name: wai key · the real keychain

# `wai key` keeps a secret in macOS's keychain through /usr/bin/security. The binary's other tests
# reach it through a stand-in, on Linux; this one runs the real tool, in a scratch keychain the test
# makes and removes (never the login keychain), and needs no dialog.
#
# The macOS runner is CI's bottleneck, so this runs on one thing alone: a change to
# wai/wai-rs/src/bin/wai_cli/dx/key.rs or this file, in a pull request's own diff or in a push to
# main. The forge's filter matches a push's delta, so a rebase can fire it; the gate below (on
# Linux) reads the pull request's own diff, and the macOS job does not start without it. On a push
# to main the gate has no pull request to read and answers `true`, so the push's own filter
# decides: work lands as direct commits to main, and a change to key.rs that reached main that way
# was run against the real keychain by nothing.

# A pull request's newer push supersedes its older run. A push to main does not: a cancelled run
# would leave that push's change to key.rs run by nothing, so each push to main takes its own group.
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.sha || github.ref }}
  cancel-in-progress: true

on:
  push:
    branches: [main]
    paths:
      - 'wai/wai-rs/src/bin/wai_cli/dx/key.rs'
      - '.github/workflows/wai-key-keychain.yml'
  pull_request:
    paths:
      - 'wai/wai-rs/src/bin/wai_cli/dx/key.rs'
      - '.github/workflows/wai-key-keychain.yml'

jobs:
  relevant:
    name: does this change touch it
    runs-on: linux
    outputs:
      run: ${{ steps.gate.outputs.run }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - id: gate
        run: |
          set -euo pipefail
          r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-key-keychain.yml \
                "${{ github.event.pull_request.base.sha }}" \
                "${{ github.event.pull_request.head.sha }}")
          echo "this change touches wai key's keychain: $r"
          echo "run=$r" >> "$GITHUB_OUTPUT"

  keychain:
    name: the real keychain · macos
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: macos
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v5
      # launchd's PATH omits cargo on the macOS host runner.
      - name: Put cargo on PATH
        shell: bash
        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: The one test
        shell: bash
        working-directory: wai/wai-rs
        run: |
          set -euo pipefail
          nice -n 10 cargo test --locked --no-default-features --features quickstart --bin wai -- --exact dx::key::tests::the_real_keychain_keeps_reads_replaces_and_removes_a_secret 2>&1 | tee "$RUNNER_TEMP/keychain.log"
          grep -qE '^test result: ok\. 1 passed; 0 failed' "$RUNNER_TEMP/keychain.log" || { echo "::error::the test did not run"; exit 1; }