test.yml

name: Test

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: test-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint-shell:
    name: Lint shell
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: POSIX sh syntax check
        run: sh -n install.sh

      - name: Install dash
        run: sudo apt-get update && sudo apt-get install -y dash

      - name: dash syntax check
        run: dash -n install.sh

      - name: Install ShellCheck
        run: sudo apt-get install -y shellcheck

      - name: ShellCheck
        run: shellcheck --shell=sh --severity=style install.sh

      - name: Syntax-check bash test helpers, if present
        run: |
          set -eu
          if [ -d tests/helpers ]; then
            for f in tests/helpers/*.bash; do
              [ -e "$f" ] || continue
              bash -n "$f"
            done
          fi

  lint-powershell:
    name: Lint PowerShell
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Install PSScriptAnalyzer
        shell: pwsh
        run: Install-Module -Name PSScriptAnalyzer -Scope CurrentUser -Force -SkipPublisherCheck

      - name: PSScriptAnalyzer
        shell: pwsh
        run: Invoke-ScriptAnalyzer -Path install.ps1 -Settings PSGallery -EnableExit

      - name: AST parse check
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $files = @("install.ps1")
          if (Test-Path "tests") {
            $files += Get-ChildItem -Path "tests" -Filter "*.ps1" -File -Recurse | Select-Object -ExpandProperty FullName
          }
          $failed = $false
          foreach ($file in $files) {
            $tokens = $null
            $errors = $null
            [void][System.Management.Automation.Language.Parser]::ParseFile($file, [ref]$tokens, [ref]$errors)
            if ($errors.Count -gt 0) {
              $failed = $true
              foreach ($e in $errors) {
                Write-Error "${file}: $e"
              }
            } else {
              Write-Output "OK: $file"
            }
          }
          if ($failed) {
            throw "AST parse errors found"
          }

  test-shell:
    name: Test shell (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Install bats-core (Linux)
        if: runner.os == 'Linux'
        run: |
          set -eu
          if command -v bats >/dev/null 2>&1; then
            exit 0
          fi
          sudo apt-get update && sudo apt-get install -y bats || sudo npm install -g bats

      - name: Install bats-core (macOS)
        if: runner.os == 'macOS'
        run: brew install bats-core

      - name: Ensure python3 is available
        run: python3 --version

      - name: Run bats suite
        run: bats tests/

  test-shell-musl:
    name: Test shell (musl / alpine)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    container:
      image: alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc
    steps:
      - name: Install checkout compatibility packages
        run: apk add --no-cache git gcompat libstdc++

      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Install musl test dependencies
        run: apk add --no-cache bash bats python3 curl tar gzip coreutils

      - name: Run bats suite
        run: bats tests/

  test-powershell:
    name: Test PowerShell
    runs-on: windows-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      # The suite is written for Pester v5; v6 discovers zero tests, so the
      # version is pinned and every run fails if nothing was discovered.
      - name: Install Pester
        shell: pwsh
        run: Install-Module -Name Pester -MinimumVersion 5.5 -MaximumVersion 5.99 -Force -SkipPublisherCheck

      - name: Run Pester (PowerShell 7)
        shell: pwsh
        run: |
          Import-Module Pester -MinimumVersion 5.5 -MaximumVersion 5.99 -Force
          $config = New-PesterConfiguration
          $config.Run.Path = "tests/Install.Tests.ps1"
          $config.Run.Exit = $true
          $config.Run.PassThru = $true
          $config.Output.Verbosity = "Detailed"
          $config.Should.ErrorAction = "Stop"
          $result = Invoke-Pester -Configuration $config
          if (-not $result -or $result.TotalCount -lt 1) {
            throw "Pester discovered zero tests"
          }

      - name: Run Pester (Windows PowerShell 5.1)
        shell: powershell
        run: |
          Import-Module Pester -MinimumVersion 5.5 -MaximumVersion 5.99 -Force
          $config = New-PesterConfiguration
          $config.Run.Path = "tests/Install.Tests.ps1"
          $config.Run.Exit = $true
          $config.Run.PassThru = $true
          $config.Output.Verbosity = "Detailed"
          $config.Should.ErrorAction = "Stop"
          $result = Invoke-Pester -Configuration $config
          if (-not $result -or $result.TotalCount -lt 1) {
            throw "Pester discovered zero tests"
          }