test.yml

name: Tests

# PER-8195: explicitly use `pull_request` only. `pull_request_target` is
# forbidden — it checks out attacker-controlled code with full secret access.
on: [push, pull_request]

# Limit GITHUB_TOKEN to read-only (CodeQL: workflow-does-not-contain-permissions)
permissions:
  contents: read

jobs:
  basic:
    name: basic
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-java@v3
        with:
          distribution: 'temurin'
          java-version: 17
      - uses: actions/cache@v3
        with:
          path: ~/.npm
          key: v1/${{ runner.os }}/java-8/${{ hashFiles('**/package-lock.json') }}
          restore-keys: v1/${{ runner.os }}/java-8/
      - run: make install
      - run: make test
        env:
          PERCY_TOKEN: ${{ secrets.PERCY_TOKEN }}

  advanced:
    # PER-8195 advanced example. Runs the advanced suite the same way the
    # basic job runs its suite — under Percy with the repo's PERCY_TOKEN.
    # No testing-mode coverage gate or external assertion helper (matches master).
    name: advanced
    runs-on: ubuntu-latest
    timeout-minutes: 20
    defaults:
      run:
        working-directory: advanced
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-java@v3
        with:
          distribution: 'temurin'
          java-version: 17
      - uses: actions/setup-node@v3
        with:
          node-version: 18
      - name: Install advanced/ dependencies
        run: make install
      - name: Run advanced tests
        env:
          PERCY_TOKEN: ${{ secrets.PERCY_TOKEN }}
        run: make test-advanced