name: Pipeline Segment - Electron Test

on:
  workflow_call:
    inputs:
      target-platform:
        type: string
        description: 'Platform to run on, can be macos, win or linux'
        required: true
      target-arch:
        type: string
        description: 'Arch to build for, can be x64, arm64 or arm'
        required: true
      test-runs-on:
        type: string
        description: 'What host to run the tests on'
        required: true
      test-container:
        type: string
        description: 'JSON container information for aks runs-on'
        required: false
        default: '{"image":null}'
      is-asan: 
        description: 'Building the Address Sanitizer (ASan) Linux build'
        required: false
        type: boolean
        default: false
      enable-ssh:
        description: 'Enable SSH debugging'
        required: false
        type: boolean
        default: false

concurrency:
  group: electron-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
  cancel-in-progress: ${{ github.ref_protected != true }}

permissions: {}

env:
  CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
  CHROMIUM_GIT_COOKIE_WINDOWS_STRING: ${{ secrets.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}
  ELECTRON_OUT_DIR: Default
  ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
  ACTIONS_STEP_DEBUG: ${{ secrets.ACTIONS_STEP_DEBUG }}
  # @sentry/cli is only needed by release upload-symbols.py; skip the ~17MB CDN download on test jobs
  SENTRYCLI_SKIP_DOWNLOAD: 1

jobs:
  test:
    defaults:
      run:
        shell: bash
    runs-on: ${{ inputs.test-runs-on }}
    permissions:
      contents: read
      issues: read
      pull-requests: read
    container: ${{ fromJSON(inputs.test-container) }}
    strategy:
      fail-fast: false
      matrix:
        build-type: ${{ inputs.target-platform == 'macos' && fromJSON('["darwin","mas"]') || (inputs.target-platform == 'win' && fromJSON('["win"]') || fromJSON('["linux"]')) }}
        shard: ${{ inputs.target-platform == 'linux' && fromJSON('[1, 2, 3]') || fromJSON('[1, 2]') }}
    env:
      BUILD_TYPE: ${{ matrix.build-type }}
      TARGET_ARCH: ${{ inputs.target-arch }}
      ARTIFACT_KEY: ${{ matrix.build-type }}_${{ inputs.target-arch }}
    steps:
    - name: Fix node20 on arm32 runners
      if: ${{ inputs.target-arch == 'arm' && inputs.target-platform == 'linux' }}
      run: |
        cp $(which node) /mnt/runner-externals/node20/bin/
        cp $(which node) /mnt/runner-externals/node24/bin/
    - name: Setup Node.js/npm
      if: ${{ inputs.target-platform == 'win' }}
      uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
      with:
        node-version: 22.21.x
    - name: Add TCC permissions on macOS
      if: ${{ inputs.target-platform == 'macos' }}
      run: |
        epochdate=$(($(date +'%s * 1000 + %-N / 1000000')))
        configure_user_tccdb () {
          local values=$1
          local dbPath="$HOME/Library/Application Support/com.apple.TCC/TCC.db"
          local sqlQuery="INSERT OR REPLACE INTO access VALUES($values);"
          sqlite3 "$dbPath" "$sqlQuery"
        }

        configure_sys_tccdb () {
          local values=$1
          local dbPath="/Library/Application Support/com.apple.TCC/TCC.db"
          local sqlQuery="INSERT OR REPLACE INTO access VALUES($values);"
          sudo sqlite3 "$dbPath" "$sqlQuery"
        }

        userValuesArray=(
            "'kTCCServiceCamera','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
            "'kTCCServiceBluetoothAlways','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
            "'kTCCServiceAppleEvents','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
            "'kTCCServiceCamera','/opt/hca/hosted-compute-agent',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
            "'kTCCServiceBluetoothAlways','/opt/hca/hosted-compute-agent',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
            "'kTCCServiceScreenCapture','/bin/bash',1,2,3,1,NULL,NULL,NULL,'UNUSED',NULL,0,$epochdate"
        )
        for values in "${userValuesArray[@]}"; do
          # Sonoma and higher have a few extra values
          # Ref: https://github.com/actions/runner-images/blob/main/images/macos/scripts/build/configure-tccdb-macos.sh
          if [ "$OSTYPE" = "darwin23" ] || [ "$OSTYPE" = "darwin24" ]; then
            configure_user_tccdb "$values,NULL,NULL,'UNUSED',${values##*,}"
            configure_sys_tccdb "$values,NULL,NULL,'UNUSED',${values##*,}"
          else
            configure_user_tccdb "$values"
            configure_sys_tccdb "$values"
          fi
        done
    - name: Turn off the unexpectedly quit dialog on macOS
      if: ${{ inputs.target-platform == 'macos' }}
      run: defaults write com.apple.CrashReporter DialogType server
    - name: Set xcode to 16.4
      if: ${{ inputs.target-platform == 'macos' }}
      run: sudo xcode-select --switch /Applications/Xcode_16.4.app
    - name: Checkout Electron
      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
      with:
        path: src/electron
        fetch-depth: 0
        ref: ${{ github.event.pull_request.head.sha }}
    - name: Turn off screenshot nag on macOS
      if: ${{ inputs.target-platform == 'macos' }}
      run: |
        defaults write ~/Library/Group\ Containers/group.com.apple.replayd/ScreenCaptureApprovals.plist "/bin/bash" -date "3024-09-23 12:00:00 +0000"
        src/electron/script/actions/screencapture-nag-remover.sh -a $(which bash)
        src/electron/script/actions/screencapture-nag-remover.sh -a /opt/hca/hosted-compute-agent
    - name: Setup SSH Debugging
      if: ${{ inputs.target-platform == 'macos' && (inputs.enable-ssh || env.ACTIONS_STEP_DEBUG == 'true') }}
      uses: ./src/electron/.github/actions/ssh-debug
      with:
        tunnel: 'true'
      env:
        CLOUDFLARE_TUNNEL_CERT: ${{ secrets.CLOUDFLARE_TUNNEL_CERT }}
        CLOUDFLARE_TUNNEL_HOSTNAME: ${{ vars.CLOUDFLARE_TUNNEL_HOSTNAME }}
        CLOUDFLARE_USER_CA_CERT: ${{ secrets.CLOUDFLARE_USER_CA_CERT }}
        AUTHORIZED_USERS: ${{ secrets.SSH_DEBUG_AUTHORIZED_USERS }}
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Dependencies
      uses: ./src/electron/.github/actions/install-dependencies
    - name: Set Chromium Git Cookie
      uses: ./src/electron/.github/actions/set-chromium-cookie
    - name: Get Depot Tools
      timeout-minutes: 5
      run: |
        git config --global core.filemode false
        git config --global core.autocrlf false
        git config --global branch.autosetuprebase always
        git config --global core.fscache true
        git config --global core.longpaths true
        git config --global core.preloadindex true
        git config --global core.longpaths true
        git clone --filter=tree:0 https://chromium.googlesource.com/chromium/tools/depot_tools.git
        # Ensure depot_tools does not update.
        test -d depot_tools && cd depot_tools
        touch .disable_auto_update
    - name: Add Depot Tools to PATH
      run: echo "$(pwd)/depot_tools" >> $GITHUB_PATH
    - name: Load ASan specific environment variables
      if: ${{ inputs.is-asan == true }}
      run: |
        echo "ARTIFACT_KEY=${{ matrix.build-type }}_${{ inputs.target-arch }}_asan" >> $GITHUB_ENV
        echo "DISABLE_CRASH_REPORTER_TESTS=true" >> $GITHUB_ENV
        echo "IS_ASAN=true" >> $GITHUB_ENV
    - name: Download Generated Artifacts
      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
      with:
        name: generated_artifacts_${{ env.ARTIFACT_KEY }}
        path: ./generated_artifacts_${{ matrix.build-type }}_${{ inputs.target-arch }}
    - name: Download Src Artifacts
      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
      with:
        name: src_artifacts_${{ env.ARTIFACT_KEY }}
        path: ./src_artifacts_${{ matrix.build-type }}_${{ inputs.target-arch }}
    - name: Restore Generated Artifacts
      run: ./src/electron/script/actions/restore-artifacts.sh
    - name: Unzip Dist (win)
      if: ${{ inputs.target-platform == 'win' }}
      shell: powershell
      run: |
        Set-ExecutionPolicy Bypass -Scope Process -Force
        cd src/out/Default
        Expand-Archive -Force dist.zip -DestinationPath ./
    - name: Unzip Dist (unix)
      if: ${{ inputs.target-platform != 'win' }}
      run: |
        cd src/out/Default
        unzip -:o dist.zip
    - name: Import & Trust Self-Signed Codesigning Cert on MacOS
      if: ${{ inputs.target-platform == 'macos' }}
      run: |
        cd src/electron
        ./script/codesign/generate-identity.sh
    # Only sign on x64 — arm64 builds are already ad-hoc signed, and re-signing
    # with an untrusted cert breaks macOS system integrations (e.g. dock bounce).
    # Autoupdater tests sign their own fixture copies via signApp().
    - name: Sign Electron.app for macOS tests
      if: ${{ inputs.target-platform == 'macos' && inputs.target-arch == 'x64' }}
      run: |
        identity=$(src/electron/script/codesign/get-trusted-identity.sh)
        if [ -n "$identity" ]; then
          codesign -s "$identity" --deep --force src/out/Default/Electron.app
        fi

    - name: Run Electron Tests
      shell: bash
      timeout-minutes: 40
      env:
        MOCHA_REPORTER: mocha-multi-reporters
        MOCHA_MULTI_REPORTERS: mocha-junit-reporter, tap
        ELECTRON_DISABLE_SECURITY_WARNINGS: 1
        DISPLAY: ':99.0'
        NPM_CONFIG_MSVS_VERSION: '2022'
      run: |
        cd src/electron
        export ELECTRON_TEST_RESULTS_DIR=`pwd`/junit
        # Get which tests are on this shard
        tests_files=$(node script/split-tests ${{ matrix.shard }} ${{ inputs.target-platform == 'linux' && 3 || 2 }})

        # Run tests
        if [ "${{ inputs.target-platform }}" != "linux" ]; then
          echo "About to start tests"
          if [ "${{ inputs.target-platform }}" = "win" ]; then
            if [ "${{ inputs.target-arch }}" = "x86" ]; then
              export npm_config_arch="ia32"
            fi
            if [ "${{ inputs.target-arch }}" = "arm64" ]; then
              export ELECTRON_FORCE_TEST_SUITE_EXIT="true"
            fi
          fi
          node script/yarn.js test --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
        else
          chown :builduser .. && chmod g+w ..
          chown -R :builduser . && chmod -R g+w .
          chmod 4755 ../out/Default/chrome-sandbox
          runuser -u builduser -- git config --global --add safe.directory $(pwd)
          if [ "${{ inputs.is-asan }}" == "true" ]; then
            cd ..
            ASAN_SYMBOLIZE="$PWD/tools/valgrind/asan/asan_symbolize.py --executable-path=$PWD/out/Default/electron"
            export ASAN_OPTIONS="symbolize=0 handle_abort=1"
            export G_SLICE=always-malloc
            export NSS_DISABLE_ARENA_FREE_LIST=1
            export NSS_DISABLE_UNLOAD=1
            export LLVM_SYMBOLIZER_PATH=$PWD/third_party/llvm-build/Release+Asserts/bin/llvm-symbolizer
            export MOCHA_TIMEOUT=180000
            echo "Piping output to ASAN_SYMBOLIZE ($ASAN_SYMBOLIZE)"
            cd electron
            runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn.js test --runners=main --trace-uncaught --enable-logging --files $tests_files | $ASAN_SYMBOLIZE
          else
            if [ "${{ inputs.target-arch }}" = "arm" ]; then
              runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn.js test --skipYarnInstall --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
            else 
              runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn.js test --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
            fi
            
          fi
        fi
    - name: Take screenshot on timeout or cancellation
      if: ${{ inputs.target-platform != 'linux' && (cancelled() || failure()) }}
      shell: bash
      run: |
        screenshot_dir="src/electron/spec/artifacts"
        mkdir -p "$screenshot_dir"
        screenshot_file="$screenshot_dir/screenshot-timeout-$(date +%Y%m%d%H%M%S).png"
        if [ "${{ inputs.target-platform }}" = "macos" ]; then
          screencapture -x "$screenshot_file" || true
        elif [ "${{ inputs.target-platform }}" = "win" ]; then
          powershell -command "Add-Type -AssemblyName System.Windows.Forms; \$screen = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; \$bitmap = New-Object System.Drawing.Bitmap(\$screen.Width, \$screen.Height); \$graphics = [System.Drawing.Graphics]::FromImage(\$bitmap); \$graphics.CopyFromScreen(\$screen.Location, [System.Drawing.Point]::Empty, \$screen.Size); \$bitmap.Save('$screenshot_file')" || true
        fi

    - name: Upload Test results to Datadog
      env:
        DD_ENV: ci
        DD_SERVICE: electron
        DD_API_KEY: ${{ secrets.DD_API_KEY }}
        DD_CIVISIBILITY_LOGS_ENABLED: true
        DD_TAGS: "os.architecture:${{ inputs.target-arch }},os.family:${{ inputs.target-platform }},os.platform:${{ inputs.target-platform }},asan:${{ inputs.is-asan }}"
      run: |
        if ! [ -z $DD_API_KEY ] && [ -f src/electron/junit/test-results-main.xml ]; then
          cd src/electron
          export DATADOG_PATH=`node script/yarn.js bin datadog-ci`
          $DATADOG_PATH junit upload junit/test-results-main.xml
        fi
      if: always() && !cancelled()
    - name: Upload Test Artifacts
      if: always()
      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7.0.0
      with:
        name: test_artifacts_${{ env.ARTIFACT_KEY }}_${{ matrix.shard }}
        path: src/electron/spec/artifacts
        if-no-files-found: ignore
    - name: Wait for active SSH sessions
      if: always() && !cancelled()
      shell: bash
      run: |
        while [ -f /var/.ssh-lock ]
        do
          sleep 60
        done
