test.yml

on:
  workflow_call:
    inputs:
      save-rust-cache:
        required: false
        type: string
        default: "true"
      test-macos:
        required: false
        type: string
        default: "false"

permissions:
  contents: read

env:
  CARGO_INCREMENTAL: 0
  CARGO_NET_RETRY: 10
  CARGO_TERM_COLOR: always
  PYTHON_VERSION: "3.12"
  RUSTC_BOOTSTRAP: 1
  RUSTUP_MAX_RETRIES: 10
  UV_LOCKED: 1

jobs:
  # We use the large GitHub actions runners
  # For Ubuntu and Windows, this requires Organization-level configuration
  # See: https://docs.github.com/en/actions/using-github-hosted-runners/about-larger-runners/about-larger-runners#about-ubuntu-and-windows-larger-runners

  cargo-test-linux:
    timeout-minutes: 10
    runs-on: depot-ubuntu-24.04-16
    name: "cargo test on linux"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: "Install Rust toolchain"
        run: rustup toolchain install --profile minimal

      - uses: astral-sh/github-actions/rust-workspace-cache@52ea66bbf7dbe95fc9e2baae530cb3827214c530
        with:
          prefix-key: v1-rust-workspace
          key: ${{ hashFiles('Cargo.toml') }}
          profile: fast-build-nightly
          save-if: ${{ inputs.save-rust-cache == 'true' }}

      - name: "Configure Python archive cache"
        # Share archives downloaded during setup with the tests.
        run: echo "UV_PYTHON_CACHE_DIR=$RUNNER_TEMP/uv-python-cache" >> "$GITHUB_ENV"

      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
        with:
          # renovate: datasource=github-release-attachments depName=astral-sh/uv
          version: "0.13.5"
          checksum: "f68d291c75783122dad58ab77def0e13f3233f358731db5d6d7e8715603b928f"

      - name: "Install required Python versions"
        env:
          UV_PYTHON_DOWNLOADS_JSON_URL: crates/uv-python-managed/download-metadata.json
        run: |
          uv python install
          # Warm the cache for Unix-only tests
          uv python install 3.12d 3.13d 3.13t 3.13td

      - name: "Install Linux test dependencies"
        run: |
          # Try the next configured mirror after the first failed download.
          cat /etc/apt/apt-mirrors.txt
          printf '%s\n' \
            'Acquire::Retries "0";' \
            'Acquire::http::Timeout "10";' \
            'Acquire::https::Timeout "10";' \
            | sudo tee /etc/apt/apt.conf.d/80-retries > /dev/null
          # Use Ubuntu's Git and matching libcurl to avoid credential failures in private-repository tests.
          sudo apt install -y --no-install-recommends --allow-downgrades \
            git/noble-updates git-man/noble-updates libcurl3t64-gnutls/noble-updates gnome-keyring

      - name: "Start gnome-keyring"
        # run gnome-keyring with 'foobar' as password for the login keyring
        # this will create a new login keyring and unlock it
        # the login password doesn't matter, but the keyring must be unlocked for the tests to work
        run: gnome-keyring-daemon --components=secrets --daemonize --unlock <<< 'foobar'

      - name: "Create btrfs filesystem"
        run: |
          sudo apt install -y btrfs-progs
          truncate -s 1G /tmp/btrfs.img
          mkfs.btrfs /tmp/btrfs.img
          sudo mkdir /btrfs
          sudo mount -o loop /tmp/btrfs.img /btrfs
          sudo chown "$(id -u):$(id -g)" /btrfs

      - name: "Create tmpfs filesystem"
        run: |
          sudo mkdir /tmpfs
          sudo mount -t tmpfs -o size=256m tmpfs /tmpfs
          sudo chown "$(id -u):$(id -g)" /tmpfs

      - name: "Create minix filesystem (low hardlink limit)"
        run: |
          truncate -s 16M /tmp/minix.img
          mkfs.minix /tmp/minix.img
          sudo mkdir /minix
          sudo mount -o loop /tmp/minix.img /minix
          sudo chown "$(id -u):$(id -g)" /minix

      - name: "Cargo test"
        env:
          # Retry more than default to reduce flakes in CI
          UV_HTTP_RETRIES: 5
          RUST_BACKTRACE: 1
          UV_INTERNAL__TEST_COW_FS: /btrfs
          UV_INTERNAL__TEST_NOCOW_FS: /tmpfs
          UV_INTERNAL__TEST_ALT_FS: /tmpfs
          UV_INTERNAL__TEST_LOWLINKS_FS: /minix
          # Write pending snapshots to a separate directory for artifact upload
          INSTA_UPDATE: new
          INSTA_PENDING_DIR: ${{ github.workspace }}/pending-snapshots
        run: |
          uv run --only-group test cargo nextest run --locked \
            --cargo-profile fast-build-nightly \
            -Z panic-abort-tests \
            -Z checksum-freshness \
            --features test-python-patch,test-universal,native-auth,secret-service \
            --workspace \
            --profile ci-linux

      - name: "Upload pending snapshots"
        if: ${{ failure() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: pending-snapshots-linux
          path: pending-snapshots/
          if-no-files-found: ignore
          include-hidden-files: true
          retention-days: 14

      - name: "Upload JUnit results"
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-results-linux
          path: target/nextest/ci*/junit.xml
          if-no-files-found: ignore
          retention-days: 14

  cargo-test-macos:
    timeout-minutes: 20
    # Only run macOS tests on main without opt-in
    if: ${{ inputs.test-macos == 'true' }}
    runs-on: namespace-profile-macos-15
    name: "cargo test on macos"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: "Install Rust toolchain"
        run: rustup toolchain install --profile minimal

      - uses: astral-sh/github-actions/rust-workspace-cache@3c9fe5db47e144ea224b57565e3ab1ab769ef41d
        with:
          prefix-key: v1-rust-workspace
          key: ${{ hashFiles('Cargo.toml') }}
          profile: fast-build-nightly
          save-if: ${{ inputs.save-rust-cache == 'true' }}

      - name: "Create HFS+ disk image (no reflink support)"
        run: |
          hdiutil create -size 256m -fs HFS+ -volname NoReflink /tmp/noreflink.dmg
          hdiutil attach /tmp/noreflink.dmg
          echo "HFS_MOUNT=/Volumes/NoReflink" >> "$GITHUB_ENV"

      - name: "Create CI keychain"
        # Namespace macOS runners do not start with an unlocked default user keychain. Create an
        # empty-password keychain for native-auth tests; GitHub and Depot runners provide one.
        run: |
          security create-keychain -p "" "$RUNNER_TEMP/uv-ci.keychain-db"
          security set-keychain-settings -lut 21600 "$RUNNER_TEMP/uv-ci.keychain-db"
          security unlock-keychain -p "" "$RUNNER_TEMP/uv-ci.keychain-db"
          security list-keychains -d user -s "$RUNNER_TEMP/uv-ci.keychain-db"
          security default-keychain -d user -s "$RUNNER_TEMP/uv-ci.keychain-db"

      - name: "Configure Python archive cache"
        run: echo "UV_PYTHON_CACHE_DIR=$RUNNER_TEMP/uv-python-cache" >> "$GITHUB_ENV"

      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
        with:
          # renovate: datasource=github-release-attachments depName=astral-sh/uv
          version: "0.13.5"
          checksum: "743f85035a1996ecb350659e01cd9faea9709829be09b1b4b03c73eaf3c9cd73"

      - name: "Install required Python versions"
        env:
          UV_PYTHON_DOWNLOADS_JSON_URL: crates/uv-python-managed/download-metadata.json
        run: |
          uv python install
          # Warm the cache for Unix-only tests
          uv python install 3.12d 3.13d 3.13t 3.13td

      - name: "Cargo test"
        env:
          # Retry more than default to reduce flakes in CI
          UV_HTTP_RETRIES: 5
          RUST_BACKTRACE: 1
          # macOS tmpdir is on APFS which supports reflink
          UV_INTERNAL__TEST_COW_FS: ${{ runner.temp }}
          # HFS+ RAM disk does not support copy-on-write and is on a different device
          UV_INTERNAL__TEST_NOCOW_FS: ${{ env.HFS_MOUNT }}
          UV_INTERNAL__TEST_ALT_FS: ${{ env.HFS_MOUNT }}
          # Write pending snapshots to a separate directory for artifact upload
          INSTA_UPDATE: new
          INSTA_PENDING_DIR: ${{ github.workspace }}/pending-snapshots
        run: |
          uv run --only-group test cargo nextest run --locked \
            --cargo-profile fast-build-nightly \
            -Z panic-abort-tests \
            -Z checksum-freshness \
            --no-default-features \
            --features test-python,test-python-managed,test-pypi,test-git,test-git-lfs,performance,test-crates-io,native-auth,apple-native \
            --workspace \
            --profile ci-macos

      - name: "Upload pending snapshots"
        if: ${{ failure() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: pending-snapshots-macos
          path: pending-snapshots/
          if-no-files-found: ignore
          include-hidden-files: true
          retention-days: 14

      - name: "Upload JUnit results"
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-results-macos
          path: target/nextest/ci*/junit.xml
          if-no-files-found: ignore
          retention-days: 14

  cargo-test-windows:
    timeout-minutes: 15
    runs-on: namespace-profile-windows-2022-x86-64-16x32
    name: "cargo test on windows ${{ matrix.partition }} of 3"
    strategy:
      fail-fast: false
      matrix:
        partition: [1, 2, 3]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Dev Drive
        run: ${{ github.workspace }}/.github/workflows/setup-dev-drive.ps1

      # actions/checkout does not let us clone into anywhere outside ${{ github.workspace }}, so we have to copy the clone...
      - name: Copy Git Repo to Dev Drive
        run: |
          Copy-Item -Path "${{ github.workspace }}" -Destination "$Env:UV_WORKSPACE" -Recurse

      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
        with:
          # renovate: datasource=github-release-attachments depName=astral-sh/uv
          version: "0.13.5"
          checksum: "a38b8d1902b7cfbc76b423ba1bb456f623f42064cdc72628b6075b89afd1019a"

      - name: "Install required Python versions"
        env:
          UV_PYTHON_DOWNLOADS_JSON_URL: crates/uv-python-managed/download-metadata.json
        run: uv python install

      - name: "Install Rust toolchain"
        working-directory: ${{ env.UV_WORKSPACE }}
        run: rustup toolchain install --profile minimal

      - uses: astral-sh/github-actions/rust-workspace-cache@3c9fe5db47e144ea224b57565e3ab1ab769ef41d
        with:
          prefix-key: v1-rust-workspace
          key: ${{ hashFiles('Cargo.toml') }}
          workspace: ${{ env.UV_WORKSPACE }}
          profile: fast-build-nightly
          # Use the same cache entry across the partitions
          add-job-id-key: false
          save-if: ${{ inputs.save-rust-cache == 'true' }}

      - name: "Create NTFS test directory (low hardlink limit)"
        run: New-Item -Path "C:\uv" -ItemType Directory -Force

      - name: "Create SMB test share (alternative filesystem)"
        run: |
          New-Item -Path "C:\uv-smb" -ItemType Directory -Force
          New-SmbShare -Name "uv-alt-fs" -Path "C:\uv-smb" -FullAccess "Everyone"

      - name: "Cargo test"
        working-directory: ${{ env.UV_WORKSPACE }}
        env:
          # Retry more than default to reduce flakes in CI
          UV_HTTP_RETRIES: 5
          # Avoid permission errors during concurrent tests
          # See https://github.com/astral-sh/uv/issues/6940
          UV_LINK_MODE: copy
          RUST_BACKTRACE: 1
          UV_INTERNAL__TEST_ALT_FS: "\\\\localhost\\uv-alt-fs"
          UV_INTERNAL__TEST_SMB_FS: "\\\\localhost\\uv-alt-fs"
          UV_INTERNAL__TEST_LOWLINKS_FS: "C:\\uv"
          # Write pending snapshots to a separate directory for artifact upload
          INSTA_UPDATE: new
          INSTA_PENDING_DIR: ${{ github.workspace }}/pending-snapshots
        shell: bash
        run: |
          uv run --only-group test cargo nextest run --locked \
            --cargo-profile fast-build-nightly \
            -Z panic-abort-tests \
            -Z checksum-freshness \
            --no-default-features \
            --features test-python,test-pypi,test-python-managed,test-windows-registry,native-auth,windows-native \
            --workspace \
            --profile ci-windows \
            --partition hash:${{ matrix.partition }}/3

      - name: "Upload pending snapshots"
        if: ${{ failure() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: pending-snapshots-windows-${{ matrix.partition }}
          path: pending-snapshots/
          if-no-files-found: ignore
          include-hidden-files: true
          retention-days: 14

      - name: "Upload JUnit results"
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: junit-results-windows-${{ matrix.partition }}
          path: ${{ env.UV_WORKSPACE }}/target/nextest/ci*/junit.xml
          if-no-files-found: ignore
          retention-days: 14