tests.yml

name: CI

on:
  push:
    branches:
      - main
      - master
  pull_request:
  merge_group:

permissions:
  contents: read

env:
  HOMEBREW_DEVELOPER: 1
  HOMEBREW_NO_AUTO_UPDATE: 1
  HOMEBREW_NO_ENV_HINTS: 1
  HOMEBREW_NO_INSTALL_CLEANUP: 1
  HOMEBREW_SORBET_RECURSIVE: 1
  HOMEBREW_VERIFY_ATTESTATIONS: 1

defaults:
  run:
    shell: bash -xeuo pipefail {0}

concurrency:
  group: "${{ github.ref }}"
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  syntax:
    if: github.repository_owner == 'Homebrew'
    runs-on: ubuntu-latest
    steps:
      - name: Set up Homebrew
        id: set-up-homebrew
        uses: Homebrew/actions/setup-homebrew@3cdb78d0f62ad29dd32de765782654f4eedea607 # 2026.08.31.1
        with:
          core: false
          cask: false

      - name: Cache Bundler RubyGems
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ steps.set-up-homebrew.outputs.gems-path }}
          key: ${{ runner.os }}-rubygems-syntax-${{ steps.set-up-homebrew.outputs.gems-hash }}
          restore-keys: ${{ runner.os }}-rubygems-syntax-

      - name: Install Bundler RubyGems
        run: brew install-bundler-gems --groups=style,typecheck

      - name: Install actionlint, shellcheck and shfmt
        run: brew install actionlint shellcheck shfmt

      - name: Cache style cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/Homebrew/style
          key: syntax-style-cache-${{ github.sha }}
          restore-keys: syntax-style-cache-

      - run: brew style

      - run: brew typecheck

  tap-syntax:
    name: tap syntax
    needs: syntax
    if: github.repository_owner == 'Homebrew'
    runs-on: macos-26
    steps:
      - name: Set up Homebrew
        id: set-up-homebrew
        uses: Homebrew/actions/setup-homebrew@3cdb78d0f62ad29dd32de765782654f4eedea607 # 2026.08.31.1
        with:
          core: true
          cask: true

      - name: Cache Bundler RubyGems
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ steps.set-up-homebrew.outputs.gems-path }}
          key: ${{ runner.os }}-rubygems-tap-syntax-${{ steps.set-up-homebrew.outputs.gems-hash }}
          restore-keys: ${{ runner.os }}-rubygems-tap-syntax-

      - name: Install Bundler RubyGems
        run: brew install-bundler-gems --groups=style,typecheck

      - name: Cache style cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/Library/Caches/Homebrew/style
          key: tap-syntax-style-cache-${{ github.sha }}
          restore-keys: tap-syntax-style-cache-

      - name: Run brew style on official taps
        run: brew style homebrew/core homebrew/cask

      - name: Run brew typecheck on official taps
        run: brew typecheck homebrew/core homebrew/cask

  formula-audit:
    name: formula audit
    needs: syntax
    if: github.repository_owner == 'Homebrew' && github.event_name != 'push'
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/homebrew/brew:main
    steps:
      - name: Set up Homebrew
        id: set-up-homebrew
        uses: Homebrew/actions/setup-homebrew@3cdb78d0f62ad29dd32de765782654f4eedea607 # 2026.08.31.1
        with:
          core: true
          cask: false

      - name: Run brew readall on homebrew/core
        run: brew readall --os=all --arch=all --aliases homebrew/core

      - name: Run brew audit --skip-style on homebrew/core
        run: brew audit --skip-style --except=version --tap=homebrew/core

      - name: Generate formula API
        run: brew generate-formula-api --dry-run

  cask-audit:
    name: cask audit
    needs: syntax
    if: github.repository_owner == 'Homebrew' && github.event_name != 'push'
    runs-on: macos-26
    steps:
      - name: Set up Homebrew
        id: set-up-homebrew
        uses: Homebrew/actions/setup-homebrew@3cdb78d0f62ad29dd32de765782654f4eedea607 # 2026.08.31.1
        with:
          core: true
          cask: true

      - name: Run brew readall on all casks
        run: brew readall --os=all --arch=all homebrew/cask

      - name: Run brew audit --skip-style on homebrew/cask
        run: |
          brew audit --skip-style --except=version --tap=homebrew/cask

      - name: Generate cask API
        run: brew generate-cask-api --dry-run

  vendored-gems:
    name: vendored gems
    needs: syntax
    runs-on: ubuntu-latest
    steps:
      - name: Set up Homebrew
        id: set-up-homebrew
        uses: Homebrew/actions/setup-homebrew@3cdb78d0f62ad29dd32de765782654f4eedea607 # 2026.08.31.1
        with:
          core: false
          cask: false

      - name: Configure Git user
        uses: Homebrew/actions/git-user-config@3cdb78d0f62ad29dd32de765782654f4eedea607 # 2026.08.31.1
        with:
          username: BrewTestBot

      # Can't cache this because we need to check that it doesn't fail the
      # "uncommitted RubyGems" step with a cold cache.
      - name: Install Bundler RubyGems
        run: brew install-bundler-gems --groups=all

      - name: Check for uncommitted RubyGems
        working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
        run: |
          git diff --stat --exit-code Library/Homebrew/vendor/bundle
          if [ -n "$(git status --porcelain -- Library/Homebrew/vendor/bundle)" ]; then
            echo "Untracked or unstaged files found:"
            git status --porcelain -- Library/Homebrew/vendor/bundle
            exit 1
          fi

  update-test:
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.runs-on }}
    needs: syntax
    if: github.event_name != 'push'
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: update-test (Linux)
            runs-on: ubuntu-latest
          - name: update-test (macOS)
            runs-on: macos-latest
    steps:
      - name: Set up Homebrew
        id: set-up-homebrew
        uses: Homebrew/actions/setup-homebrew@3cdb78d0f62ad29dd32de765782654f4eedea607 # 2026.08.31.1
        with:
          core: false
          cask: false

      - name: Run brew update-tests
        run: |
          brew update-test
          brew update-test --to-tag
          brew update-test --commit=HEAD

  tests:
    name: ${{ matrix.name }}
    if: github.repository_owner == 'Homebrew'
    runs-on: ${{ matrix.runs-on }}
    timeout-minutes: 30
    permissions:
      contents: read
      code-quality: write
      pull-requests: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: tests (online, 1/2)
            test-flags: --online --coverage --profile 3
            runs-on: ubuntu-latest
            online: true
            load-only: false
            shard: 1
            shard-count: 2
          - name: tests (online, 2/2)
            test-flags: --online --coverage --profile 3
            runs-on: ubuntu-latest
            online: true
            load-only: false
            shard: 2
            shard-count: 2
          - name: tests (generic OS, 1/2)
            test-flags: --generic --coverage --profile 3
            runs-on: ubuntu-latest
            online: false
            load-only: false
            shard: 1
            shard-count: 2
          - name: tests (generic OS, 2/2)
            test-flags: --generic --coverage --profile 3
            runs-on: ubuntu-latest
            online: false
            load-only: false
            shard: 2
            shard-count: 2
          - name: tests (Linux, 1/2)
            test-flags: --coverage --profile 3
            runs-on: ubuntu-24.04
            online: false
            load-only: false
            shard: 1
            shard-count: 2
          - name: tests (Linux, 2/2)
            test-flags: --coverage --profile 3
            runs-on: ubuntu-24.04
            online: false
            load-only: false
            shard: 2
            shard-count: 2
          - name: tests (macOS, 1/2)
            test-flags: --coverage --profile 3
            runs-on: macos-26
            online: false
            load-only: false
            shard: 1
            shard-count: 2
          - name: tests (macOS, 2/2)
            test-flags: --coverage --profile 3
            runs-on: macos-26
            online: false
            load-only: false
            shard: 2
            shard-count: 2
          - name: tests (no Sorbet)
            test-flags: --coverage --profile 3
            runs-on: ubuntu-24.04
            online: false
            load-only: false
            shard: 0
            shard-count: 0
            runtime-cache: tests-no-sorbet-linux
            runtime-log: parallel_runtime_rspec.log
          - name: tests (load-only Linux)
            test-flags: --load-only
            runs-on: ubuntu-24.04
            online: false
            load-only: true
            shard: 0
            shard-count: 0
            runtime-cache: unused
            runtime-log: parallel_runtime_rspec.log
          - name: tests (load-only macOS)
            test-flags: --load-only
            runs-on: macos-26
            online: false
            load-only: true
            shard: 0
            shard-count: 0
            runtime-cache: unused
            runtime-log: parallel_runtime_rspec.log
    steps:
      - name: Set up Homebrew
        id: set-up-homebrew
        uses: Homebrew/actions/setup-homebrew@3cdb78d0f62ad29dd32de765782654f4eedea607 # 2026.08.31.1
        with:
          # We only test needs_homebrew_core tests on macOS because
          # homebrew/core is not available by default on GitHub-hosted Ubuntu
          # runners, and it's expensive to tap it.
          # Load-only jobs never run examples, so they don't need it either.
          core: ${{ runner.os == 'macOS' && matrix.load-only != true }}
          cask: false

      - name: Cache Bundler RubyGems
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ steps.set-up-homebrew.outputs.gems-path }}
          key: ${{ matrix.runs-on }}-tests-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }}
          restore-keys: ${{ matrix.runs-on }}-tests-rubygems-

      - run: brew config

      - name: Install Bundler RubyGems
        run: brew install-bundler-gems --groups=all

      - name: Untap untrusted preinstalled tap
        if: runner.os == 'macOS' && matrix.load-only != true
        run: |
          if brew tap | grep -qx aws/tap; then
            brew untap --force aws/tap
          fi

      - name: Install Subversion
        if: matrix.online || (runner.os == 'macOS' && matrix.load-only != true)
        run: brew install subversion

      - name: Create parallel test log directory
        run: mkdir tests

      - name: Restore parallel tests log
        if: matrix.shard-count == 0 && matrix.load-only != true
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: tests/${{ matrix.runtime-log }}
          key: ${{ matrix.runtime-cache }}-parallel-runtime-${{ github.run_id }}-${{ github.run_attempt }}
          restore-keys: |
            ${{ matrix.runtime-cache }}-parallel-runtime-
            ${{ runner.os }}-${{ matrix.test-flags }}-parallel_runtime_rspec-

      - name: Stage parallel tests log
        if: matrix.shard-count == 0 && matrix.load-only != true
        run: |
          mkdir -p "$TEST_RUNTIME_PATH"
          if [[ -f "tests/$RUNTIME_LOG" ]]; then
            cp "tests/$RUNTIME_LOG" "$TEST_RUNTIME_PATH/$RUNTIME_LOG"
          fi
        env:
          RUNTIME_LOG: ${{ matrix.runtime-log }}
          TEST_RUNTIME_PATH: ${{ steps.set-up-homebrew.outputs.repository-path }}/Library/Homebrew/tests

        # brew tests doesn't like world writable directories
      - name: Cleanup permissions
        if: runner.os == 'Linux'
        run: sudo chmod -R g-w,o-w /home/linuxbrew/.linuxbrew/Homebrew

      - name: Disable Sorbet runtime
        if: matrix.name == 'tests (no Sorbet)'
        run: echo "HOMEBREW_TESTS_NO_SORBET_RUNTIME=1" >> "$GITHUB_ENV"

      - name: Run brew tests
        if: github.event_name == 'pull_request' || matrix.online != true
        run: |
          read -ra test_flags <<< "$TEST_FLAGS"
          if (( SHARD_COUNT > 0 )); then
            test_flags+=("--shard=$SHARD_INDEX/$SHARD_COUNT")
          fi
          brew tests "${test_flags[@]}"
        env:
          HOMEBREW_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # These cannot be queried at the macOS level on GitHub Actions.
          HOMEBREW_LANGUAGES: en-GB
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
          TEST_FLAGS: ${{ matrix.test-flags }}
          SHARD_INDEX: ${{ matrix.shard }}
          SHARD_COUNT: ${{ matrix.shard-count }}

      - name: Collect parallel tests log
        if: matrix.shard-count == 0 && matrix.load-only != true && success()
        run: cp "$TEST_RUNTIME_PATH/$RUNTIME_LOG" "tests/$RUNTIME_LOG"
        env:
          RUNTIME_LOG: ${{ matrix.runtime-log }}
          TEST_RUNTIME_PATH: ${{ steps.set-up-homebrew.outputs.repository-path }}/Library/Homebrew/tests

      - name: Save parallel tests log
        if: matrix.shard-count == 0 && matrix.load-only != true && success()
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: tests/${{ matrix.runtime-log }}
          key: ${{ matrix.runtime-cache }}-parallel-runtime-${{ github.run_id }}-${{ github.run_attempt }}

      - name: Get RSpec JUnit XML filenames
        if: matrix.load-only != true
        id: junit_xml
        working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
        run: |
          mkdir -p Library/Homebrew/test/junit
          filenames=$(find Library/Homebrew/test/junit -name 'rspec*.xml' -print | tr '\n' ',')
          echo "filenames=${filenames%,}" >> "$GITHUB_OUTPUT"

      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        if: matrix.load-only != true && (github.event_name == 'pull_request' || matrix.online != true)
        with:
          working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
          files: ${{ steps.junit_xml.outputs.filenames }}
          disable_search: true
          token: ${{ secrets.CODECOV_TOKEN }}
          report_type: test_results

      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        if: matrix.load-only != true && (github.event_name == 'pull_request' || matrix.online != true)
        with:
          working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
          files: Library/Homebrew/test/coverage/coverage.xml
          disable_search: true
          token: ${{ secrets.CODECOV_TOKEN }}

  test-bot:
    name: ${{ matrix.name }}
    needs: syntax
    if: github.repository_owner == 'Homebrew' && github.event_name != 'push'
    runs-on: ${{ matrix.runs-on }}
    container:
      image: ${{ matrix.container }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: test-bot (Linux arm64)
            runs-on: ubuntu-24.04-arm
            container: ghcr.io/homebrew/ubuntu24.04:latest
          - name: test-bot (Linux arm64, padded prefix)
            runs-on: ubuntu-24.04-arm
            container: ghcr.io/homebrew/ubuntu24.04:latest
            prefix-constant: LINUX_ARM64_BOTTLE_PREFIX
            system-tar: true
          - name: test-bot (Linux x86_64)
            runs-on: ubuntu-latest
            container: ghcr.io/homebrew/ubuntu24.04:main
          - name: test-bot (Linux x86_64, padded prefix)
            runs-on: ubuntu-latest
            container: ghcr.io/homebrew/ubuntu24.04:main
            prefix-constant: LINUX_X86_64_BOTTLE_PREFIX
            system-tar: true
          - name: test-bot (no Sorbet)
            runs-on: ubuntu-latest
            container: ghcr.io/homebrew/ubuntu24.04:main
          - name: test-bot (Linux containerless)
            runs-on: ubuntu-latest
          # Use older Ubuntu for testing Homebrew's glibc and gcc support.
          - name: test-bot (Linux Homebrew glibc)
            runs-on: ubuntu-latest
            container: ubuntu:22.04
          - name: test-bot (macOS arm64)
            runs-on: macos-26
          - name: test-bot (macOS arm64, padded prefix)
            runs-on: macos-26
            prefix-constant: MACOS_ARM64_BOTTLE_PREFIX
    env:
      HOMEBREW_TEST_BOT_ANALYTICS: 1
    steps:
      - name: Install Homebrew and Homebrew's dependencies
        # All other images are built from our Homebrew Dockerfile.
        # This is the only one that needs to be set up manually.
        if: matrix.container == 'ubuntu:22.04'
        env:
          DEBIAN_FRONTEND: noninteractive
        run: |
          # Slimmed down version from the Homebrew Dockerfile
          apt-get update
          apt-get install -y --no-install-recommends \
            bzip2 \
            ca-certificates \
            curl \
            file \
            g++ \
            git-core \
            jq \
            less \
            locales \
            make \
            netbase \
            patch \
            procps \
            sudo \
            uuid-runtime \
            tzdata

          # Install Homebrew
          mkdir -p /home/linuxbrew/.linuxbrew/bin
          # Don't do shallow clone or it's unshallowed by "Set up Homebrew"
          git clone https://github.com/Homebrew/brew.git /home/linuxbrew/.linuxbrew/Homebrew
          cd /home/linuxbrew/.linuxbrew/bin
          ln -s ../Homebrew/bin/brew brew
          echo "/home/linuxbrew/.linuxbrew/bin" >>"$GITHUB_PATH"

      - name: Set up Homebrew
        id: set-up-homebrew
        uses: Homebrew/actions/setup-homebrew@3cdb78d0f62ad29dd32de765782654f4eedea607 # 2026.08.31.1
        with:
          core: true
          cask: false

      - name: Set up padded bottle prefix
        if: matrix.prefix-constant
        env:
          PREFIX_CONSTANT: ${{ matrix.prefix-constant }}
        run: |
          padded_prefix="$(brew ruby -- -e 'puts Homebrew.const_get(ARGV.fetch(0))' "${PREFIX_CONSTANT}")"
          test "${#padded_prefix}" -eq 64
          mkdir -p "${padded_prefix}/bin"
          ln -s "$(brew --repository)/bin/brew" "${padded_prefix}/bin/brew"
          test "$("${padded_prefix}/bin/brew" --prefix)" = "${padded_prefix}"
          echo "${padded_prefix}/bin" >> "${GITHUB_PATH}"

      - run: brew install gnu-tar
        if: matrix.system-tar != true

      - name: Disable Sorbet runtime
        if: matrix.name == 'test-bot (no Sorbet)'
        run: echo "HOMEBREW_TESTS_NO_SORBET_RUNTIME=1" >> "$GITHUB_ENV"

      - name: Setup environment variables
        if: matrix.name == 'test-bot (Linux Homebrew glibc)'
        run: |
          # Set environment variables to bypass `brew doctor` failures and disable
          # recursive Sorbet runtime checks for speed on Tier >=2 configurations
          echo "HOMEBREW_GLIBC_TESTING=1" >> "$GITHUB_ENV"
          echo "HOMEBREW_SORBET_RECURSIVE=0" >> "$GITHUB_ENV"

      - run: brew test-bot --only-cleanup-before

      - run: brew test-bot --only-setup
        env:
          HOMEBREW_TEST_BOT_IGNORE_DOCTOR_FAILURE: ${{ matrix.prefix-constant && '1' || null }}

      - name: Run brew test-bot formulae
        run: |
          test_bot_args=(--only-formulae)
          if [[ -n "${JSON_TAB}" ]]; then
            test_bot_args+=(--only-json-tab)
          fi
          brew test-bot "${test_bot_args[@]}" --test-default-formula
        env:
          JSON_TAB: ${{ matrix.system-tar != true && '1' || '' }}

  bundle-and-services:
    name: ${{ matrix.name }}
    needs: syntax
    if: github.repository_owner == 'Homebrew' && github.event_name != 'push'
    runs-on: ${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: bundle and services (Linux)
            runs-on: ubuntu-latest
          - name: bundle and services (macOS)
            runs-on: macos-latest
    steps:
      - name: Set up Homebrew
        id: set-up-homebrew
        uses: Homebrew/actions/setup-homebrew@3cdb78d0f62ad29dd32de765782654f4eedea607 # 2026.08.31.1
        with:
          core: false
          cask: false

      - run: brew test-bot --only-cleanup-before

      - name: Run brew bundle and brew services integration tests
        run: |
          cat <<EOS >> Brewfile
            brew "git"
            brew "memcached", restart_service: true
            brew "postgresql@15", restart_service: true
            cask "rectangle"
            cask "1password-cli"
            cask "firefox"
            # VSCode cask is not available on Linux.
            vscode "shopify.ruby-lsp" if OS.mac?
          EOS

          brew bundle check && exit 1
          brew bundle check --verbose && exit 1
          brew bundle list
          brew bundle --verbose
          brew bundle --upgrade-formulae=memcached,postgresql@15
          brew bundle upgrade
          brew bundle env | grep PATH | grep git
          brew bundle env --install
          brew bundle exec --services true
          brew bundle dump --force
          brew services list
          brew services info memcached postgresql@15
          brew services info --json memcached postgresql@15
          brew services cleanup
          brew bundle cleanup --force

  analytics:
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: analytics (Linux)
            runs-on: ubuntu-latest
          - name: analytics (macOS)
            runs-on: macos-latest
    needs: syntax
    if: github.repository_owner == 'Homebrew' && github.event_name != 'push'
    steps:
      - name: Set up Homebrew
        id: set-up-homebrew
        uses: Homebrew/actions/setup-homebrew@3cdb78d0f62ad29dd32de765782654f4eedea607 # 2026.08.31.1

      - name: Cache Homebrew Bundler RubyGems
        id: cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ steps.set-up-homebrew.outputs.gems-path }}
          key: ${{ runner.os }}-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }}
          restore-keys: ${{ runner.os }}-rubygems-

      - name: Install Homebrew Bundler RubyGems
        if: steps.cache.outputs.cache-hit != 'true'
        run: brew install-bundler-gems

      - name: Set up uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1

      - run: brew formula-analytics --setup

      - run: brew formula-analytics --install --json --days-ago=2
        if: github.event.pull_request.head.repo.fork == false && (github.event_name == 'pull_request' && github.event.pull_request.user.login != 'dependabot[bot]')
        env:
          HOMEBREW_INFLUXDB_TOKEN: ${{ secrets.HOMEBREW_INFLUXDB_READ_TOKEN }}

      - run: brew generate-analytics-api
        if: github.event.pull_request.head.repo.fork == false && (github.event_name == 'pull_request' && github.event.pull_request.user.login != 'dependabot[bot]')
        env:
          HOMEBREW_INFLUXDB_TOKEN: ${{ secrets.HOMEBREW_INFLUXDB_READ_TOKEN }}