central action policy
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          repository: durable-workflow/.github
          ref: main
          path: .central-action-policy
          persist-credentials: false
      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.13"
      - name: Install policy dependencies
        run: python -m pip install PyYAML==6.0.2
      - name: Require centrally approved immutable action commits
        run: >-
          python .central-action-policy/scripts/qualification_policy.py validate
          --policy .central-action-policy/qualification/policy.json
          --target server
          --workflow-directory .github/workflows

  preflight:
    name: Repository contracts
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - name: Checkout server
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Validate release metadata and CI scripts
        run: |
          node --check scripts/ci/sync-source-release.mjs
          node scripts/ci/sync-source-release.mjs --check
          node --test scripts/ci/test-source-release.mjs

      - name: Validate embedded Workflow package authority
        run: php scripts/ci/test-workflow-package-authority.php

      - name: Install worker OpenAPI validation dependencies
        run: >-
          composer install
          --no-dev
          --no-scripts
          --no-interaction
          --no-progress
          --prefer-dist

      - name: Require versioned worker OpenAPI evolution
        env:
          OPENAPI_BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'push' && github.event.before || inputs.corpus_base_ref }}
        run: php scripts/ci/check-worker-openapi-evolution.php "$OPENAPI_BASE_REF"

      - name: Require durable codec evidence
        env:
          CORPUS_BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'push' && github.event.before || inputs.corpus_base_ref }}
        run: |
          set -euo pipefail
          if [[ ! "$CORPUS_BASE_REF" =~ ^[0-9a-f]{40}$ ]] || [[ "$CORPUS_BASE_REF" =~ ^0+$ ]]; then
            echo "Invalid regression corpus base revision: $CORPUS_BASE_REF" >&2
            exit 1
          fi
          git rev-parse --verify "$CORPUS_BASE_REF^{commit}"
          python scripts/ci/validate-regression-corpus.py --base-ref "$CORPUS_BASE_REF"

      - name: Prove corpus policy guards cannot be weakened
        run: python scripts/ci/test-regression-corpus-policy.py

  feature:
    name: PHPUnit feature suite
    needs: action-policy
    if: ${{ always() }}
    runs-on: ubuntu-latest
    timeout-minutes: 25

    steps:
      - name: Require central action policy preflight
        if: ${{ github.server_url == 'https://github.com' }}
        env:
          ACTION_POLICY_RESULT: ${{ needs.action-policy.result }}
        run: test "$ACTION_POLICY_RESULT" = success

      - name: Checkout server
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Resolve locked workflow package authority
        id: workflow
        run: php scripts/ci/resolve-workflow-package-authority.php

      - name: Checkout workflow package from GitHub
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          repository: durable-workflow/workflow
          ref: ${{ steps.workflow.outputs.commit }}
          path: workflow-package
          persist-credentials: false

      - name: Verify workflow package source provenance
        shell: bash
        env:
          WORKFLOW_PACKAGE_SOURCE: ${{ steps.workflow.outputs.source }}
          WORKFLOW_PACKAGE_REF: ${{ steps.workflow.outputs.ref }}
          WORKFLOW_PACKAGE_COMMIT: ${{ steps.workflow.outputs.commit }}
        run: |
          set -euo pipefail
          resolved_commit="$(git -C workflow-package rev-parse HEAD)"
          if [[ "$resolved_commit" != "$WORKFLOW_PACKAGE_COMMIT" ]]; then
            echo "Resolved Workflow commit $resolved_commit does not match $WORKFLOW_PACKAGE_COMMIT" >&2
            exit 1
          fi
          printf '%s\n' \
            "$WORKFLOW_PACKAGE_SOURCE" \
            "$WORKFLOW_PACKAGE_REF" \
            "$resolved_commit" \
            > workflow-package/.package-provenance
          rm -rf workflow-package/.git

      - name: Run feature, Nexus, and regression corpus suites
        shell: bash
        env:
          CORPUS_BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'push' && github.event.before || inputs.corpus_base_ref }}
        run: |
          set -euo pipefail
          if [[ ! "$CORPUS_BASE_REF" =~ ^[0-9a-f]{40}$ ]] || [[ "$CORPUS_BASE_REF" =~ ^0+$ ]]; then
            echo "Invalid regression corpus base revision: $CORPUS_BASE_REF" >&2
            exit 1
          fi
          docker build --target base -t durable-workflow-server-phpunit-base .
          docker run --rm --entrypoint sh durable-workflow-server-phpunit-base \
            -c 'node --version >/dev/null && python3 -m venv /tmp/dw-conformance-venv && test -x /tmp/dw-conformance-venv/bin/python3'
          docker build -t durable-workflow-server-corpus-validator - <<'DOCKERFILE'
          FROM durable-workflow-server-phpunit-base
          RUN apt-get update \
              && apt-get install -y --no-install-recommends git \
              && rm -rf /var/lib/apt/lists/*
          DOCKERFILE
          docker network create \
            "dw-server-feature-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}"
          docker run --detach \
            --name "dw-server-s3-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}" \
            --network "dw-server-feature-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}" \
            --env AWS_ACCESS_KEY_ID=dw-s3-access \
            --env AWS_SECRET_ACCESS_KEY=dw-s3-secret-key \
            ghcr.io/chrislusf/seaweedfs@sha256:e1ee85a3089d96c4f3df699a0944468557813f5df306819c9d368c4039070ddf
          docker run --detach \
            --name "dw-server-backup-mysql-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}" \
            --network "dw-server-feature-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}" \
            --memory 512m --memory-swap 512m \
            --env MYSQL_ALLOW_EMPTY_PASSWORD=yes --env MYSQL_ROOT_HOST=% \
            --health-cmd='mysqladmin --silent --host=127.0.0.1 ping' \
            --health-interval=1s --health-start-period=20s --health-retries=30 \
            mysql@sha256:679e7e924f38a3cbb62a3d7df32924b83f7321a602d3f9f967c01b3df18495d6 \
            --disable-log-bin --performance-schema=ON \
            --innodb-buffer-pool-size=64M --innodb-redo-log-capacity=64M \
            --innodb-log-buffer-size=8M --table-open-cache=256 --max-connections=40
          docker run --detach \
            --name "dw-server-backup-pgsql-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}" \
            --network "dw-server-feature-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}" \
            --memory 256m --memory-swap 256m \
            --env POSTGRES_HOST_AUTH_METHOD=trust \
            --health-cmd='pg_isready --host=127.0.0.1 --username=postgres' \
            --health-interval=1s --health-start-period=5s --health-retries=30 \
            postgres@sha256:f1c3376c26f2609ab9f29f71f824103fe2fcd8ee0346485cb6122a4f93df6f94
          for database in mysql pgsql; do
            for attempt in $(seq 1 60); do
              health="$(docker inspect --format '{{.State.Health.Status}}' "dw-server-backup-${database}-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}")"
              [ "$health" = healthy ] && break
              [ "$health" != unhealthy ] || exit 1
              sleep 1
            done
            [ "$health" = healthy ]
          done
          tar \
            --exclude=vendor \
            --exclude='*/vendor' \
            --exclude=build \
            --exclude='*/build' \
            -cf - . \
            | docker run --rm -i \
                --network "dw-server-feature-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}" \
                -e CORPUS_BASE_REF \
                -e DW_TEST_S3_ENDPOINT="http://dw-server-s3-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}:8333" \
                -e DW_TEST_S3_ACCESS_KEY_ID=dw-s3-access \
                -e DW_TEST_S3_SECRET_ACCESS_KEY=dw-s3-secret-key \
                -e DW_TEST_BACKUP_MYSQL_HOST="dw-server-backup-mysql-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}" \
                -e DW_TEST_COMPLETION_MYSQL_HOST="dw-server-backup-mysql-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}" \
                -e DW_TEST_BACKUP_PGSQL_HOST="dw-server-backup-pgsql-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}" \
                -e DW_TEST_COMPLETION_PGSQL_HOST="dw-server-backup-pgsql-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}" \
                -w /app \
                --entrypoint sh \
                durable-workflow-server-corpus-validator \
                -lc 'set -eu; tar --no-same-owner -xf - -C /app; cp -a /app/workflow-package /workflow; php scripts/ci/prepare-release-workflow-composer-metadata.php; composer update durable-workflow/workflow --with-dependencies --minimal-changes --no-install --no-scripts --no-autoloader --no-interaction --no-progress --prefer-dist; composer install --no-interaction --no-progress --prefer-dist; git --version; vendor/bin/phpunit --version; git rev-parse --verify "$CORPUS_BASE_REF^{commit}"; php scripts/ci/check-worker-openapi-evolution.php "$CORPUS_BASE_REF"; vendor/bin/phpunit tests/Feature tests/Unit/NexusContractTest.php tests/Unit/CodecRegressionCorpusTest.php tests/Unit/PhpunitFeatureWorkflowContractTest.php tests/Unit/OpenApiDocumentEvolutionTest.php tests/Unit/NamespaceConformanceRunnerContractTest.php tests/Unit/NamespaceRuntimeContractTest.php tests/Unit/SchedulesConformanceRunnerContractTest.php tests/Unit/SchedulesRuntimeContractTest.php --no-progress --colors=never; python3 scripts/ci/validate-regression-corpus.py --base-ref "$CORPUS_BASE_REF" --verify-counterfactual'

      - name: Clean up test services
        if: always()
        run: |
          docker rm -f \
            "dw-server-s3-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}" \
            "dw-server-backup-mysql-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}" \
            "dw-server-backup-pgsql-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}" \
            >/dev/null 2>&1 || true
          docker network rm \
            "dw-server-feature-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}" \
            >/dev/null 2>&1 || true

  qualification:
    name: Feature source qualification
    needs: [preflight, feature]
    if: ${{ always() }}
    runs-on: ubuntu-latest
    timeout-minutes: 2

    steps:
      - name: Require repository contracts and feature tests
        env:
          PREFLIGHT_RESULT: ${{ needs.preflight.result }}
          FEATURE_RESULT: ${{ needs.feature.result }}
        run: |
          set -euo pipefail
          test "$PREFLIGHT_RESULT" = success
          test "$FEATURE_RESULT" = success
          echo "Server repository contracts and feature tests succeeded."

  prepared-local-source:
    name: Candidate cancellation and prepared-local source qualification
    needs: [action-policy, preflight]
    if: ${{ github.event_name == 'workflow_dispatch' && inputs.prepared_local_workflow_commit != '' }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    services:
      mysql:
        image: mysql@sha256:679e7e924f38a3cbb62a3d7df32924b83f7321a602d3f9f967c01b3df18495d6
        env:
          MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
          MYSQL_DATABASE: prepared_local_test
          MYSQL_ROOT_HOST: "%"
        ports: ["3317:3306"]
        options: >-
          --health-cmd="mysqladmin --silent --host=127.0.0.1 ping"
          --health-interval=2s --health-timeout=5s --health-retries=30
      postgres:
        image: postgres@sha256:f1c3376c26f2609ab9f29f71f824103fe2fcd8ee0346485cb6122a4f93df6f94
        env:
          POSTGRES_HOST_AUTH_METHOD: trust
          POSTGRES_DB: prepared_local_test
        ports: ["5439:5432"]
        options: >-
          --health-cmd="pg_isready --host=127.0.0.1 --username=postgres"
          --health-interval=2s --health-timeout=5s --health-retries=30
    env:
      DW_PREPARED_WORKFLOW_COMMIT: ${{ inputs.prepared_local_workflow_commit }}
    steps:
      - name: Require immutable candidate source
        run: |
          set -euo pipefail
          [[ "$DW_PREPARED_WORKFLOW_COMMIT" =~ ^[0-9a-f]{40}$ ]]
          [[ ! "$DW_PREPARED_WORKFLOW_COMMIT" =~ ^0+$ ]]
      - name: Check out Server candidate
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - name: Check out exact Native candidate
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          repository: durable-workflow/workflow
          ref: ${{ inputs.prepared_local_workflow_commit }}
          path: prepared-workflow-source
          persist-credentials: false
      - name: Record source binding and qualify all supported databases
        run: |
          set -euo pipefail
          test "$(git -C prepared-workflow-source rev-parse HEAD)" = "$DW_PREPARED_WORKFLOW_COMMIT"
          mkdir -p prepared-local-evidence
          chmod 0777 prepared-local-evidence
          {
            echo "Candidate source qualification only. No image, release or SDK conformance claim."
            echo "Server commit: $(git rev-parse HEAD)"
            echo "Native source overlay: $DW_PREPARED_WORKFLOW_COMMIT"
            echo "Locked package baseline retained by ordinary feature CI."
          } > prepared-local-evidence/provenance.txt
          docker build --target base -t dw-server-prepared-local-base .
          tar --exclude=vendor --exclude='*/vendor' --exclude=build --exclude='*/build' \
            --exclude=prepared-local-evidence -cf ../prepared-local-source.tar .
          qualification_status=0
          for database in sqlite mysql pgsql; do
            database_name=prepared_local_test
            database_user=root
            database_port=3317
            if [ "$database" = sqlite ]; then database_name=:memory:; fi
            if [ "$database" = pgsql ]; then database_user=postgres; database_port=5439; fi
            if ! docker run --rm --init --network host \
              --user 1000:1000 \
              --tmpfs /app:rw,uid=1000,gid=1000,mode=0755 \
              --volume "$PWD/../prepared-local-source.tar:/source.tar:ro" \
              --volume "$PWD/prepared-local-evidence:/evidence" \
              --env COMPOSER_HOME=/tmp/dw-prepared-composer \
              --env DB_CONNECTION="$database" --env DB_DATABASE="$database_name" \
              --env DB_HOST=127.0.0.1 --env DB_PORT="$database_port" \
              --env DB_USERNAME="$database_user" --env DB_PASSWORD= \
              --env DW_PREPARED_DATABASE="$database" \
              --workdir /app --entrypoint sh dw-server-prepared-local-base -ec '
                tar --no-same-owner -xf /source.tar -C /app
                composer install --no-interaction --no-progress --prefer-dist
                mv vendor/durable-workflow/workflow /tmp/locked-workflow-package
                cp -a prepared-workflow-source vendor/durable-workflow/workflow
                php vendor/bin/phpunit tests/Feature/PreparedLocalActivityProtocolTest.php tests/Feature/ActivityAttemptStatusTest.php tests/Feature/HistoryRetentionTest.php tests/Unit/WorkerPollFenceTest.php tests/Source/CancellationCascadeDiagnosticsTest.php tests/Source/PreparedLocalCancellationPolicyTest.php tests/Source/CancellationScopeAdmissionTest.php tests/Source/ScopedActivityCancellationReceiptTest.php tests/Source/CancellationScopeDeliveryTest.php tests/Feature/WorkflowStreamsTest.php tests/Feature/WorkflowDebugTest.php --fail-on-skipped --log-junit "/evidence/$DW_PREPARED_DATABASE.xml" --colors=never
                if [ "$DW_PREPARED_DATABASE" = sqlite ]; then
                  php vendor/bin/phpunit tests/Feature/CooperativeCancellationProtocolTest.php tests/Feature/WorkflowWorkerProtocolTest.php tests/Feature/ActivityWorkerProtocolTest.php tests/Feature/SearchAttributeValueValidationTest.php tests/Feature/NamespaceDurableStateQuotaTest.php tests/Feature/RuntimeExternalPayloadTransportTest.php tests/Feature/RuntimePayloadCompletionUploadsTest.php tests/Unit/RuntimePayloadCompletionContextTest.php tests/Unit/WorkerProtocolOpenApiContractTest.php --log-junit /evidence/affected-regression.xml --colors=never
                fi
              ' > "prepared-local-evidence/$database.log" 2>&1; then
              qualification_status=1
            fi
          done
          test "$qualification_status" = 0
      - name: Retain exact source qualification evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: candidate-prepared-local-source
          path: prepared-local-evidence
          if-no-files-found: error
          retention-days: 90