test.yml

name: Tests

# PER-8195: explicitly use `pull_request` only. `pull_request_target` is
# forbidden — it checks out attacker-controlled code with full secret access.
on: [push, pull_request]

# Limit GITHUB_TOKEN to read-only (CodeQL: workflow-does-not-contain-permissions)
permissions:
  contents: read

jobs:
  basic:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: 3.x
      - uses: actions/setup-node@v4
        with:
          node-version: 18
      - uses: actions/cache@v4
        with:
          path: ~/.cache/pip
          key: v1/${{ runner.os }}/pip/${{ hashFiles('**/{requirements,development}.txt') }}
          restore-keys: v1/${{ runner.os }}/pip/
      - uses: actions/cache@v4
        with:
          path: ~/.npm
          key: v1/${{ runner.os }}/node-18/${{ hashFiles('**/package-lock.lock') }}
          restore-keys: v1/${{ runner.os }}/node-18/
      - name: Run tests
        env:
          PERCY_TOKEN: ${{ secrets.PERCY_TOKEN }}
        run: make test

  advanced:
    # PER-8195 advanced example. Runs the advanced suite the same way the
    # basic job runs its suite — under Percy with the repo's PERCY_TOKEN.
    # No testing-mode coverage gate or external assertion helper (matches master).
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: advanced
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      - uses: actions/setup-node@v3
        with:
          node-version: 18
      - name: Install percy CLI
        run: npm install --no-save @percy/cli@^1.31.13
      - name: Install advanced/ python dependencies
        run: make install
      - name: Run advanced tests
        env:
          PERCY_TOKEN: ${{ secrets.PERCY_TOKEN }}
        run: make test-advanced