pr-unit.yml

name: Unit Tests - PR
on:
  workflow_call:
    inputs:
      concurrency_group_prefix:
        default: pr
        required: false
        type: string

env:
  HUSKY: "0"
  NX_DEFAULT_OUTPUT_STYLE: static

concurrency:
  group: ${{ inputs.concurrency_group_prefix }}-unit-affected-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  affected_no_terraform:
    name: "Affected Unit Tests (no terraform)"
    runs-on: depot-ubuntu-24.04-16
    container:
      image: ghcr.io/open-constructs/jsii-terraform@sha256:62c00a313a1c9457c0d8d3b6ee86c77d241c2d18c4cc1f9b9015836d6d6a98c8
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: "Add Git safe.directory" # Go 1.18+ embeds repo info in builds
        run: git config --global --add safe.directory /__w/cdk-terrain/cdk-terrain
      - name: ensure correct user
        run: chown -R root /__w/cdk-terrain
      - name: Setup Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: .nvmrc
      - name: Setup corepack-managed pnpm
        uses: ./.github/actions/setup-corepack-pnpm

      - name: Derive base/head SHAs for nx affected
        uses: nrwl/nx-set-shas@e602fada7ad5987b0f7b1905e7a99ea1c661514c # v5.1.0

      - name: Get cache directory paths
        id: global-cache-dir-path
        run: |
          mkdir -p /usr/local/share/.cache/go
          echo "go=/usr/local/share/.cache/go" >> $GITHUB_OUTPUT
      - name: Restore go cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ steps.global-cache-dir-path.outputs.go }}
          key: go-${{ runner.os }}-${{ hashFiles('**/go.sum') }}-unit
          restore-keys: |
            go-${{ runner.os }}-${{ hashFiles('**/go.sum') }}-
            go-${{ runner.os }}-

      - name: Create TF_PLUGIN_CACHE_DIR if set
        run: |
          if [ -n "${TF_PLUGIN_CACHE_DIR:-}" ]; then
            mkdir -p "$TF_PLUGIN_CACHE_DIR"
          fi

      - name: installing dependencies
        timeout-minutes: 20
        run: pnpm ci

      - name: package (only when @cdktn/hcl2cdk is affected)
        timeout-minutes: 30
        # @cdktn/hcl2cdk's globalSetup.ts spawns `cdktn init --dist=...` which
        # reads jsii tarballs from the workspace-root dist/ directory; that
        # output isn't produced by an Nx target chain, only by `pnpm run package`
        # + tools/collect-dist.mjs. Run it conditionally so unrelated PRs
        # don't pay the multi-language packaging cost.
        run: |
          if pnpm exec nx show projects --affected --base="$NX_BASE" --head="$NX_HEAD" | grep -qx '@cdktn/hcl2cdk'; then
            echo "@cdktn/hcl2cdk affected; running pnpm run package"
            pnpm run package
          else
            echo "@cdktn/hcl2cdk not affected; skipping pnpm run package"
          fi

      - name: nx affected - test (excluding terraform-dependent projects)
        timeout-minutes: 30
        run: |
          pnpm exec nx affected -t test \
            --exclude='*,!tag:unit-test' \
            --parallel=2 \
            --base="$NX_BASE" --head="$NX_HEAD" \
            --coverage \
            --reporters=default --reporters=github-actions
        env:
          GOCACHE: ${{ steps.global-cache-dir-path.outputs.go }}

      - name: Coverage summary
        if: always()
        run: node tools/test-coverage-summary.mjs >> "$GITHUB_STEP_SUMMARY"

  affected_terraform:
    name: "Affected Unit Tests (terraform)"
    runs-on: depot-ubuntu-24.04-16
    container:
      image: ghcr.io/open-constructs/jsii-terraform@sha256:62c00a313a1c9457c0d8d3b6ee86c77d241c2d18c4cc1f9b9015836d6d6a98c8
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        include:
          - terraform_version: "1.16.1"
            terraform_binary: terraform1.16.1
          - terraform_version: "1.5.7"
            terraform_binary: terraform1.5.7
          - terraform_version: "1.12.6"
            terraform_binary: tofu1.12.6
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: "Add Git safe.directory"
        run: git config --global --add safe.directory /__w/cdk-terrain/cdk-terrain
      - name: ensure correct user
        run: chown -R root /__w/cdk-terrain
      - name: Setup Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: .nvmrc
      - name: Setup corepack-managed pnpm
        uses: ./.github/actions/setup-corepack-pnpm

      - name: Derive base/head SHAs for nx affected
        uses: nrwl/nx-set-shas@e602fada7ad5987b0f7b1905e7a99ea1c661514c # v5.1.0

      - name: Get cache directory paths
        id: global-cache-dir-path
        run: |
          mkdir -p /usr/local/share/.cache/go
          echo "go=/usr/local/share/.cache/go" >> $GITHUB_OUTPUT
          mkdir -p /usr/local/share/.cache/providerSchema
          echo "providerSchema=/usr/local/share/.cache/providerSchema" >> $GITHUB_OUTPUT
      - name: Restore go cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ steps.global-cache-dir-path.outputs.go }}
          key: go-${{ runner.os }}-${{ hashFiles('**/go.sum') }}-unit
          restore-keys: |
            go-${{ runner.os }}-${{ hashFiles('**/go.sum') }}-
            go-${{ runner.os }}-
      - name: Restore provider schema cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ steps.global-cache-dir-path.outputs.providerSchema }}
          key: providerSchema-${{ runner.os }}-${{ matrix.terraform_version }}-unit-affected

      - name: Create TF_PLUGIN_CACHE_DIR if set
        run: |
          if [ -n "${TF_PLUGIN_CACHE_DIR:-}" ]; then
            mkdir -p "$TF_PLUGIN_CACHE_DIR"
          fi

      - name: installing dependencies
        timeout-minutes: 20
        run: pnpm ci

      - name: package (only when @cdktn/cli-core is affected)
        timeout-minutes: 30
        run: |
          if pnpm exec nx show projects --affected --base="$NX_BASE" --head="$NX_HEAD" | grep -qx '@cdktn/cli-core'; then
            echo "@cdktn/cli-core affected; running pnpm run package"
            pnpm run package
          else
            echo "@cdktn/cli-core not affected; skipping pnpm run package"
          fi

      - name: nx affected - test (terraform-dependent projects)
        timeout-minutes: 30
        run: |
          unset TF_PLUGIN_CACHE_DIR
          pnpm exec nx affected -t test \
            --exclude='*,!tag:unit-test:terraform' \
            --parallel=2 \
            --base="$NX_BASE" --head="$NX_HEAD" \
            --coverage \
            --reporters=default --reporters=github-actions
        env:
          TERRAFORM_BINARY_NAME: ${{ matrix.terraform_binary }}
          GOCACHE: ${{ steps.global-cache-dir-path.outputs.go }}
          CDKTF_EXPERIMENTAL_PROVIDER_SCHEMA_CACHE_PATH: ${{ steps.global-cache-dir-path.outputs.providerSchema }}

      - name: Coverage summary
        if: always()
        run: node tools/test-coverage-summary.mjs >> "$GITHUB_STEP_SUMMARY"

  results:
    if: ${{ always() }}
    runs-on: ubuntu-latest
    name: Unit Tests - PR - Result
    needs: [affected_no_terraform, affected_terraform]
    steps:
      - name: Fail if any required job failed or was cancelled
        run: exit 1
        if: >-
          ${{
               contains(needs.*.result, 'failure')
            || contains(needs.*.result, 'cancelled')
          }}