tests.yml

name: Tests

on:
    push:
        branches: [ 'main' ]
    pull_request:
        branches: [ '*' ]

permissions:
    # allow issuing OIDC tokens, needed for the depot.dev auth
    id-token: write
    # allow at least reading the repo contents, add other permissions if necessary
    contents: read

jobs:
    matrix-prep:
        name: Prepare matrix
        runs-on: ubuntu-22.04
        outputs:
            matrix: ${{ steps.set-matrix.outputs.result }}
        steps:
            -   uses: actions/github-script@v6
                id: set-matrix
                with:
                    script: |
                        const matrix = {
                            cpu: ['x86', 'arm'],
                            php_version: ['80', '81', '82', '83'],
                        }
                        
                        // If this is a third-party pull request, skip ARM builds
                        if (context.eventName === 'pull_request') {
                            const pr = context.payload.pull_request
                            if (pr.head.repo.full_name !== pr.base.repo.full_name) {
                                matrix.cpu = ['x86']
                            }
                        }
                        
                        return matrix

    tests:
        name: Build and tests PHP ${{ matrix.php_version }}, ${{ matrix.cpu }}
        runs-on: ubuntu-22.04
        needs: matrix-prep
        strategy:
            fail-fast: false
            matrix: ${{ fromJson(needs.matrix-prep.outputs.matrix) }}
        steps:
            -   uses: actions/checkout@v4

            # See https://stackoverflow.com/questions/70312490/github-actions-runner-environment-doesnt-build-for-arm-images
            -   name: Set up QEMU to run ARM images (that were built with Depot)
                uses: docker/setup-qemu-action@v3

            -   uses: depot/setup-action@v1
            -   uses: docker/setup-buildx-action@v3

            # We use this action instead of running `make docker-images-php-XX` directly because it lets us
            # use OIDC authentication instead of a secret. Secrets can't be used in pull request builds.
            -   name: Build Docker images
                uses: depot/bake-action@v1
                with:
                    load: true
                    # If this is a third-party pull request, fall back to the local buildx builder
                    buildx-fallback: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
                env:
                    CPU: ${{ matrix.cpu }}
                    CPU_PREFIX: ${{ (matrix.cpu == 'arm') && 'arm-' || '' }}
                    PHP_VERSION: ${{ matrix.php_version }}
                    IMAGE_VERSION_SUFFIX: ${{ (matrix.cpu == 'arm') && 'arm64' || 'x86_64' }}
                    DOCKER_PLATFORM: ${{ (matrix.cpu == 'arm') && 'linux/arm64' || 'linux/amd64' }}

            -   name: Test that layers can be exported
                run: |
                    make layer-php-${{ matrix.php_version }}
                    make layer-php-${{ matrix.php_version }}-fpm
                env:
                    CPU: ${{ matrix.cpu }}

            -   name: Test that the "console" layer can be exported
                run: make layer-console
                if: ${{ matrix.php_version == 80 }}
                env:
                    CPU: ${{ matrix.cpu }}

            -   name: Run tests
                run: make test-${{ matrix.php_version }}
                env:
                    CPU: ${{ matrix.cpu }}