test.yml

name: test

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Lets a follow-up push cancel an in-flight run from the same branch — saves
# minutes when the maintainer pushes a fix on top of an immediately-broken
# commit.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: macos-15
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Show toolchain
        run: |
          swift --version
          xcodebuild -version

      # SwiftPM caches resolved dependencies and intermediate build products
      # under .build/. Keyed on Package.resolved so the cache invalidates
      # whenever a dependency version moves.
      - name: Cache .build
        uses: actions/cache@v4
        with:
          path: .build
          key: ${{ runner.os }}-spm-${{ hashFiles('**/Package.resolved') }}
          restore-keys: |
            ${{ runner.os }}-spm-

      - name: Build
        run: swift build

      - name: Test
        run: swift test
        env:
          # No TDX credentials are seeded in CI. The 2 RailIntegration
          # tests `XCTSkip` cleanly without them; the other 90+ run fully
          # (MockURLProtocol covers HTTP + executor behavior offline).
          # Setting this disables Auth.read's keychain prompt if it ever
          # leaks through (it shouldn't, but defense in depth).
          NSUnbufferedIO: "YES"

  # Lints the plugin shell scripts and runs the session-start hook behavior
  # test. Runs on ubuntu (shellcheck pre-installed, fast) — the scripts are
  # OS-agnostic for linting, and the behavior test only asserts the
  # binary-presence banner, which is emitted before the macOS-only `security`
  # call, so it passes regardless of platform.
  shell:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: shellcheck plugin scripts
        run: shellcheck plugin/bin/*.sh plugin/hooks/*.sh plugin/tests/*.sh

      - name: session-start hook behavior test
        run: bash plugin/tests/test-session-start.sh