test.yml

name: tests

on:
  push:
    branches: [master]
  pull_request:
  workflow_dispatch:

concurrency:
  group: tests-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Elixir ${{ matrix.elixir }} / OTP ${{ matrix.otp }}
    runs-on: ubuntu-latest
    env:
      MIX_ENV: test
    strategy:
      fail-fast: false
      matrix:
        include:
          - elixir: '1.19'
            otp: '28'
    steps:
      - uses: actions/checkout@v4

      # mob.adopt's native (--android/--ios) tests render from mob_new's
      # templates — mob_new is the single source, not duplicated here. Provide
      # a mob_new checkout so MobDev.Adopt.Generator resolves them via
      # MOB_NEW_DIR (mirrors a user having the mob_new archive installed).
      - name: Checkout mob_new (native adopt templates)
        uses: actions/checkout@v4
        with:
          repository: GenericJam/mob_new
          path: mob_new

      - uses: erlef/setup-beam@v1
        with:
          elixir-version: ${{ matrix.elixir }}
          otp-version: ${{ matrix.otp }}

      - name: Cache deps + _build
        uses: actions/cache@v4
        with:
          path: |
            deps
            _build
          key: mix-${{ runner.os }}-${{ matrix.elixir }}-${{ matrix.otp }}-${{ hashFiles('**/mix.lock') }}
          restore-keys: mix-${{ runner.os }}-${{ matrix.elixir }}-${{ matrix.otp }}-

      - run: mix deps.get
      - run: mix deps.compile
      - run: mix compile --warnings-as-errors

      # Some HotPush tests inspect `_build/dev/lib/*/ebin/*.beam` to verify
      # which runtime BEAMs the `mix mob.push` helper would ship to a device.
      # Under MIX_ENV=test the dev tree doesn't exist; pre-populate it so
      # those tests have something to look at.
      - name: Compile :dev tree (for HotPush tests)
        env:
          MIX_ENV: dev
        run: mix compile

      - name: Format check
        run: mix format --check-formatted

      - name: Credo (strict)
        run: mix credo --strict

      - name: Tests
        env:
          # mob.adopt native tests resolve mob_new's templates from this checkout.
          MOB_NEW_DIR: ${{ github.workspace }}/mob_new
        # `:macos_only` — tests that shell out to /usr/libexec/PlistBuddy
        # and similar macOS-bound tools.
        # `:requires_zig` — run by the macOS `zig` job below, which has the
        # pinned Zig and reads Mach-O objects with `nm`.
        # Both run by default on a maintainer's laptop; CI explicitly skips.
        run: mix test --exclude macos_only --exclude requires_zig

  # MOB-201: `mix mob.doctor`'s Xcode / iOS SDK / iPhone Duo rows, run against
  # real Xcodes selected through DEVELOPER_DIR (the same resolution
  # MobDev.NativeBuild's `xcrun --show-sdk-path` uses). The 27.1 row is the
  # only Xcode 27.1 + iOS 27.1 SDK the project can run today: GitHub's
  # `xcode-27` image (preview) has it; it has no iOS 27.1 simulator runtime and
  # no iPhone Duo simulator. The 26.6 row keeps the Xcode 26 lane alive.
  xcode:
    name: Xcode ${{ matrix.xcode }} (${{ matrix.runner }})
    runs-on: ${{ matrix.runner }}
    env:
      MIX_ENV: test
      HOMEBREW_NO_AUTO_UPDATE: '1'
      DEVELOPER_DIR: /Applications/Xcode_${{ matrix.xcode }}.app/Contents/Developer
      MOB_EXPECT_XCODE: ${{ matrix.xcode }}
      MOB_EXPECT_IOS_SDK: ${{ matrix.ios_sdk }}
      MOB_EXPECT_DUO: ${{ matrix.duo }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: xcode-27
            xcode: '27.1'
            ios_sdk: '27.1'
            duo: ok
          - runner: xcode-27
            xcode: '27.0'
            ios_sdk: '27.0'
            duo: warn
          - runner: macos-26
            xcode: '26.6'
            ios_sdk: '26.5'
            duo: warn
    steps:
      - uses: actions/checkout@v4

      # erlef/setup-beam has no macOS support; Homebrew's bottles are recent
      # enough for mob_dev's `elixir: "~> 1.19"`.
      - name: Install Elixir
        run: |
          brew install elixir
          mix local.hex --force
          mix local.rebar --force

      - name: Cache deps + _build
        uses: actions/cache@v4
        with:
          path: |
            deps
            _build
          key: mix-${{ matrix.runner }}-${{ hashFiles('**/mix.lock') }}
          restore-keys: mix-${{ matrix.runner }}-

      - run: xcodebuild -version && xcrun --sdk iphoneos --show-sdk-version
      - run: mix deps.get
      - run: mix test --only xcode_live test/mob_dev/xcode_live_test.exs

  # `:requires_zig` tests compile generated driver tables and plugin NIFs with
  # the pinned Zig (read from .tool-versions so CI can't drift from it). macOS,
  # because the iOS objects are Mach-O and the test reads them with `nm`.
  zig:
    name: Zig (requires_zig)
    runs-on: macos-26
    env:
      MIX_ENV: test
      HOMEBREW_NO_AUTO_UPDATE: '1'
    steps:
      - uses: actions/checkout@v4

      - name: Install Elixir
        run: |
          brew install elixir
          mix local.hex --force
          mix local.rebar --force

      - name: Zig version from .tool-versions
        id: zig
        run: echo "version=$(awk '$1 == "zig" {print $2}' .tool-versions)" >> "$GITHUB_OUTPUT"

      - uses: mlugg/setup-zig@v2
        with:
          version: ${{ steps.zig.outputs.version }}
          # A cached .zig-cache holds configure results that name the zig
          # binary by its absolute path, which changes every run.
          use-cache: false

      # The Xcode 26.6 lane's cache (same runner, same MIX_ENV). On a cold
      # cache vix's precompiled downloads failed on this runner (NIF :enoent,
      # then header_too_long fetching libvips), and the source fallback needs
      # glib. This job depends on that lane keeping the cache warm.
      - name: Cache deps + _build
        uses: actions/cache/restore@v4
        with:
          path: |
            deps
            _build
          key: mix-macos-26-${{ hashFiles('**/mix.lock') }}
          restore-keys: mix-macos-26-

      - run: mix deps.get
      - run: mix test --only requires_zig

  security_scan:
    name: Security scan
    needs: test
    runs-on: ubuntu-latest
    if: always()
    # Informational: a finding shouldn't block the workflow gate while we
    # establish a baseline. Flip to `--strict` once we've triaged what's
    # already in the dep tree.
    continue-on-error: true
    env:
      MIX_ENV: test
    steps:
      - uses: actions/checkout@v4

      - uses: erlef/setup-beam@v1
        with:
          elixir-version: '1.19'
          otp-version: '28'

      - name: Cache deps + _build (reuse test job's key)
        uses: actions/cache@v4
        with:
          path: |
            deps
            _build
          key: mix-${{ runner.os }}-1.19-28-${{ hashFiles('**/mix.lock') }}
          restore-keys: mix-${{ runner.os }}-1.19-28-

      - run: mix deps.get
      - run: mix deps.compile

      # osv-scanner is an optional external tool the scanner consumes when
      # available. Missing tools are reported as soft warnings (not failures).
      - name: Install osv-scanner
        run: |
          curl -sSfL https://github.com/google/osv-scanner/releases/latest/download/osv-scanner_linux_amd64 \
            -o /usr/local/bin/osv-scanner
          chmod +x /usr/local/bin/osv-scanner
          osv-scanner --version

      - name: mix mob.security_scan
        # The hex_deps layer applies to mob_dev itself; the gradle / swift /
        # bundled_runtime layers no-op (mob_dev has no native surface).
        run: mix mob.security_scan