mattermost/.github/workflows/server-ci-report.yml

# Server CI Report can be triggered by any branch, but always runs on the default branch.
# That means changes to this file won't reflect in a pull request but must first be merged.
name: Server CI Report

on:
  workflow_run:
    workflows:
      - Server CI
    types:
      - completed

jobs:
  generate-report-matrix:
    runs-on: ubuntu-22.04
    outputs:
      REPORT_MATRIX: ${{ steps.report.outputs.REPORT_MATRIX }}
    steps:
      - name: report/download-artifacts-from-PR-workflow
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ github.token }}
          pattern: "*-test-logs"
          path: reports

      - name: report/validate-and-prepare-data
        id: validate
        run: |
          # Create validated data file
          > /tmp/validated-tests.json

          find "reports" -type f -name "test-name" | while read -r test_file; do
            folder=$(basename "$(dirname "$test_file")")
            test_name_raw=$(cat "$test_file" | tr -d '\n\r')

            # Validate test name: allow alphanumeric, spaces, hyphens, underscores, parentheses, and dots
            if [[ "$test_name_raw" =~ ^[a-zA-Z0-9\ \(\)_.-]+$ ]] && [[ ${#test_name_raw} -le 100 ]]; then
              # Use jq to safely escape the test name as JSON
              test_name_escaped=$(echo -n "$test_name_raw" | jq -R .)
              echo "{\"artifact\": \"$folder\", \"name\": $test_name_escaped}" >> /tmp/validated-tests.json
            else
              echo "Warning: Skipping invalid test name in $test_file: '$test_name_raw'" >&2
            fi
          done

          # Verify we have at least some valid tests
          if [[ ! -s /tmp/validated-tests.json ]]; then
            echo "Error: No valid test names found" >&2
            exit 1
          fi          

      - name: report/generate-report-matrix
        id: report
        run: |
          # Convert validated JSON objects to matrix format
          jq -s '{ "test": . }' /tmp/validated-tests.json | tee /tmp/report-matrix
          echo REPORT_MATRIX=$(cat /tmp/report-matrix | jq --compact-output --monochrome-output) >> ${GITHUB_OUTPUT}          

  publish-report:
    runs-on: ubuntu-22.04
    name: Publish Report ${{ matrix.test.name }}
    needs:
      - generate-report-matrix
    permissions:
      pull-requests: write
      checks: write
      issues: write
    strategy:
      matrix: ${{ fromJson(needs.generate-report-matrix.outputs.REPORT_MATRIX) }}
    steps:
      - name: report/download-artifacts-from-PR-workflow
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ github.token }}
          name: ${{ matrix.test.artifact }}
          path: ${{ matrix.test.artifact }}
      - name: report/fetch-pr-number
        if: github.event.workflow_run.event == 'pull_request'
        id: incoming-pr
        env:
          ARTIFACT: "${{ matrix.test.artifact }}"
        run: |
          if [[ -f "$ARTIFACT/pr-number" ]]; then
            pr_number=$(cat "$ARTIFACT/pr-number" | tr -d '\n\r' | grep -E '^[0-9]+$')
            if [[ -n "$pr_number" ]] && [[ ${#pr_number} -le 10 ]]; then
              echo "NUMBER=$pr_number" >> ${GITHUB_OUTPUT}
            else
              echo "Invalid PR number format" >&2
              exit 1
            fi
          else
            echo "PR number file not found" >&2
            exit 1
          fi          
      - name: Publish test report
        id: report
        uses: mikepenz/action-junit-report@3a81627bfac62268172037048872e8ebd4207e6d # v6.4.1
        with:
          report_paths: ${{ matrix.test.artifact }}/report.xml
          check_name: ${{ matrix.test.name }} (Results)
          job_name: ${{ matrix.test.name }}
          commit: ${{ github.event.workflow_run.head_commit.id }}
          require_tests: true
          check_retries: true
          flaky_summary: true
          include_passed: true
          check_annotations: true

      - name: Report retried tests (pull request)
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        if: ${{ steps.report.outputs.flaky_summary != '<table><tr><th>Test</th><th>Retries</th></tr></table>' && steps.report.outputs.failed == '0' && github.event.workflow_run.event == 'pull_request' }}
        env:
          TEST_NAME: "${{ matrix.test.name }}"
          FLAKY_SUMMARY: "${{ steps.report.outputs.flaky_summary }}"
          PR_NUMBER: "${{ steps.incoming-pr.outputs.NUMBER }}"
        with:
          script: |
            const body = `#### ⚠️  One or more flaky tests detected ⚠️\n* Workflow run: [github.com/mattermost/mattermost:${process.env.TEST_NAME}](${{ github.event.workflow_run.html_url }})\n* Double check your code to ensure you have not introduced a flaky test.\n\n${process.env.FLAKY_SUMMARY}`

            await github.rest.issues.createComment({
              issue_number: process.env.PR_NUMBER,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: body
            })            

      - name: Report retried tests to flaky-test webhook (pull request)
        if: >-
          steps.report.outputs.flaky_summary != '<table><tr><th>Test</th><th>Retries</th></tr></table>'
          && steps.report.outputs.failed == '0'
          && github.event.workflow_run.event == 'pull_request'
          && env.WEBHOOK_URL_FLAKY_TEST != ''
          && env.WEBHOOK_AUTH_TOKEN_FLAKY_TEST != ''          
        continue-on-error: true
        env:
          WEBHOOK_URL_FLAKY_TEST: ${{ secrets.WEBHOOK_URL_FLAKY_TEST }}
          WEBHOOK_AUTH_TOKEN_FLAKY_TEST: ${{ secrets.WEBHOOK_AUTH_TOKEN_FLAKY_TEST }}
          FLAKY_SUMMARY: ${{ steps.report.outputs.flaky_summary }}
          PR_NUMBER: ${{ steps.incoming-pr.outputs.NUMBER }}
          REPO: ${{ github.repository }}
        run: |
          PAYLOAD=$(jq -n \
            --arg repo "$REPO" \
            --arg pr_number "$PR_NUMBER" \
            --arg flaky_summary "$FLAKY_SUMMARY" \
            '{repo:$repo, pr_number:$pr_number, flaky_summary:$flaky_summary}')

          curl -X POST -fsSL \
            --connect-timeout 5 \
            --max-time 30 \
            -H "Content-Type: application/json" \
            -H "Authorization: Bearer $WEBHOOK_AUTH_TOKEN_FLAKY_TEST" \
            -d "$PAYLOAD" \
            "$WEBHOOK_URL_FLAKY_TEST"