open-standards/.github/workflows/wai-audit.yml

name: wai-audit collector and player integration

# WAI's stream audit kit (wai/wai-audit, extensions/stream-audit.md): the collector's tests (every
# session of the corpus live-conformance/audit posted gets the corpus's outcome, and the stored
# sessions report exactly the corpus's served reports, byte for byte and signature; CORS, body
# limits, per-client limits and CMCD intake), clippy with warnings as errors, on Linux and on the
# macOS runner; and on the macOS runner, the host with the browser installed, the player
# integration's unit tests against the corpus and the browser end to end (e2e/run.sh): an HLS
# stream made with the host's media tool, served from another origin, played through an
# open-source web player twice (its loader adapter, and the network tap), each session verified,
# stored and reported by a collector on loopback, and the report recomputed from the bundles.
# The packages come from e2e/package-lock.json with install scripts off. Nothing listens beyond
# loopback.
#
# Push filters match the push's delta, so every path the jobs read is listed.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    branches: [main]
    paths:
      - 'wai/wai-audit/**'
      - 'wai/wai-rs/**'
      - 'wai/wai-quantum/**'
      - 'wai/wai-ops/**'
      - 'wai/live-conformance/audit/**'
      - 'wai/live-conformance/native-sink/**'
      - 'wai/extensions/stream-audit.md'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-audit.yml'
  pull_request:
    paths:
      - 'wai/wai-audit/**'
      - 'wai/wai-rs/**'
      - 'wai/wai-quantum/**'
      - 'wai/wai-ops/**'
      - 'wai/live-conformance/audit/**'
      - 'wai/live-conformance/native-sink/**'
      - 'wai/extensions/stream-audit.md'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-audit.yml'

jobs:
  relevant:
    name: does this change touch it
    runs-on: linux
    outputs:
      run: ${{ steps.gate.outputs.run }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - id: gate
        run: |
          set -euo pipefail
          r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-audit.yml \
                "${{ github.event.pull_request.base.sha }}" \
                "${{ github.event.pull_request.head.sha }}")
          echo "this change touches wai-audit: $r"
          echo "run=$r" >> "$GITHUB_OUTPUT"

  collector-linux:
    name: collector · linux
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Install Rust 1.98.0
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
          rustup toolchain install 1.98.0 --profile minimal --component clippy
          rustup default 1.98.0
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: Tests and clippy
        shell: bash
        working-directory: wai/wai-audit
        run: |
          set -euo pipefail
          cargo test --locked --release 2>&1 | tee "$RUNNER_TEMP/test.log"
          grep -qE '^test result: ok\. [1-9][0-9]* passed; 0 failed' "$RUNNER_TEMP/test.log" || { echo "::error::no test ran"; exit 1; }
          cargo clippy --locked --release --all-targets -- -D warnings

  kit-macos:
    name: collector, player integration and the browser end to end · macos
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: macos
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      # launchd's PATH omits cargo and the host's packages (the media tool, node) on the macOS
      # host runner.
      - name: Put cargo and the host's tools on PATH
        shell: bash
        run: |
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
          echo "/opt/homebrew/bin" >> "$GITHUB_PATH"
      - name: The collector's tests
        shell: bash
        working-directory: wai/wai-audit
        run: |
          set -euo pipefail
          nice -n 10 cargo test --locked --release 2>&1 | tee "$RUNNER_TEMP/test.log"
          grep -qE '^test result: ok\. [1-9][0-9]* passed; 0 failed' "$RUNNER_TEMP/test.log" || { echo "::error::no test ran"; exit 1; }
      - name: The player integration and the browser end to end
        shell: bash
        env:
          BROWSER_BIN: /Applications/Google Chrome.app/Contents/MacOS/Google Chrome # allow-name: the runner host's installed browser, by its path
          AUDIT_E2E_OUT: ${{ runner.temp }}/wai-audit-e2e
        run: |
          set -euo pipefail
          test -x "$BROWSER_BIN" || { echo "::error::this runner has no browser at $BROWSER_BIN"; exit 1; }
          command -v ffmpeg >/dev/null || { echo "::error::this runner has no media tool to make the stream with"; exit 1; }
          nice -n 10 bash wai/wai-audit/e2e/run.sh 2>&1 | tee "$RUNNER_TEMP/audit-e2e.log"
          grep -qE '^ℹ pass [1-9][0-9]*$' "$RUNNER_TEMP/audit-e2e.log" && ! grep -qE '^ℹ fail [1-9]' "$RUNNER_TEMP/audit-e2e.log" \
            || { echo "::error::the player integration's unit tests did not pass"; exit 1; }
          grep -q '^all checks ok$' "$RUNNER_TEMP/audit-e2e.log" || { echo "::error::the browser end to end did not pass"; exit 1; }
          if grep -q '^FAIL' "$RUNNER_TEMP/audit-e2e.log"; then echo "::error::a check failed"; exit 1; fi
      # The page's integration and the native sink are two implementations of stream-audit's
      # player: the page replays the native sink corpus's page-parity case call for call and
      # signs the same bundle byte for byte (extensions/native-sink.md §10).
      - name: The page replays the native sink's corpus
        shell: bash
        run: |
          set -euo pipefail
          node --test wai/wai-audit/web/native-sink.test.mjs 2>&1 | tee "$RUNNER_TEMP/native-parity.log"
          grep -qE '^ℹ pass [1-9][0-9]*$' "$RUNNER_TEMP/native-parity.log" && ! grep -qE '^ℹ fail [1-9]' "$RUNNER_TEMP/native-parity.log" \
            || { echo "::error::the page did not sign the native sink's bundle"; exit 1; }