tests.yml

# Executes all the tests on all the platforms
name: Tests

on:
  workflow_call:
    inputs:
      versionOverrideArg:
        required: false
        type: string
      extensionVersionOverride:
        required: false
        type: string

permissions:
  actions: read
  contents: read

jobs:
  setup_for_tests:
    name: Setup for tests
    runs-on: ubuntu-latest
    # This job checks out and runs PR-authored code (SelectTests, the test build), so it is kept at
    # contents:read with no pull-requests:write. The selection comment is posted from the
    # separate comment_selection job below, which runs no PR code and holds the write scope instead.
    permissions:
      contents: read
    env:
      # Single source of truth for the selection-summary path: passed to the select-tests action
      # (so it writes here) and reused by the upload step below (so it uploads the same file).
      # Mirrors the action's own default; keeping it here lets one value drive both the write and
      # the upload instead of repeating the literal path.
      SELECT_TESTS_COMMENT_FILE: ${{ github.workspace }}/artifacts/select-tests-comment.md
    outputs:
      tests_matrix_no_nugets: ${{ steps.split_matrix.outputs.tests_matrix_no_nugets }}
      tests_matrix_requires_nugets_linux: ${{ steps.split_matrix.outputs.tests_matrix_requires_nugets_linux }}
      tests_matrix_requires_nugets_windows: ${{ steps.split_matrix.outputs.tests_matrix_requires_nugets_windows }}
      tests_matrix_requires_nugets_macos: ${{ steps.split_matrix.outputs.tests_matrix_requires_nugets_macos }}
      tests_matrix_requires_cli_archive: ${{ steps.split_matrix.outputs.tests_matrix_requires_cli_archive }}
      # Selective CI (see docs/ci/test-trigger-selector-design.md). The audit/enforce knob is the
      # select-tests action's `enforce` input; tests.yml just consumes what the selector returns.
      # In audit the selector returns run-all (every gate true + the full matrix), so everything runs.
      run_polyglot: ${{ fromJSON(steps.select_tests.outputs.selection).run_polyglot }}
      run_typescript_sdk: ${{ fromJSON(steps.select_tests.outputs.selection).run_typescript_sdk }}
      run_typescript_api_compat: ${{ fromJSON(steps.select_tests.outputs.selection).run_typescript_api_compat }}
      run_extension_unit: ${{ fromJSON(steps.select_tests.outputs.selection).run_extension_unit }}
      run_extension_e2e: ${{ fromJSON(steps.select_tests.outputs.selection).run_extension_e2e }}
      run_winget_installer: ${{ fromJSON(steps.select_tests.outputs.selection).run_winget_installer }}
      run_homebrew_installer: ${{ fromJSON(steps.select_tests.outputs.selection).run_homebrew_installer }}
      run_nix_package: ${{ fromJSON(steps.select_tests.outputs.selection).run_nix_package }}
      run_cli_starter_validation: ${{ fromJSON(steps.select_tests.outputs.selection).run_cli_starter_validation }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        # This job runs PR-authored code; don't leave the checkout's GITHUB_TOKEN persisted in
        # .git/config where that code could read it. The select-tests base-commit fetch is
        # unauthenticated (public repo) and nothing here pushes, so dropping the credential is safe.
        with:
          persist-credentials: false

      # Compute the selected test subset + non-.NET job booleans. The action reuses this job's checkout
      # (checkout=false) so the BeforeBuildProps.props it may write survives for enumerate-tests below,
      # and does its own minimal SDK bootstrap (setupDotNet=true). enforce: 'true' restricts the test
      # matrix and gates non-.NET jobs (the knob is documented on the action's `enforce` input).
      # No job-level actions/setup-dotnet on
      # purpose -- global.json declares tools.runtimes, so Arcade always uses repo-local .dotnet.
      - name: Select relevant tests
        id: select_tests
        uses: ./.github/actions/select-tests
        with:
          checkout: 'false'
          enforce: 'true'
          commentFile: ${{ env.SELECT_TESTS_COMMENT_FILE }}
          # Kill switch: the 'run-full-ci' PR label forces the full matrix + all jobs. Read from the event
          # payload snapshot, so adding the label takes effect on the next push (or reopen), not on a
          # plain re-run of an existing run. Empty on non-PR events -> the action force-alls anyway.
          forceAll: ${{ contains(github.event.pull_request.labels.*.name, 'run-full-ci') }}
          prBaseSha: ${{ github.event.pull_request.base.sha }}
          # The PR's real head, NOT github.sha (the synthetic refs/pull/N/merge commit). The selector
          # diffs head against the merge-base of base..head, so it sees only the PR's own commits. Using
          # the merge commit instead lets base-branch churn leak into the diff whenever GitHub's merge
          # ref and the event's base.sha disagree (the merge ref is regenerated asynchronously as the
          # base advances) -- which over-selected an unrelated file in
          # https://github.com/microsoft/aspire/pull/18377#issuecomment-4782187184.
          headSha: ${{ github.event.pull_request.head.sha }}

      # Hand the selection summary to the separate comment_selection job (below) as an artifact. The
      # comment is posted from THAT job, which holds pull-requests:write but runs no PR code, so this
      # job -- which checks out and runs PR-authored code -- never holds the write token.
      - name: Upload selection summary
        if: ${{ github.event_name == 'pull_request' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: select-tests-comment
          path: ${{ env.SELECT_TESTS_COMMENT_FILE }}
          if-no-files-found: ignore
          retention-days: 1

      # enumerate-tests reuses this job's checkout + restore (checkout/restore=false) so the props
      # file the selector wrote survives -- a fresh checkout would git-clean it away. When a
      # restriction was written, beforeBuildPropsPath points enumerate at the selected subset; in
      # an ALL selection project_override_props is empty and enumerate builds the full matrix.
      #
      # Skipped entirely when the selection has no .NET test projects (has_dotnet_tests=false, e.g. an
      # extension-only / polyglot-only change whose only targets are non-.NET jobs). An empty selection
      # cannot be expressed as an empty ProjectToBuild -- that makes the enumerate build fall back to the
      # whole solution and fail on non-test tooling projects -- so we skip the build and let the matrix
      # default to empty below; the selected non-.NET jobs still run (gated by the run_* outputs).
      - uses: ./.github/actions/enumerate-tests
        id: generate_tests_matrix
        if: ${{ steps.select_tests.outputs.has_dotnet_tests != 'false' }}
        with:
          buildArgs: '/p:IncludeTemplateTests=true /p:IncludeCliE2ETests=${{ github.event_name == ''pull_request'' }}'
          checkout: 'false'
          # The job only did a minimal SDK bootstrap above, so enumerate must restore. beforeBuildPropsPath
          # (set when a non-ALL selection wrote a restriction) narrows that restore + the enumeration
          # build to the selected projects; an unrestricted selection restores everything.
          restore: 'true'
          # The job already installed the SDK via dotnet.sh above, so the action's setup-dotnet would
          # just re-download it into a location nothing reads (global.json has tools.runtimes -> Arcade
          # always uses repo-local .dotnet). Skip it; restore: 'true' still bootstraps the toolset.
          setupDotNet: 'false'
          beforeBuildPropsPath: ${{ steps.select_tests.outputs.project_override_props }}

      # The expanded matrix can exceed 128KB. It MUST reach the bash step below via a file, not an
      # environment variable: a single env string over Linux's MAX_ARG_STRLEN (~128KB) makes the
      # step's execve("/usr/bin/bash") fail with E2BIG ("Argument list too long"). pwsh writes its
      # run-script to a file, so interpolating the (trusted, build-generated) matrix into a literal
      # here-string here keeps it out of the environment entirely.
      - name: Write test matrix to file
        shell: pwsh
        run: |
          $m = @'
          ${{ steps.generate_tests_matrix.outputs.all_tests }}
          '@.Trim()
          # enumerate-tests is skipped for a no-.NET-tests selection, leaving all_tests empty; default to
          # an empty matrix so the split step and the downstream `include[0] != null` guards see zero.
          if ([string]::IsNullOrWhiteSpace($m)) { $m = '{"include":[]}' }
          $m | Set-Content -Path "${{ github.workspace }}/all_tests.json" -Encoding utf8 -NoNewline

      - name: Split matrix by dependency type
        id: split_matrix
        shell: pwsh
        run: |
          $matrix = Get-Content -Raw "${{ github.workspace }}/all_tests.json"
          $splitScript = "${{ github.workspace }}/eng/scripts/split-test-matrix-by-deps.ps1"
          & $splitScript -AllTestsMatrix $matrix -OutputToGitHubEnv

  # Posts the "selected tests" PR comment. Deliberately isolated from setup_for_tests: that
  # job checks out and runs PR-authored code, so it must not hold pull-requests:write. This job runs
  # NO PR code -- it only downloads the selection-summary artifact and posts it -- so granting it the
  # write scope is least-privilege. Informational only; a token/permission hiccup (e.g. a fork PR
  # with a read-only token) must never fail CI, hence continue-on-error.
  #
  # One comment per pushed commit: a re-run of the same commit updates that commit's comment in place
  # (no duplicate -- re-runs are common), a new commit posts a fresh comment at the bottom, and
  # comments from superseded commits are collapsed (minimized, never deleted) so the timeline stays
  # clean while the per-push history is preserved. Every comment links the head commit it was computed
  # for, which is also the idempotency key.
  comment_selection:
    name: Comment selected tests on PR
    runs-on: ubuntu-latest
    needs: setup_for_tests
    if: ${{ github.event_name == 'pull_request' }}
    continue-on-error: true
    permissions:
      contents: read
      issues: write
      pull-requests: write
    steps:
      - name: Download selection summary
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: select-tests-comment
          path: ${{ github.workspace }}/select-tests-comment
      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        env:
          SELECT_TESTS_COMMENT_FILE: ${{ github.workspace }}/select-tests-comment/select-tests-comment.md
        with:
          script: |
            const fs = require('fs');
            const file = process.env.SELECT_TESTS_COMMENT_FILE;
            if (!file || !fs.existsSync(file)) {
              core.info(`No selection summary at ${file}; skipping comment.`);
              return;
            }
            const marker = '<!-- select-tests-comment -->';
            const { owner, repo } = context.repo;
            const issue_number = context.issue.number;
            // Link the head commit the selection was computed for. On pull_request the workflow runs
            // against an ephemeral merge ref, so prefer the PR head SHA (what the author pushed and
            // recognizes) and fall back to context.sha otherwise. The full SHA is also the idempotency
            // key: a comment whose body links this SHA is "the comment for this commit".
            const sha = context.payload.pull_request?.head?.sha ?? context.sha;
            const shortSha = sha.slice(0, 7);
            const shaUrl = `${context.serverUrl}/${owner}/${repo}/commit/${sha}`;
            const footer = `\n\n---\n_Selection computed for commit [\`${shortSha}\`](${shaUrl})._`;
            const body = `${marker}\n${fs.readFileSync(file, 'utf8')}${footer}`;

            // One comment per pushed commit. Re-runs of the same commit find that commit's existing
            // comment (its body links this SHA) and update it in place -- no duplicate. A new commit
            // matches nothing and posts a fresh comment at the bottom.
            const comments = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number });
            const mine = comments.filter(c => c.body && c.body.includes(marker));
            const current = mine.filter(c => c.body.includes(sha)).at(-1);
            let keepId;
            try {
              if (current) {
                await github.rest.issues.updateComment({ owner, repo, comment_id: current.id, body });
                keepId = current.id;
                core.info(`Updated selection comment ${current.id} for ${shortSha}.`);
              } else {
                const created = await github.rest.issues.createComment({ owner, repo, issue_number, body });
                keepId = created.data.id;
                core.info(`Created selection comment ${created.data.id} for ${shortSha}.`);
              }
            } catch (error) {
              core.info(`Could not create or update selection comment for ${shortSha}: ${error.message}`);
              return;
            }

            // Collapse every other prior selection comment (superseded commits, or the legacy single
            // sticky comment from before this per-commit logic) instead of deleting them, so the
            // timeline stays clean but the per-push history is preserved.
            //
            // Only the run for the PR's CURRENT head may collapse the others. A manual re-run of an
            // older run carries that older commit in its event payload; if it is no longer the PR head,
            // refresh its own comment (above) but do NOT minimize -- otherwise it would collapse the
            // newer commit's live comment. Default to "not live" if the head can't be resolved, so a
            // transient API error never collapses the wrong comment.
            let isLiveHead = false;
            try {
              const pull = await github.rest.pulls.get({ owner, repo, pull_number: issue_number });
              isLiveHead = pull.data.head.sha === sha;
            } catch (error) {
              core.info(`Could not resolve PR head (${error.message}); skipping minimization.`);
            }
            if (isLiveHead) {
              // minimizeComment is GraphQL-only and takes the node_id from the REST listing. Best
              // effort: a failure (e.g. already minimized) must not fail this informational job.
              for (const c of mine) {
                if (c.id === keepId) {
                  continue;
                }
                try {
                  await github.graphql(
                    `mutation($id: ID!) { minimizeComment(input: { subjectId: $id, classifier: OUTDATED }) { minimizedComment { isMinimized } } }`,
                    { id: c.node_id });
                } catch (error) {
                  core.info(`Could not minimize comment ${c.id}: ${error.message}`);
                }
              }
            }

  build_packages:
    name: Build packages
    uses: ./.github/workflows/build-packages.yml
    with:
      versionOverrideArg: ${{ inputs.versionOverrideArg }}

  build_cli_archive_linux:
    name: Build native CLI archive (Linux)
    uses: ./.github/workflows/build-cli-native-archives.yml
    with:
      versionOverrideArg: ${{ inputs.versionOverrideArg }}
      targets: '[{"os": "ubuntu-latest", "runner": "8-core-ubuntu-latest", "rids": "linux-x64"}]'

  build_cli_archive_linux_arm64:
    name: Build native CLI archive (Linux ARM64)
    uses: ./.github/workflows/build-cli-native-archives.yml
    with:
      versionOverrideArg: ${{ inputs.versionOverrideArg }}
      targets: '[{"os": "ubuntu-latest", "runner": "ubuntu-24.04-arm", "rids": "linux-arm64"}]'

  # Per-OS CLI archive builds produce RID-specific DCP and Dashboard NuGets.
  # Split by OS so that test jobs can depend on just their platform's archive,
  # allowing Linux tests to start as soon as the Linux archive completes
  # without waiting for the slower Windows/macOS builds.
  build_cli_archive_windows:
    name: Build native CLI archive (Windows)
    uses: ./.github/workflows/build-cli-native-archives.yml
    with:
      versionOverrideArg: ${{ inputs.versionOverrideArg }}
      targets: '[{"os": "windows-latest", "runner": "windows-latest", "rids": "win-x64"}]'

  build_cli_archive_windows_arm64:
    name: Build native CLI archive (Windows ARM64)
    uses: ./.github/workflows/build-cli-native-archives.yml
    with:
      versionOverrideArg: ${{ inputs.versionOverrideArg }}
      # Use the newer VS 2026 ARM linker; the VS 2022 image fails on Aspire.Dashboard.obj with LNK1322.
      targets: '[{"os": "windows-latest", "runner": "windows-11-vs2026-arm", "rids": "win-arm64"}]'

  build_cli_archive_macos:
    name: Build native CLI archive (macOS)
    uses: ./.github/workflows/build-cli-native-archives.yml
    with:
      versionOverrideArg: ${{ inputs.versionOverrideArg }}
      targets: '[{"os": "macos-latest", "runner": "macos-latest", "rids": "osx-arm64"}]'

  build_cli_archive_macos_x64:
    name: Build native CLI archive (macOS x64)
    uses: ./.github/workflows/build-cli-native-archives.yml
    with:
      versionOverrideArg: ${{ inputs.versionOverrideArg }}
      # Cross-compile osx-x64 on the Apple Silicon (arm64) macos-latest runner
      # instead of the Intel macos-15-intel runner. The Intel runner is ~2.5x
      # slower per core and made this the long pole of the CLI build (~18m vs
      # ~8m on Apple Silicon). Native AOT officially supports arm64 -> osx-x64
      # cross-compilation, and this archive is only packaged and structurally
      # verified (verify-cli-tool-nupkg.ps1 / verify-cli-npm-package.ps1) — the
      # x64 binary is never executed here, so running it on arm64 hardware is
      # never attempted. This mirrors the AzDO release pipeline, which already
      # builds osx-x64 on an arm64 mac agent (eng/pipelines/templates/build_sign_native.yml).
      targets: '[{"os": "macos-latest", "runner": "macos-latest", "rids": "osx-x64"}]'

  prepare_winget_installer_artifacts:
    name: Prepare WinGet installer artifacts
    uses: ./.github/workflows/prepare-installer-artifacts.yml
    needs: [
      setup_for_tests,
      build_packages,
      build_cli_archive_windows,
      build_cli_archive_windows_arm64,
    ]
    if: ${{ needs.setup_for_tests.outputs.run_winget_installer == 'true' }}
    with:
      installer: winget

  prepare_homebrew_installer_artifacts:
    name: Prepare Homebrew installer artifacts
    uses: ./.github/workflows/prepare-installer-artifacts.yml
    needs: [
      setup_for_tests,
      build_packages,
      build_cli_archive_macos,
      build_cli_archive_macos_x64,
    ]
    if: ${{ needs.setup_for_tests.outputs.run_homebrew_installer == 'true' }}
    with:
      installer: homebrew

  nix_package:
    name: Nix package smoke
    runs-on: ubuntu-latest
    needs: setup_for_tests
    if: ${{ needs.setup_for_tests.outputs.run_nix_package == 'true' }}
    env:
      NIX_CONFIG: experimental-features = nix-command flakes
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Nix
        run: |
          sudo apt-get update
          sudo apt-get install -y nix-bin
          sudo git config --global --add safe.directory "$GITHUB_WORKSPACE"
          sudo --preserve-env=NIX_CONFIG nix --version

      - name: Check flake
        run: sudo --preserve-env=NIX_CONFIG nix flake check --print-build-logs

      - name: Build Aspire CLI package
        run: sudo --preserve-env=NIX_CONFIG nix build .#aspire-cli --print-build-logs

      - name: Smoke test packaged CLI
        run: |
          test "$(cat result/lib/aspire-cli/.aspire-install.json)" = '{"source":"nix"}'
          ./result/bin/aspire --version

  build_cli_e2e_image:
    name: Build CLI E2E Docker image
    uses: ./.github/workflows/build-cli-e2e-image.yml
    needs: setup_for_tests
    if: ${{ fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_cli_archive).include[0] != null }}

  tests_no_nugets:
    name: No-package tests
    uses: ./.github/workflows/run-tests.yml
    needs: setup_for_tests
    if: ${{ fromJson(needs.setup_for_tests.outputs.tests_matrix_no_nugets).include[0] != null }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.setup_for_tests.outputs.tests_matrix_no_nugets) }}
    with:
      testShortName: ${{ matrix.shortname }}
      os: ${{ matrix.runs-on }}
      testProjectPath: ${{ matrix.testProjectPath }}
      mtpBaseArgs: ${{ matrix.mtpBaseArgs }}
      extraTestArgs: "--filter-not-trait \"quarantined=true\" --filter-not-trait \"outerloop=true\" ${{ matrix.extraTestArgs }}"
      versionOverrideArg: ${{ inputs.versionOverrideArg }}
      properties: ${{ toJson(matrix.properties) }}

  # Split requires-nugets tests by OS so each group depends only on
  # the CLI archive build for its platform, avoiding cross-OS blocking.
  tests_requires_nugets_linux:
    name: Package tests - Linux
    uses: ./.github/workflows/run-tests.yml
    needs: [setup_for_tests, build_packages, build_cli_archive_linux]
    if: ${{ fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_nugets_linux).include[0] != null }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_nugets_linux) }}
    with:
      testShortName: ${{ matrix.shortname }}
      os: ${{ matrix.runs-on }}
      testProjectPath: ${{ matrix.testProjectPath }}
      mtpBaseArgs: ${{ matrix.mtpBaseArgs }}
      extraTestArgs: "--filter-not-trait \"quarantined=true\" --filter-not-trait \"outerloop=true\" ${{ matrix.extraTestArgs }}"
      versionOverrideArg: ${{ inputs.versionOverrideArg }}
      properties: ${{ toJson(matrix.properties) }}

  tests_requires_nugets_windows:
    name: Package tests - Windows
    uses: ./.github/workflows/run-tests.yml
    needs: [setup_for_tests, build_packages, build_cli_archive_windows]
    if: ${{ fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_nugets_windows).include[0] != null }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_nugets_windows) }}
    with:
      testShortName: ${{ matrix.shortname }}
      os: ${{ matrix.runs-on }}
      testProjectPath: ${{ matrix.testProjectPath }}
      mtpBaseArgs: ${{ matrix.mtpBaseArgs }}
      extraTestArgs: "--filter-not-trait \"quarantined=true\" --filter-not-trait \"outerloop=true\" ${{ matrix.extraTestArgs }}"
      versionOverrideArg: ${{ inputs.versionOverrideArg }}
      properties: ${{ toJson(matrix.properties) }}

  tests_requires_nugets_macos:
    name: Package tests - macOS
    uses: ./.github/workflows/run-tests.yml
    needs: [setup_for_tests, build_packages, build_cli_archive_macos]
    if: ${{ fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_nugets_macos).include[0] != null }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_nugets_macos) }}
    with:
      testShortName: ${{ matrix.shortname }}
      os: ${{ matrix.runs-on }}
      testProjectPath: ${{ matrix.testProjectPath }}
      mtpBaseArgs: ${{ matrix.mtpBaseArgs }}
      extraTestArgs: "--filter-not-trait \"quarantined=true\" --filter-not-trait \"outerloop=true\" ${{ matrix.extraTestArgs }}"
      versionOverrideArg: ${{ inputs.versionOverrideArg }}
      properties: ${{ toJson(matrix.properties) }}

  tests_requires_cli_archive:
    name: CLI archive tests
    uses: ./.github/workflows/run-tests.yml
    needs: [setup_for_tests, build_packages, build_cli_archive_linux, build_cli_e2e_image]
    if: ${{ fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_cli_archive).include[0] != null }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_cli_archive) }}
    with:
      testShortName: ${{ matrix.shortname }}
      os: ${{ matrix.runs-on }}
      testProjectPath: ${{ matrix.testProjectPath }}
      mtpBaseArgs: ${{ matrix.mtpBaseArgs }}
      extraTestArgs: "--filter-not-trait \"quarantined=true\" --filter-not-trait \"outerloop=true\" ${{ matrix.extraTestArgs }}"
      versionOverrideArg: ${{ inputs.versionOverrideArg }}
      properties: ${{ toJson(matrix.properties) }}

  polyglot_validation:
    name: Polyglot SDK Validation
    # Pull requests validate the current TypeScript AppHost LTS runtime. Main branch
    # builds add the older supported LTS runtime without adding that cost to every PR.
    # In audit the selector returns run_polyglot=true, so this keeps its existing event behavior;
    if: ${{ (github.event_name == 'pull_request' || github.ref == 'refs/heads/main') && (needs.setup_for_tests.outputs.run_polyglot == 'true') }}
    uses: ./.github/workflows/polyglot-validation.yml
    needs: [setup_for_tests, build_packages, build_cli_archive_linux]
    with:
      versionOverrideArg: ${{ inputs.versionOverrideArg }}

  cli_starter_validation_linux_x64:
    name: Aspire CLI Starter Validation (Ubuntu x64)
    needs: [setup_for_tests, build_packages, build_cli_archive_linux]
    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
    uses: ./.github/workflows/cli-starter-validation.yml
    with:
      runner: ubuntu-latest
      artifactSuffix: linux-x64
      maxStartupSeconds: 120
      resourceReadyTimeoutSeconds: 120
      prNumber: ${{ github.event.pull_request.number }}
      workflowRunId: ${{ github.run_id }}
      checkoutRef: ${{ github.event.pull_request.head.sha }}

  cli_starter_validation_linux_arm64:
    name: Aspire CLI Starter Validation (Ubuntu ARM64)
    needs: [setup_for_tests, build_packages, build_cli_archive_linux_arm64]
    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
    uses: ./.github/workflows/cli-starter-validation.yml
    with:
      runner: ubuntu-24.04-arm
      artifactSuffix: linux-arm64
      maxStartupSeconds: 180
      resourceReadyTimeoutSeconds: 180
      prNumber: ${{ github.event.pull_request.number }}
      workflowRunId: ${{ github.run_id }}
      checkoutRef: ${{ github.event.pull_request.head.sha }}

  cli_starter_validation_windows_x64:
    name: Aspire CLI Starter Validation (Windows x64)
    needs: [setup_for_tests, build_packages, build_cli_archive_windows]
    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
    uses: ./.github/workflows/cli-starter-validation.yml
    with:
      runner: windows-latest
      artifactSuffix: windows-x64
      maxStartupSeconds: 120
      resourceReadyTimeoutSeconds: 120
      prNumber: ${{ github.event.pull_request.number }}
      workflowRunId: ${{ github.run_id }}
      checkoutRef: ${{ github.event.pull_request.head.sha }}

  cli_starter_validation_windows_arm64:
    name: Aspire CLI Starter Validation (Windows ARM64)
    needs: [setup_for_tests, build_packages, build_cli_archive_windows_arm64]
    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
    uses: ./.github/workflows/cli-starter-validation.yml
    with:
      runner: windows-11-arm
      artifactSuffix: windows-arm64
      maxStartupSeconds: 180
      resourceReadyTimeoutSeconds: 300
      prNumber: ${{ github.event.pull_request.number }}
      workflowRunId: ${{ github.run_id }}
      checkoutRef: ${{ github.event.pull_request.head.sha }}

  cli_starter_validation_macos_x64:
    name: Aspire CLI Starter Validation (macOS x64)
    needs: [setup_for_tests, build_packages, build_cli_archive_macos_x64]
    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
    uses: ./.github/workflows/cli-starter-validation.yml
    with:
      runner: macos-15-intel
      artifactSuffix: macos-x64
      maxStartupSeconds: 180
      resourceReadyTimeoutSeconds: 180
      prNumber: ${{ github.event.pull_request.number }}
      workflowRunId: ${{ github.run_id }}
      checkoutRef: ${{ github.event.pull_request.head.sha }}

  cli_starter_validation_macos_arm64:
    name: Aspire CLI Starter Validation (macOS ARM64)
    needs: [setup_for_tests, build_packages, build_cli_archive_macos]
    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
    uses: ./.github/workflows/cli-starter-validation.yml
    with:
      runner: macos-latest
      artifactSuffix: macos-arm64
      maxStartupSeconds: 120
      resourceReadyTimeoutSeconds: 120
      prNumber: ${{ github.event.pull_request.number }}
      workflowRunId: ${{ github.run_id }}
      checkoutRef: ${{ github.event.pull_request.head.sha }}

  extension_tests_win:
    name: Run VS Code extension unit tests (Windows)
    uses: ./.github/workflows/extension-unit-tests.yml
    needs: [setup_for_tests]
    # Also gated on run_extension_e2e (not just run_extension_unit): this job packages and uploads
    # the aspire-extension VSIX that extension_e2e_tests installs. The focused workflow preserves
    # packaging after unit-test failures so E2E
    # still receives its VSIX and provides an independent signal.
    if: ${{ needs.setup_for_tests.outputs.run_extension_unit == 'true' || needs.setup_for_tests.outputs.run_extension_e2e == 'true' }}
    with:
      packageVsix: true
      extensionVersionOverride: ${{ inputs.extensionVersionOverride }}

  extension_bootstrap_linux:
    name: Validate VS Code extension bootstrap (Linux)
    # Without this, the non-Windows code paths in
    # extension/scripts/prepareCorepackYarn.mjs (npm invocation that does not go
    # through node.exe, POSIX tar) are only exercised on contributor machines
    # and never on a fresh CI image. extension_tests_win covers the Windows
    # paths; this job covers Linux/macOS. macOS is omitted because the only
    # platform-specific branch beyond Linux is the cache path, which is
    # explicitly overridden via COREPACK_HOME in the build entrypoints.
    runs-on: ubuntu-latest
    needs: [setup_for_tests]
    if: ${{ needs.setup_for_tests.outputs.run_extension_unit == 'true' || needs.setup_for_tests.outputs.run_extension_e2e == 'true' }}
    env:
      NPM_REGISTRY: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
      COREPACK_ENABLE_DOWNLOAD_PROMPT: 0
    defaults:
      run:
        working-directory: ./extension
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup Node.js environment
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: '22.x'
      - name: Install Corepack
        run: |
          set -euo pipefail
          # Scope Corepack's cache to this job. Set via $GITHUB_ENV because the
          # `runner` context is not available in job-level env evaluation.
          export COREPACK_HOME="$RUNNER_TEMP/corepack"
          echo "COREPACK_HOME=$COREPACK_HOME" >> "$GITHUB_ENV"

          CorepackVersion="$(tr -d '[:space:]' < scripts/corepack-version.txt)"
          npm install --global --force --registry "$NPM_REGISTRY" "corepack@${CorepackVersion}"

          installed="$(corepack --version 2>/dev/null || true)"
          if [ "$installed" != "$CorepackVersion" ]; then
            echo "corepack version mismatch: expected $CorepackVersion, got '$installed'. The bundled Corepack on PATH may be taking precedence over the npm-global install."
            exit 1
          fi

          corepack enable
      - name: Seed Corepack Yarn cache via prepareCorepackYarn.mjs
        # Exercises the script's non-Windows branches against a clean cache
        # directory. Failing here means a contributor on Linux/macOS following
        # CONTRIBUTING.MD would also be broken.
        run: node ./scripts/prepareCorepackYarn.mjs
      - name: Validate lockfile registries
        # Mirror of the same allowlist guard in extension_tests_win so this
        # cross-platform bootstrap also catches drift to a public-registry URL.
        run: |
          node -e "const fs = require('fs'); const allow = 'pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm'; const bad = fs.readFileSync('yarn.lock', 'utf8').split(/\r?\n/).filter(l => /^\s*resolved\s+\x22/.test(l)).filter(l => !l.includes(allow)); if (bad.length) { throw new Error('extension/yarn.lock contains resolved entries outside the internal dotnet-public-npm feed. Regenerate it through the internal feed before restoring. First offender -> ' + bad[0]); }"
      - name: Validate seeded cache via yarn install
        run: corepack yarn install --frozen-lockfile --non-interactive

  extension_e2e_tests:
    name: Run VS Code extension E2E tests
    uses: ./.github/workflows/extension-e2e-tests.yml
    # extension_tests_win stays in `needs` because it uploads the aspire-extension VSIX these shards
    # install, but E2E is deliberately not gated on its unit-test *result*: !cancelled() keeps the
    # shards running when those tests fail, and the VSIX packaging steps in that job carry the same
    # condition so the artifact is published either way. Before this, one unit failure - or an npm
    # blip on that single Windows runner - skipped all 30 shards and erased the E2E signal entirely.
    # The remaining producers are still required by result, since a missing CLI archive or package
    # feed makes every shard fail on a download rather than tell us anything.
    if: >-
      ${{ !cancelled() &&
          needs.setup_for_tests.outputs.run_extension_e2e == 'true' &&
          needs.build_packages.result == 'success' &&
          needs.build_cli_archive_linux.result == 'success' &&
          needs.build_cli_archive_windows.result == 'success' &&
          needs.extension_bootstrap_linux.result == 'success' }}
    needs: [setup_for_tests, build_packages, build_cli_archive_linux, build_cli_archive_windows, extension_tests_win, extension_bootstrap_linux]

  typescript_sdk_tests:
    name: TypeScript SDK Unit Tests
    needs: [setup_for_tests]
    if: ${{ needs.setup_for_tests.outputs.run_typescript_sdk == 'true' }}
    uses: ./.github/workflows/typescript-sdk-tests.yml

  typescript_api_compat:
    name: TypeScript API Compatibility
    needs: [setup_for_tests]
    if: ${{ needs.setup_for_tests.outputs.run_typescript_api_compat == 'true' }}
    uses: ./.github/workflows/typescript-api-compat.yml

  results:
    if: ${{ always() && github.repository_owner == 'microsoft' }}
    runs-on: ubuntu-latest
    name: Final Test Results
    needs: [
      setup_for_tests,
      build_packages,
      build_cli_archive_linux,
      build_cli_archive_linux_arm64,
      build_cli_archive_windows,
      build_cli_archive_windows_arm64,
      build_cli_archive_macos,
      build_cli_archive_macos_x64,
      prepare_winget_installer_artifacts,
      prepare_homebrew_installer_artifacts,
      nix_package,
      build_cli_e2e_image,
      extension_tests_win,
      extension_e2e_tests,
      extension_bootstrap_linux,
      cli_starter_validation_linux_x64,
      cli_starter_validation_linux_arm64,
      cli_starter_validation_windows_x64,
      cli_starter_validation_windows_arm64,
      cli_starter_validation_macos_x64,
      cli_starter_validation_macos_arm64,
      typescript_sdk_tests,
      typescript_api_compat,
      tests_no_nugets,
      tests_requires_nugets_linux,
      tests_requires_nugets_windows,
      tests_requires_nugets_macos,
      tests_requires_cli_archive,
      polyglot_validation,
    ]
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Create test results directory
        shell: bash
        run: mkdir -p "${{ github.workspace }}/testresults"

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: logs-*-ubuntu-latest
          merge-multiple: true
          path: ${{ github.workspace }}/testresults/ubuntu-latest

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: logs-*-windows-latest
          merge-multiple: true
          path: ${{ github.workspace }}/testresults/windows-latest

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: logs-*-macos-latest
          merge-multiple: true
          path: testresults/macos-latest

      - name: Upload test results
        if: ${{ always() }}
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: All-TestResults
          path: ${{ github.workspace }}/testresults/**/*.trx

      - name: Generate test results summary
        if: ${{ always() }}
        shell: bash
        run: |
          ${{ github.workspace }}/dotnet.sh \
            run \
            --project ${{ github.workspace }}/tools/GenerateTestSummary/GenerateTestSummary.csproj \
            -- \
            ${{ github.workspace }}/testresults \
            --combined

      - name: Generate CI timeline
        if: ${{ always() }}
        continue-on-error: true
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          ${{ github.workspace }}/dotnet.sh run \
            --project ${{ github.workspace }}/tools/GenerateCITimeline/GenerateCITimeline.csproj \
            -- \
            --repo ${{ github.repository }} \
            --min-total 8

      - name: Fail if any dependency failed
        # 'skipped' can be when a transitive dependency fails and the dependent job gets 'skipped'.
        # For example, one of setup_* jobs failing and the dependent test jobs getting 'skipped'.
        # Some jobs are optional and can have an empty matrix. In those cases we allow a 'skipped'
        # result. Specifically:
        # - the test-bucket jobs (tests_no_nugets, tests_requires_nugets_{linux,windows,macos},
        #   tests_requires_cli_archive): selective CI routes a PR's changes to a subset of buckets, so
        #   any bucket can be legitimately empty -> its job is 'skipped'. Each is therefore gated on its
        #   matrix being non-empty (include[0] != null); a 'skipped' result is only a failure when the
        #   bucket actually had work. Before selective CI these were always populated on a full run.
        # - cli_starter_validation_*: these jobs run on pull requests when the selector routes the
        #   change to job:cli-starter-validation, and are expected to be skipped otherwise (a
        #   non-selecting PR, or any other workflow event).
        # - extension_e2e_tests: this job only runs when the PR/push changes the VS Code extension,
        #   Aspire CLI, or the extension E2E workflow wiring.
        # - polyglot_validation: this job runs for pull requests and main branch builds; it is
        #   expected to be skipped for other workflow events.
        # All other jobs in this gate are required, and a 'skipped' result is treated as a failure.
        if: >-
          ${{ always() &&
              (contains(needs.*.result, 'failure') ||
               contains(needs.*.result, 'cancelled') ||
               ((github.event_name == 'pull_request' &&
                ((needs.extension_tests_win.result == 'skipped' && (needs.setup_for_tests.outputs.run_extension_unit == 'true' || needs.setup_for_tests.outputs.run_extension_e2e == 'true')) ||
                 (needs.setup_for_tests.outputs.run_extension_e2e == 'true' &&
                  needs.extension_e2e_tests.result == 'skipped') ||
                 (needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' &&
                  (needs.cli_starter_validation_linux_x64.result == 'skipped' ||
                   needs.cli_starter_validation_linux_arm64.result == 'skipped' ||
                   needs.cli_starter_validation_windows_x64.result == 'skipped' ||
                   needs.cli_starter_validation_windows_arm64.result == 'skipped' ||
                   needs.cli_starter_validation_macos_x64.result == 'skipped' ||
                   needs.cli_starter_validation_macos_arm64.result == 'skipped')) ||
                 (needs.typescript_sdk_tests.result == 'skipped' &&
                  (needs.setup_for_tests.outputs.run_typescript_sdk == 'true')) ||
                 (needs.typescript_api_compat.result == 'skipped' &&
                  (needs.setup_for_tests.outputs.run_typescript_api_compat == 'true')) ||
                 needs.build_cli_archive_macos_x64.result == 'skipped' ||
                 (needs.prepare_winget_installer_artifacts.result == 'skipped' && (needs.setup_for_tests.outputs.run_winget_installer == 'true')) ||
                 (needs.prepare_homebrew_installer_artifacts.result == 'skipped' && (needs.setup_for_tests.outputs.run_homebrew_installer == 'true')) ||
                 (needs.nix_package.result == 'skipped' && (needs.setup_for_tests.outputs.run_nix_package == 'true')) ||
                 (fromJson(needs.setup_for_tests.outputs.tests_matrix_no_nugets).include[0] != null &&
                  needs.tests_no_nugets.result == 'skipped') ||
                 (fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_nugets_linux).include[0] != null &&
                  needs.tests_requires_nugets_linux.result == 'skipped') ||
                 (fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_nugets_windows).include[0] != null &&
                  needs.tests_requires_nugets_windows.result == 'skipped') ||
                 (fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_nugets_macos).include[0] != null &&
                  needs.tests_requires_nugets_macos.result == 'skipped') ||
                 (fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_cli_archive).include[0] != null &&
                  needs.build_cli_e2e_image.result == 'skipped') ||
                 (fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_cli_archive).include[0] != null &&
                  needs.tests_requires_cli_archive.result == 'skipped') ||
                 (needs.polyglot_validation.result == 'skipped' && (needs.setup_for_tests.outputs.run_polyglot == 'true')))) ||
               (github.event_name != 'pull_request' &&
                ((needs.extension_tests_win.result == 'skipped' && (needs.setup_for_tests.outputs.run_extension_unit == 'true' || needs.setup_for_tests.outputs.run_extension_e2e == 'true')) ||
                 (needs.setup_for_tests.outputs.run_extension_e2e == 'true' &&
                  needs.extension_e2e_tests.result == 'skipped') ||
                 (needs.typescript_sdk_tests.result == 'skipped' &&
                  (needs.setup_for_tests.outputs.run_typescript_sdk == 'true')) ||
                 needs.build_cli_archive_macos_x64.result == 'skipped' ||
                 (needs.prepare_winget_installer_artifacts.result == 'skipped' && (needs.setup_for_tests.outputs.run_winget_installer == 'true')) ||
                 (needs.prepare_homebrew_installer_artifacts.result == 'skipped' && (needs.setup_for_tests.outputs.run_homebrew_installer == 'true')) ||
                 (needs.nix_package.result == 'skipped' && (needs.setup_for_tests.outputs.run_nix_package == 'true')) ||
                 (fromJson(needs.setup_for_tests.outputs.tests_matrix_no_nugets).include[0] != null &&
                  needs.tests_no_nugets.result == 'skipped') ||
                 (fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_nugets_linux).include[0] != null &&
                  needs.tests_requires_nugets_linux.result == 'skipped') ||
                 (fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_nugets_windows).include[0] != null &&
                  needs.tests_requires_nugets_windows.result == 'skipped') ||
                 (github.ref == 'refs/heads/main' &&
                  (needs.polyglot_validation.result == 'skipped' && (needs.setup_for_tests.outputs.run_polyglot == 'true'))) ||
                 (fromJson(needs.setup_for_tests.outputs.tests_matrix_requires_nugets_macos).include[0] != null &&
                  needs.tests_requires_nugets_macos.result == 'skipped'))))) }}
        run: |
          echo "One or more dependent jobs failed."
          exit 1