verify.yml

name: Verify
on:
  workflow_call:
  workflow_dispatch:
concurrency:
  group: ${{ github.workflow }}-verify-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true
jobs:
  binding:
    name: Binding
    runs-on: ubuntu-latest
    steps:
      - name: Clone repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - name: Install dependencies
        uses: $/.github/actions/install-dependencies
      - name: Cache Rust builds
        uses: wevm/actions/vendor/Swatinem/rust-cache/v2.9.2@73e899a58d51092d694fbaf94b7a1d8c09bfea28
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Build compiler binding
        run: pnpm build:binding:test
      - name: Upload compiler binding
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          if-no-files-found: error
          name: binding
          path: |
            binding/*.node
            binding/compiler.wasm
            src/web/internal/Wasm.generated.ts
          retention-days: 1
    timeout-minutes: 30
  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - name: Clone repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - name: Install dependencies
        uses: $/.github/actions/install-dependencies
      - name: Cache Rust builds
        uses: wevm/actions/vendor/Swatinem/rust-cache/v2.9.2@73e899a58d51092d694fbaf94b7a1d8c09bfea28
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Build package
        run: pnpm build
    timeout-minutes: 30
  checks:
    name: Checks
    runs-on: ubuntu-latest
    steps:
      - name: Clone repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - name: Install dependencies
        uses: $/.github/actions/install-dependencies
      - name: Check code
        run: pnpm check
      - name: Check native inventory
        run: pnpm check:native >> "$GITHUB_STEP_SUMMARY"
      - name: Check at-rule inventory
        run: pnpm check:at-rules >> "$GITHUB_STEP_SUMMARY"
      - name: Check Base UI inventory
        run: pnpm check:base-ui >> "$GITHUB_STEP_SUMMARY"
      - name: Check generated Rust tables
        run: pnpm check:tables
  conformance:
    name: CSS Conformance
    runs-on: ubuntu-latest
    steps:
      - name: Clone repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - name: Install dependencies
        uses: $/.github/actions/install-dependencies
      - name: Enforce complete property conformance
        run: |
          set -o pipefail
          pnpm check:css:full 2>&1 | tee css-conformance.md
      - if: ${{ always() }}
        name: Publish conformance summary
        run: cat css-conformance.md >> "$GITHUB_STEP_SUMMARY"
      - if: ${{ always() && hashFiles('css-conformance.md') != '' }}
        name: Upload conformance report
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: css-conformance
          path: css-conformance.md
          retention-days: 30
  rust:
    name: Rust
    runs-on: ubuntu-latest
    steps:
      - name: Clone repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - name: Install dependencies
        uses: $/.github/actions/install-dependencies
      - name: Cache Rust builds
        uses: wevm/actions/vendor/Swatinem/rust-cache/v2.9.2@73e899a58d51092d694fbaf94b7a1d8c09bfea28
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Check formatting
        run: cargo fmt --all --check
      - name: Lint crates
        run: cargo clippy --workspace --all-targets -- -D warnings
      - name: Lint the web-only compiler
        run: cargo clippy --package compiler --no-default-features --all-targets -- -D warnings
      - name: Lint the WebAssembly build
        run: cargo clippy --package wasm --target wasm32-wasip1 -- -D warnings
      - name: Test crates
        run: cargo test --workspace
    timeout-minutes: 30
  wasi:
    name: WebAssembly binding
    needs: [binding]
    runs-on: ubuntu-latest
    steps:
      - name: Clone repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - name: Install dependencies
        uses: $/.github/actions/install-dependencies
      - name: Cache Rust builds
        uses: wevm/actions/vendor/Swatinem/rust-cache/v2.9.2@73e899a58d51092d694fbaf94b7a1d8c09bfea28
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Download compiler binding
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: binding
      - name: Build WebAssembly binding
        run: pnpm build:binding:wasi
      - name: Build package for the packed fallback
        run: pnpm build:package
      - name: Compare with the native addon
        run: pnpm check:wasi
    timeout-minutes: 30
  test-shards:
    name: Test (${{ matrix.shard }}/16)
    needs: [binding]
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]
    runs-on: ubuntu-latest
    steps:
      - name: Clone repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - name: Install dependencies
        uses: $/.github/actions/install-dependencies
      - name: Remove Microsoft package sources
        # Some runner images list an unsigned packages.microsoft.com source, which fails `apt-get update`.
        # No step installs a package from it.
        run: grep -rl packages.microsoft.com /etc/apt/sources.list.d | xargs -r sudo rm -f
      - name: Install browser
        run: pnpm exec playwright install --with-deps --only-shell chromium
      - name: Install Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          cache: pip
          cache-dependency-path: test/conformance/requirements.txt
          python-version: '3.12'
      - name: Install print engine
        run: |
          sudo apt-get update
          sudo apt-get install -y libpango-1.0-0 libpangoft2-1.0-0 poppler-utils
          python -m pip install -r test/conformance/requirements.txt
      - name: Download compiler binding
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: binding
      - name: Build package for integration consumers
        run: pnpm build:package
      - env:
          CI: true
          ZYZZ_BINDING: prebuilt
        name: Run tests
        run: |
          pnpm run test run --shard=${{ matrix.shard }}/16 --coverage --reporter=default --reporter=blob --outputFile.blob=test-results/blob-${{ matrix.shard }}.json
      - name: Upload shard results
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          if-no-files-found: error
          include-hidden-files: true
          name: test-shard-${{ matrix.shard }}
          path: |
            test-results/
            coverage/
          retention-days: 1
    timeout-minutes: 30
  test:
    name: Test
    if: ${{ !cancelled() }}
    needs: [test-shards, typescript]
    permissions:
      contents: read
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      - name: Clone repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - name: Install dependencies
        uses: $/.github/actions/install-dependencies
      - name: Download shard results
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          pattern: test-shard-*
          merge-multiple: true
      - name: Require all shards and type checks
        env:
          SHARDS_RESULT: ${{ needs.test-shards.result }}
          TYPES_RESULT: ${{ needs.typescript.result }}
        run: |
          test "$SHARDS_RESULT" = success
          test "$TYPES_RESULT" = success
          for shard in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16; do test -f "test-results/blob-$shard.json"; done
      - name: Merge test results and coverage
        if: ${{ !cancelled() }}
        run: |
          mkdir -p test-results/blobs
          mv test-results/blob-*.json test-results/blobs/
          pnpm run test run --merge-reports=test-results/blobs --coverage --reporter=default --reporter=json --outputFile=test-results/integration.json
      - env:
          NODE_OPTIONS: --max-old-space-size=4096
        name: Enforce full at-rule compiler acceptance
        run: node scripts/at-rule-acceptance.ts --require-full --require-targets --results test-results/integration.json
      - if: ${{ !cancelled() && hashFiles('test-results/at-rule-target-retention.json') != '' }}
        name: Upload at-rule target review
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: at-rule-target-retention
          path: test-results/at-rule-target-retention.json
          retention-days: 30
      - if: ${{ !cancelled() && hashFiles('test-results/at-rule-print-capabilities.json') != '' }}
        name: Upload print capabilities
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: at-rule-print-capabilities
          path: test-results/at-rule-print-capabilities.json
          retention-days: 30
      - if: ${{ failure() && hashFiles('test-results/next-*.json') != '' }}
        name: Upload Next.js failure evidence
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: next-failure-evidence
          path: test-results/next-*.json
          retention-days: 30
      - if: ${{ !cancelled() && hashFiles('coverage/coverage-summary.json') != '' }}
        name: Report coverage
        uses: wevm/actions/vendor/davelosert/vitest-coverage-report-action/v2.13.1@73e899a58d51092d694fbaf94b7a1d8c09bfea28
        with:
          comment-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && 'pr' || 'none' }}
          file-coverage-mode: all
          name: Integration Tests
      - if: ${{ !cancelled() && hashFiles('coverage/coverage-summary.json') != '' }}
        name: Upload coverage
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: coverage
          path: coverage/
          retention-days: 30
      - if: ${{ !cancelled() && hashFiles('test-results/css-browser-capabilities.json') != '' }}
        name: Upload CSS browser capabilities
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: css-browser-capabilities
          path: test-results/css-browser-capabilities.json
          retention-days: 30
      - if: ${{ failure() && hashFiles('test-results/css-consumer-*.test-d.ts') != '' }}
        name: Upload failing CSS consumer
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: css-consumer
          path: test-results/css-consumer-*.test-d.ts
          retention-days: 30
      - if: ${{ !cancelled() && hashFiles('test-results/at-rule-browser-capabilities.json') != '' }}
        name: Upload at-rule browser capabilities
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: at-rule-browser-capabilities
          path: test-results/at-rule-browser-capabilities.json
          retention-days: 30
  typescript:
    name: Types (typescript@7)
    env:
      NODE_OPTIONS: --max-old-space-size=4096
    runs-on: ubuntu-latest
    steps:
      - name: Clone repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - name: Install dependencies
        uses: $/.github/actions/install-dependencies
      - name: Check types
        run: |
          set -o pipefail
          pnpm exec tsc --extendedDiagnostics | tee typescript-diagnostics.txt
          {
            printf '## TypeScript %s type check\n\n```\n' "$(pnpm exec tsc --version | sed 's/^Version //')"
            cat typescript-diagnostics.txt
            printf '```\n'
          } >> "$GITHUB_STEP_SUMMARY"
    timeout-minutes: 45
  zizmor:
    name: Actions security
    runs-on: ubuntu-latest
    steps:
      - name: Clone repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - name: Audit GitHub Actions
        uses: wevm/actions/vendor/zizmorcore/zizmor-action/v0.7.0@73e899a58d51092d694fbaf94b7a1d8c09bfea28
        with:
          advanced-security: false
          annotations: true
          inputs: .github
          version: '1.31.0'
    timeout-minutes: 5

permissions:
  contents: read