test.yml

name: Tests

# Monorepo CI: unit, lint, Playwright, contract, docs, MCP.
# Live JS SDK e2e against a relayer is .github/workflows/test-sdk.yml.

on:
  pull_request:
    branches: [main, staging, dev]
  push:
    branches: [main, staging, dev]
  workflow_dispatch:

concurrency:
  group: test-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  meta:
    name: ${{ matrix.name }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Compatibility / Contract metadata
            script: scripts/check-compatibility-contract.mjs
          - name: Docs / Code references match packages
            script: scripts/check-docs-code-sync.mjs
          - name: Docs / Freshness
            script: scripts/check-docs-freshness.mjs
          - name: Release / Manual versions and changelogs
            script: scripts/verify-manual-sdk-release.mjs
          - name: Release / Verifier regressions
            script: scripts/tests/verify-manual-sdk-release.test.mjs
          - name: SEAL cross-account synthetic parser
            script: scripts/synthetic-seal-cross-account.test.mjs
          - name: Migration / Completion artifact
            script: scripts/write-migration-completion-artifact.mjs --self-test

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc

      - name: Verify changed package versions
        if: matrix.script == 'scripts/verify-manual-sdk-release.mjs' && github.event_name == 'pull_request' && github.base_ref == 'main'
        env:
          RELEASE_BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          git fetch --no-tags --depth=1 origin "$RELEASE_BASE_SHA"
          node scripts/verify-package-version-bumps.mjs --base "$RELEASE_BASE_SHA"

      - name: Run check
        run: node ${{ matrix.script }}

  mcp-tests:
    name: MCP / Integration (login handoff)
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v4

      - name: Setup JS
        uses: ./.github/actions/setup-js

      - name: MCP integration tests
        run: pnpm --filter @mysten-incubation/memwal-mcp test

  sdk-checks:
    name: SDK / Unit (Node ${{ matrix.node-version }})
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        node-version: ["22.23.4", "24.22.1"]

    steps:
      - uses: actions/checkout@v4

      - name: Setup JS
        uses: ./.github/actions/setup-js
        with:
          node-version: ${{ matrix.node-version }}

      - name: Typecheck, build and unit tests
        run: pnpm --filter @mysten-incubation/memwal test

  chatbot-e2e:
    name: Chatbot / Playwright E2E
    runs-on: ubuntu-latest
    timeout-minutes: 25

    services:
      postgres:
        image: pgvector/pgvector:pg17
        env:
          POSTGRES_USER: memwal
          POSTGRES_PASSWORD: memwal_secret
          POSTGRES_DB: memwal
        ports: ["5432:5432"]
        options: >-
          --health-cmd "pg_isready -U memwal"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
      redis:
        image: redis:7-alpine
        ports: ["6379:6379"]
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-retries 10

    env:
      POSTGRES_URL: postgresql://memwal:memwal_secret@localhost:5432/memwal
      REDIS_URL: redis://localhost:6379
      AUTH_SECRET: ci-test-secret-not-for-production
      OPENROUTER_API_KEY: mock-not-used-tests-use-local-mocks
      PORT: "3001"
      PLAYWRIGHT: "True"
      NODE_ENV: test

    steps:
      - uses: actions/checkout@v4

      - name: Setup JS
        uses: ./.github/actions/setup-js

      - name: Build SDK
        run: pnpm build:sdk

      - name: Setup Playwright
        # Slow package mirrors can spend eight minutes on OS deps alone.
        timeout-minutes: 12
        uses: ./.github/actions/setup-playwright
        with:
          package: "@memwal/chatbot"
          cache-id: chatbot

      - name: Run Playwright E2E
        run: pnpm --filter @memwal/chatbot test:e2e

      - name: Upload Playwright report
        if: always()
        uses: ./.github/actions/upload-playwright-report
        with:
          app: chatbot

  researcher-e2e:
    name: Researcher / Unit + Playwright E2E
    runs-on: ubuntu-latest
    timeout-minutes: 25

    services:
      postgres:
        image: pgvector/pgvector:pg17
        env:
          POSTGRES_USER: memwal
          POSTGRES_PASSWORD: memwal_secret
          POSTGRES_DB: memwal
        ports: ["5432:5432"]
        options: >-
          --health-cmd "pg_isready -U memwal"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
      redis:
        image: redis:7-alpine
        ports: ["6379:6379"]
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-retries 10

    env:
      POSTGRES_URL: postgresql://memwal:memwal_secret@localhost:5432/memwal
      REDIS_URL: redis://localhost:6379
      AUTH_SECRET: ci-test-secret-not-for-production
      OPENROUTER_API_KEY: mock-not-used-tests-use-local-mocks
      NEXT_PUBLIC_MEMWAL_PACKAGE_ID: "0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
      PORT: "3000"
      PLAYWRIGHT: "True"
      NODE_ENV: test

    steps:
      - uses: actions/checkout@v4

      - name: Setup JS
        uses: ./.github/actions/setup-js

      - name: Build SDK
        run: pnpm build:sdk

      - name: Unit tests
        run: pnpm --filter researcher test:unit

      - name: Setup Playwright
        timeout-minutes: 12
        uses: ./.github/actions/setup-playwright
        with:
          package: researcher
          cache-id: researcher

      - name: Run Playwright E2E
        run: pnpm --filter researcher test:e2e

      - name: Upload Playwright report
        if: always()
        uses: ./.github/actions/upload-playwright-report
        with:
          app: researcher

  noter-e2e:
    name: Noter / Playwright E2E
    runs-on: ubuntu-latest
    timeout-minutes: 25

    services:
      postgres:
        image: postgres:17
        env:
          POSTGRES_USER: noter
          POSTGRES_PASSWORD: noter_secret
          POSTGRES_DB: noter
        ports: ["5432:5432"]
        options: >-
          --health-cmd "pg_isready -U noter"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10

    env:
      DATABASE_URL: postgresql://noter:noter_secret@localhost:5432/noter
      NEXT_PUBLIC_APP_URL: http://localhost:3002
      PORT: "3002"
      NODE_ENV: test
      PLAYWRIGHT: "True"
      NEXT_PUBLIC_ENOKI_API_KEY: ci-placeholder-not-used-tests-use-delegate-key
      NEXT_PUBLIC_GOOGLE_CLIENT_ID: ci-placeholder-not-used-tests-use-delegate-key
      NEXT_PUBLIC_SUI_NETWORK: testnet
      NEXT_PUBLIC_MEMWAL_PACKAGE_ID: "0xcf6ad755a1cdff7217865c796778fabe5aa399cb0cf2eba986f4b582047229c6"
      NEXT_PUBLIC_MEMWAL_REGISTRY_ID: "0xe80f2feec1c139616a86c9f71210152e2a7ca552b20841f2e192f99f75864437"
      NEXT_PUBLIC_MEMWAL_SERVER_URL: https://relayer.dev.memwal.ai

    steps:
      - uses: actions/checkout@v4

      - name: Setup JS
        uses: ./.github/actions/setup-js

      - name: Build SDK
        run: pnpm build:sdk

      - name: Setup Playwright
        timeout-minutes: 12
        uses: ./.github/actions/setup-playwright
        with:
          package: "@memwal/noter"
          cache-id: noter

      - name: Run Playwright E2E
        run: pnpm --filter @memwal/noter test:e2e

      - name: Upload Playwright report
        if: always()
        uses: ./.github/actions/upload-playwright-report
        with:
          app: noter

  server-e2e:
    name: Server / E2E
    runs-on: ubuntu-latest
    timeout-minutes: 25

    services:
      postgres:
        image: pgvector/pgvector:pg17
        env:
          POSTGRES_USER: memwal
          POSTGRES_PASSWORD: memwal_secret
          POSTGRES_DB: memwal
        ports: ["5432:5432"]
        options: >-
          --health-cmd "pg_isready -U memwal"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
      redis:
        image: redis:7-alpine
        ports: ["6379:6379"]
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-retries 10

    env:
      DATABASE_URL: postgresql://memwal:memwal_secret@localhost:5432/memwal
      REDIS_URL: redis://localhost:6379
      PORT: "8000"
      TEST_BASE_URL: http://localhost:8000
      RUST_LOG: info
      SUI_NETWORK: testnet
      SUI_GRPC_URL: "https://fullnode.testnet.sui.io:443"
      MEMWAL_PACKAGE_ID: "0xcf6ad755a1cdff7217865c796778fabe5aa399cb0cf2eba986f4b582047229c6"
      MEMWAL_REGISTRY_ID: "0xe80f2feec1c139616a86c9f71210152e2a7ca552b20841f2e192f99f75864437"
      SIDECAR_AUTH_TOKEN: ci-test-sidecar-token-not-for-production

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry + build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            services/server/target
          key: cargo-${{ runner.os }}-${{ hashFiles('services/server/Cargo.lock') }}
          restore-keys: cargo-${{ runner.os }}-

      - name: Setup Node (for TS sidecar auto-spawned by server)
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc

      - name: Install sidecar deps
        working-directory: services/server/scripts
        run: |
          if [ -f package-lock.json ]; then
            npm ci
          else
            npm install
          fi

      - name: Setup Python
        uses: ./.github/actions/setup-python
        with:
          python-version: "3.11.17"

      - name: Install Python deps
        run: pip install -r services/server/tests/requirements.txt

      - name: Build HTTP-only CI server
        working-directory: services/server
        run: |
          cargo build --features ci-offline-onchain --bin memwal-server || \
            cargo build --features ci-offline-onchain

      - name: Start server in background
        working-directory: services/server
        run: |
          BIN=$(ls -1 target/debug/memwal-server target/debug/memwal 2>/dev/null | head -n1)
          if [ -z "$BIN" ]; then
            BIN=$(find target/debug -maxdepth 1 -type f -perm -u+x -not -name '*.d' | head -n1)
          fi
          echo "Starting $BIN"
          nohup "$BIN" > server.log 2>&1 &
          echo $! > server.pid

      - name: Wait for /health
        run: |
          for i in $(seq 1 60); do
            if curl -fsS http://localhost:8000/health >/dev/null 2>&1; then
              echo "server is up after ${i}s"
              exit 0
            fi
            sleep 1
          done
          echo "server did not come up within 60s" >&2
          tail -n 100 services/server/server.log || true
          exit 1

      - name: Run server E2E
        run: python3 services/server/tests/e2e_test.py

      - name: Stop server
        if: always()
        run: |
          if [ -f services/server/server.pid ]; then
            kill "$(cat services/server/server.pid)" 2>/dev/null || true
          fi

      - name: Upload server log
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: server-e2e-log
          path: services/server/server.log
          retention-days: 14
          if-no-files-found: ignore

  chatbot-checks:
    name: Chatbot / Lint + Build
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - uses: actions/checkout@v4

      - name: Setup JS
        uses: ./.github/actions/setup-js

      - name: Build SDK
        run: pnpm build:sdk

      # Soft-fail: ultracite 7.3.0 passes a `--skip` flag the bundled biome
      # rejects. Flip to hard-fail once the version mismatch is fixed.
      - name: Lint (biome/ultracite)
        continue-on-error: true
        run: pnpm --filter @memwal/chatbot lint

      - name: Unit tests (vitest)
        run: pnpm --filter @memwal/chatbot test:unit

      - name: Build (Next.js, type-check inclusive)
        working-directory: apps/chatbot
        env:
          # next build imports auth.ts, which rejects a missing or short secret.
          AUTH_SECRET: ci-test-secret-not-for-production
          POSTGRES_URL: postgresql://dummy:dummy@localhost:5432/dummy
        run: pnpm exec next build

  noter-checks:
    name: Noter / Unit tests + Build
    runs-on: ubuntu-latest
    timeout-minutes: 20

    env:
      DATABASE_URL: postgresql://dummy:dummy@localhost:5432/dummy
      NEXT_PUBLIC_ENOKI_API_KEY: ci-placeholder-build-only
      NEXT_PUBLIC_GOOGLE_CLIENT_ID: ci-placeholder-build-only
      NEXT_PUBLIC_SUI_NETWORK: testnet
      NEXT_PUBLIC_MEMWAL_PACKAGE_ID: "0xcf6ad755a1cdff7217865c796778fabe5aa399cb0cf2eba986f4b582047229c6"
      NEXT_PUBLIC_MEMWAL_REGISTRY_ID: "0xe80f2feec1c139616a86c9f71210152e2a7ca552b20841f2e192f99f75864437"
      NEXT_PUBLIC_MEMWAL_SERVER_URL: https://relayer.dev.memwal.ai

    steps:
      - uses: actions/checkout@v4

      - name: Setup JS
        uses: ./.github/actions/setup-js

      - name: Build SDK
        run: pnpm build:sdk

      - name: Unit tests (vitest)
        run: pnpm --filter @memwal/noter test:unit

      - name: Type-check (tsc --noEmit)
        working-directory: apps/noter
        run: pnpm exec tsc --noEmit

      - name: Build (Next.js, type-check inclusive)
        working-directory: apps/noter
        run: pnpm exec next build

  openclaw-plugin-checks:
    name: OpenClaw Plugin / Unit tests
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup JS
        uses: ./.github/actions/setup-js

      - name: Build SDK (workspace dep of the plugin)
        run: pnpm build:sdk

      # Guards the defects found by running the plugin against a real OpenClaw
      # gateway and a misbehaving relayer. The manifest must not mark credential
      # fields required, or `plugins install` deadlocks; the agent tools must
      # stay declared in contracts.tools, or neither registers; every relayer
      # call must keep its deadline, or a hung relayer blocks the turn; and the
      # injection filter must not regress in either direction, meaning attack
      # payloads stay caught and ordinary developer speech stays storable.
      # Also runs the GH #639/#640 security suite, which had no CI job either.
      - name: Unit tests (node:test)
        run: pnpm --filter @mysten-incubation/oc-memwal test

  openclaw-plugin-e2e:
    name: OpenClaw Plugin / E2E
    # Merges to staging and main only, never per PR. The live half writes to
    # Walrus, which is append-only with no per-blob delete, so every run leaves
    # permanent data and costs gas plus storage. The mock-relayer half needs no
    # credentials and runs regardless.
    if: >-
      github.event_name == 'push' &&
      (github.ref == 'refs/heads/staging' || github.ref == 'refs/heads/main')
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup JS
        uses: ./.github/actions/setup-js

      - name: Build SDK (workspace dep of the plugin)
        run: pnpm build:sdk

      # Without the two secrets the live cases skip themselves and only the
      # mock-relayer cases run, so this job is safe to land before the secrets
      # exist and will not fail the branch. The secrets stay on this step so
      # they are not in the environment for pnpm install.
      - name: E2E (mock relayer always, live relayer when secrets are set)
        env:
          # Always staging, even on a main merge: the suite stores real memories and
          # there is no reason to put test data on mainnet.
          MEMWAL_SERVER_URL: https://relayer.dev.memwal.ai
          MEMWAL_PRIVATE_KEY: ${{ secrets.MEMWAL_E2E_PRIVATE_KEY }}
          MEMWAL_ACCOUNT_ID: ${{ secrets.MEMWAL_E2E_ACCOUNT_ID }}
          MEMWAL_E2E_WRITE: "1"
        run: pnpm --filter @mysten-incubation/oc-memwal test:e2e

  server-checks:
    name: Server / Clippy + Unit tests
    runs-on: ubuntu-latest
    timeout-minutes: 20

    services:
      postgres:
        image: pgvector/pgvector:pg17
        env:
          POSTGRES_USER: memwal
          POSTGRES_PASSWORD: memwal_secret
          POSTGRES_DB: memwal
        ports: ["5432:5432"]
        options: >-
          --health-cmd "pg_isready -U memwal"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
      redis:
        image: redis:7-alpine
        ports: ["6379:6379"]
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-retries 10

    env:
      DATABASE_URL: postgresql://memwal:memwal_secret@localhost:5432/memwal
      REDIS_URL: redis://localhost:6379

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain (+ clippy)
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - name: Cache cargo registry + build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            services/server/target
          key: cargo-checks-${{ runner.os }}-${{ hashFiles('services/server/Cargo.lock') }}
          restore-keys: cargo-checks-${{ runner.os }}-

      # Soft-fail: services/server emits pre-existing clippy warnings with
      # `-D warnings`. Flip to `-- -D warnings` once those are cleaned up.
      - name: Clippy
        continue-on-error: true
        working-directory: services/server
        run: cargo clippy --all-targets

      - name: Unit tests (cargo test)
        working-directory: services/server
        env:
          OWNER_RATE_LIMIT_TEST_DATABASE_URL: ${{ env.DATABASE_URL }}
          ADMIN_API_KEY: ci-only-owner-policy-test-key
        run: cargo test --bins

  move-contract:
    name: Move / Contract tests
    runs-on: ubuntu-latest
    timeout-minutes: 15

    env:
      SUI_VERSION: testnet-v1.74.0

    steps:
      - uses: actions/checkout@v4

      - name: Cache Sui CLI
        id: sui-cache
        uses: actions/cache@v4
        with:
          path: ~/.local/bin/sui
          key: sui-${{ runner.os }}-${{ env.SUI_VERSION }}

      - name: Install Sui CLI
        if: steps.sui-cache.outputs.cache-hit != 'true'
        run: |
          mkdir -p "$HOME/.local/bin"
          TMPDIR="$(mktemp -d)"
          cd "$TMPDIR"
          curl -fsSL \
            "https://github.com/MystenLabs/sui/releases/download/${SUI_VERSION}/sui-${SUI_VERSION}-ubuntu-x86_64.tgz" \
            -o sui.tgz
          tar -xzf sui.tgz
          SUI_BIN="$(find . -maxdepth 2 -type f -name sui -perm -u+x | head -n1)"
          if [ -z "$SUI_BIN" ]; then
            echo "::error::sui binary not found in archive"
            tar -tzf sui.tgz | head -100
            exit 1
          fi
          cp "$SUI_BIN" "$HOME/.local/bin/sui"
          chmod +x "$HOME/.local/bin/sui"
          cd /
          rm -rf "$TMPDIR"

      - name: Add Sui to PATH
        run: echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Verify Sui version
        run: sui --version

      - name: Run Move unit tests
        working-directory: services/contract
        run: sui move test

      - name: Require SEAL cross-account deny invariant
        working-directory: services/contract
        run: |
          set -o pipefail
          sui move test seal_approve_delegate_requires_matching_owner | tee /tmp/seal-invariant.log
          grep -q 'test_seal_approve_delegate_requires_matching_owner' /tmp/seal-invariant.log