test.yml

name: ci

on:
  pull_request:
    branches:
      - master
  push:
    branches:
      - master

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  lint:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: oven-sh/setup-bun@v2

      - uses: actions/setup-node@v7
        with:
          node-version: '24.x'
          registry-url: 'https://registry.npmjs.org'

      - name: Install Dependency
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bun install --frozen-lockfile

      - name: Run lint and typecheck
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bun run lint

  test:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: oven-sh/setup-bun@v2

      - uses: actions/setup-node@v7
        with:
          node-version: '24.x'
          registry-url: 'https://registry.npmjs.org'

      - name: Install Dependency
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bun install --frozen-lockfile

      - name: Run unit tests with coverage
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bun run test:coverage

      - name: Upload coverage artifact
        uses: actions/upload-artifact@v7
        with:
          name: coverage
          path: coverage
          if-no-files-found: error

  node18-smoke:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: oven-sh/setup-bun@v2

      - name: Install Dependency
        run: bun install --frozen-lockfile

      - name: Build package
        run: bun run build

      # Node 18 goes on PATH only after the build: typescript >= 7 ships an
      # extensionless ESM bin/tsc that Node 18.17 cannot load.
      - name: Set up the oldest supported Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '18.17.0'

      - name: Load every built module and run the offline commands
        run: node scripts/smoke-lib.js

      - name: Check late abort errors on the oldest supported Node.js
        run: >-
          node tests/fixtures/hermes-async-check.cjs
          '{"operation":"abort","modulePath":"./lib/utils/hermes-base.js"}'

      - name: Check debug-output failure cleanup on Node 18
        env:
          HERMES_TEST_NODE: node
        run: bun test tests/hermes-blockers.test.ts

  publish-dry-run:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: oven-sh/setup-bun@v2

      - uses: actions/setup-node@v7
        with:
          node-version: '24.x'
          registry-url: 'https://registry.npmjs.org'

      - name: Install Dependency
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bun install --frozen-lockfile

      - name: Prepare dry run publish version
        env:
          PUBLISH_DRY_RUN: 'true'
          PUBLISH_VERSION: 0.0.0-dry-run.${{ github.run_id }}.${{ github.run_attempt }}
        run: bun scripts/prepublish.ts

      - name: Dry run publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npm publish --dry-run --access public --tag dry-run

  hermes-integration:
    name: hermes-hbc-${{ matrix.hbc }}${{ matrix.suffix }}
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        include:
          - hbc: 96
            suffix: ""
            package: react-native@0.77.3
            directory: react-native
            executable: sdks/hermesc/linux64-bin/hermesc
          - hbc: 98
            suffix: ""
            package: hermes-compiler@250829098.0.16
            directory: hermes-compiler
            executable: hermesc/linux64-bin/hermesc
          - hbc: 98
            suffix: -patch17
            package: hermes-compiler@250829098.0.17
            directory: hermes-compiler
            executable: hermesc/linux64-bin/hermesc
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: oven-sh/setup-bun@v2
      - uses: actions/setup-node@v7
        with:
          node-version: '24.x'
      - run: bun install --frozen-lockfile
      - name: Install the pinned real compiler
        shell: bash
        env:
          COMPILER_PACKAGE: ${{ matrix.package }}
          COMPILER_DIRECTORY: ${{ matrix.directory }}
          COMPILER_EXECUTABLE: ${{ matrix.executable }}
          EXPECTED_HBC: ${{ matrix.hbc }}
        run: |
          set -euo pipefail
          root="$RUNNER_TEMP/hermes-tests/$COMPILER_DIRECTORY"
          mkdir -p "$root"
          archive=$(npm pack "$COMPILER_PACKAGE" --pack-destination "$RUNNER_TEMP" --silent)
          tar -xzf "$RUNNER_TEMP/$archive" --strip-components=1 -C "$root" \
            "package/$COMPILER_EXECUTABLE" package/package.json
          export HERMESC="$root/$COMPILER_EXECUTABLE"
          test -x "$HERMESC"
          "$HERMESC" -version
          bun -e 'import {probeHbcVersion} from "./src/utils/hermes-base"; if (probeHbcVersion(process.env.HERMESC) !== Number(process.env.EXPECTED_HBC)) throw new Error("unexpected HBC version");'
          echo "HERMESC=$HERMESC" >> "$GITHUB_ENV"
      - name: Fetch pinned real Metro fixtures
        shell: bash
        run: |
          set -euo pipefail
          root="$RUNNER_TEMP/hermes-metro-fixtures"
          mkdir -p "$root"
          base="https://raw.githubusercontent.com/sunnylqm/hbc-diff-benchmark/e6a870a1c26c4b64c7860d7e1aa575707d22ad88"
          for file in base.jsbundle s3-medium-feature.jsbundle; do
            curl --fail --location --retry 2 --max-time 60 "$base/fixtures/$file" -o "$root/$file"
          done
          curl --fail --location --retry 2 --max-time 60 "$base/LICENSE" -o "$root/LICENSE"
          echo "11c8ad8f7e8c7c59ee45582c77d896a35fa646617f3ba0f5b338a425a7c93b7d  $root/base.jsbundle" | sha256sum --check
          echo "a693e68254b6c13fae8f839d20c14f9d11c5ab98d4be1b8d13ba1e929a12d752  $root/s3-medium-feature.jsbundle" | sha256sum --check
          echo "HERMES_METRO_FIXTURES=$root" >> "$GITHUB_ENV"
      - name: Run real compiler and fallback regressions
        run: bun test tests/hermes-*.test.ts
      - name: Run seeded differential fuzzing
        run: bun run fuzz:hermes-base --rounds 50 --seed ${{ matrix.hbc }} --out "${{ runner.temp }}/hermes-fuzz"
      - name: Preserve failing fuzz cases
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: hermes-fuzz-hbc-${{ matrix.hbc }}${{ matrix.suffix }}
          path: ${{ runner.temp }}/hermes-fuzz
          if-no-files-found: ignore