@shipfox/api-workflows 11.0.0 → 12.0.0

package/src/db/workflow-runs/run-create.test.ts

@@ -1,4 +1,6 @@
+import type {WorkflowFieldTemplate} from '@shipfox/api-definitions-dto';
 import {WORKFLOWS_WORKFLOW_RUN_ATTEMPT_CREATED} from '@shipfox/api-workflows-dto';
+import {parseWorkflowTemplate, planInterpolationField} from '@shipfox/expression';
 import {and, eq, sql} from 'drizzle-orm';
 import type {AgentDefaultsResolver} from '#core/agent-defaults.js';
 import {InterpolationUnresolvableError} from '#core/errors.js';
@@ -9,9 +11,11 @@ import {buildModel, expression, shellRef, template} from '#test/helpers/workflow
 import {workflowModel} from '#test/index.js';
 import {db} from '../db.js';
 import {workflowsOutbox} from '../schema/outbox.js';
+import {workflowRunCounters} from '../schema/workflow-run-counters.js';
 import {workflowRuns} from '../schema/workflow-runs.js';
 import {
   createWorkflowRun,
+  evaluateJobActivations,
   getJobExecutionsByJobId,
   getJobsByWorkflowRunId,
   getStepsByJobId,
@@ -23,6 +27,15 @@ import {
   updateJobExecutionStatus,
 } from '../workflow-runs.js';
 
+function checkoutTemplate(source: string): WorkflowFieldTemplate {
+  const result = planInterpolationField({
+    field: 'checkout.repository',
+    segments: parseWorkflowTemplate(source),
+  });
+  if (!result.ok) throw new Error('Expected valid checkout template');
+  return result.plan.field.segments;
+}
+
 describe('workflow run queries', () => {
   let workspaceId: string;
   let projectId: string;
@@ -35,6 +48,219 @@ describe('workflow run queries', () => {
   });
 
   describe('createWorkflowRun', () => {
+    test('persists normalized integration trigger facts alongside the payload', async () => {
+      const triggerConnectionId = crypto.randomUUID();
+      const integrations = {
+        resolveTriggerReference: vi.fn().mockResolvedValue({
+          externalRepositoryId: 'github:42',
+          ref: 'refs/heads/main',
+          commit: 'a'.repeat(40),
+        }),
+        resolveSourceRepository: vi.fn().mockResolvedValue({
+          connection: {id: triggerConnectionId, provider: 'github', slug: 'github-main'},
+          repository: {
+            externalRepositoryId: 'github:42',
+            owner: 'acme',
+            name: 'api',
+            fullName: 'acme/api',
+            defaultBranch: 'main',
+            visibility: 'private' as const,
+            cloneUrl: 'https://github.com/acme/api.git',
+            htmlUrl: 'https://github.com/acme/api',
+          },
+        }),
+      } as never;
+      const projects = {
+        getProjectBySource: vi.fn().mockResolvedValue({project: {id: 'project-1'}}),
+      } as never;
+
+      const run = await createWorkflowRun({
+        workspaceId,
+        projectId,
+        definitionId,
+        model: buildModel(),
+        triggerConnectionId,
+        triggerPayload: {
+          provider: 'github',
+          source: 'github-main',
+          event: 'push',
+          deliveryId: 'delivery-1',
+          data: {ref: 'refs/heads/main', headCommitSha: 'a'.repeat(40)},
+        },
+        integrations,
+        projects,
+      });
+
+      const triggerReference = {
+        project: {id: 'project-1'},
+        repository: 'acme/api',
+        ref: 'refs/heads/main',
+        commit: 'a'.repeat(40),
+      };
+      expect(run.triggerReference).toEqual(triggerReference);
+      await expect(
+        db()
+          .select({triggerReference: workflowRuns.triggerReference})
+          .from(workflowRuns)
+          .where(eq(workflowRuns.id, run.id)),
+      ).resolves.toEqual([{triggerReference}]);
+    });
+
+    test('creates a run when trigger enrichment fails', async () => {
+      const triggerConnectionId = crypto.randomUUID();
+      const integrations = {
+        resolveTriggerReference: vi.fn().mockResolvedValue({
+          externalRepositoryId: 'github:42',
+          ref: 'refs/heads/main',
+          commit: 'a'.repeat(40),
+        }),
+        resolveSourceRepository: vi.fn().mockRejectedValue(new Error('source unavailable')),
+      } as never;
+      const projects = {
+        getProjectBySource: vi.fn().mockResolvedValue({project: {id: 'project-1'}}),
+      } as never;
+
+      const run = await createWorkflowRun({
+        workspaceId,
+        projectId,
+        definitionId,
+        model: buildModel(),
+        triggerConnectionId,
+        triggerPayload: {
+          provider: 'github',
+          source: 'github-main',
+          event: 'push',
+          deliveryId: 'delivery-1',
+          data: {ref: 'refs/heads/main', headCommitSha: 'a'.repeat(40)},
+        },
+        integrations,
+        projects,
+      });
+
+      expect(run.triggerReference).toBeNull();
+      await expect(
+        db()
+          .select({triggerReference: workflowRuns.triggerReference})
+          .from(workflowRuns)
+          .where(eq(workflowRuns.id, run.id)),
+      ).resolves.toEqual([{triggerReference: null}]);
+    });
+
+    test('resolves and persists a dynamic run name while preserving the static snapshot', async () => {
+      const run = await createWorkflowRun({
+        workspaceId,
+        projectId,
+        definitionId,
+        model: buildModel({
+          name: 'Deploy application',
+          runName: `Deploy ${template('event.environment')}`,
+        }),
+        triggerPayload: {
+          source: 'github',
+          event: 'deployment',
+          deliveryId: 'delivery-1',
+          data: {environment: 'production'},
+        },
+      });
+
+      expect(run).toMatchObject({
+        name: 'Deploy production',
+        workflowName: 'Deploy application',
+        nameOverride: 'Deploy production',
+      });
+      await expect(getWorkflowRunById(run.id)).resolves.toMatchObject({
+        name: 'Deploy production',
+        workflowName: 'Deploy application',
+        nameOverride: 'Deploy production',
+      });
+    });
+
+    test('loads referenced variables before resolving the run name', async () => {
+      const secrets = createTestSecretsClient();
+      await secrets.setSecrets({
+        workspaceId,
+        projectId,
+        namespace: '',
+        values: {ENVIRONMENT: 'staging'},
+      });
+
+      const run = await createWorkflowRun({
+        workspaceId,
+        projectId,
+        definitionId,
+        model: buildModel({runName: `Deploy ${template('vars.ENVIRONMENT')}`}),
+        triggerPayload: {
+          source: 'manual',
+          event: 'fire',
+          subscriptionId: crypto.randomUUID(),
+          userId: crypto.randomUUID(),
+        },
+        secrets,
+      });
+
+      expect(run).toMatchObject({
+        name: 'Deploy staging',
+        workflowName: 'Test Workflow',
+        nameOverride: 'Deploy staging',
+      });
+    });
+
+    test('creates the run when only the run name references variables without a secrets client', async () => {
+      const run = await createWorkflowRun({
+        workspaceId,
+        projectId,
+        definitionId,
+        model: buildModel({
+          name: 'Deploy application',
+          runName: template('vars.ENVIRONMENT'),
+        }),
+        triggerPayload: {
+          source: 'manual',
+          event: 'fire',
+          subscriptionId: crypto.randomUUID(),
+          userId: crypto.randomUUID(),
+        },
+      });
+
+      expect(run).toMatchObject({
+        name: 'Deploy application',
+        workflowName: 'Deploy application',
+        nameOverride: null,
+      });
+      await expect(getJobsByWorkflowRunId(run.id)).resolves.toHaveLength(1);
+    });
+
+    test('falls back to the static name when run-name resolution cannot produce a value', async () => {
+      const run = await createWorkflowRun({
+        workspaceId,
+        projectId,
+        definitionId,
+        model: buildModel({
+          name: 'Deploy application',
+          runName: template('event.environment'),
+        }),
+        triggerPayload: {
+          source: 'github',
+          event: 'deployment',
+          deliveryId: 'delivery-1',
+          data: {},
+        },
+      });
+
+      expect(run).toMatchObject({
+        name: 'Deploy application',
+        workflowName: 'Deploy application',
+        nameOverride: null,
+      });
+      await expect(
+        db()
+          .select({name: workflowRuns.name, workflowName: workflowRuns.workflowName})
+          .from(workflowRuns)
+          .where(eq(workflowRuns.id, run.id)),
+      ).resolves.toEqual([{name: null, workflowName: 'Deploy application'}]);
+      await expect(getJobsByWorkflowRunId(run.id)).resolves.toHaveLength(1);
+    });
+
     test('inserts run, jobs, and steps atomically', async () => {
       const run = await createWorkflowRun({
         workspaceId,
@@ -53,6 +279,7 @@ describe('workflow run queries', () => {
       expect(run.id).toBeDefined();
       expect(run.projectId).toBe(projectId);
       expect(run.definitionId).toBe(definitionId);
+      expect(run.number).toBe(1);
       expect(run.status).toBe('pending');
       expect(run.triggerProvider).toBeNull();
       expect(run.triggerPayload).toMatchObject({source: 'manual', event: 'fire'});
@@ -75,7 +302,8 @@ describe('workflow run queries', () => {
       expect(jobExecutions[0]).toMatchObject({
         jobId: runJobs[0]?.id,
         sequence: 1,
-        name: 'build #1',
+        nameOverride: null,
+        name: 'build',
         runner: ['ubuntu-latest'],
         evaluationTrace: null,
       });
@@ -88,11 +316,147 @@ describe('workflow run queries', () => {
         type: 'setup',
         name: 'Set up job',
         position: 0,
-        config: {},
+        config: {
+          checkout: {
+            permissions: {contents: 'read'},
+            persist_credentials: true,
+          },
+        },
       });
       expect(jobSteps[1]).toMatchObject({position: 1, config: {run: 'echo hello'}});
     });
 
+    test('allocates distinct consecutive numbers for concurrent creations of one definition', async () => {
+      const [first, second] = await Promise.all([
+        createWorkflowRun({
+          workspaceId,
+          projectId,
+          definitionId,
+          model: buildModel({name: 'First'}),
+          triggerPayload: {
+            source: 'manual',
+            event: 'fire',
+            subscriptionId: crypto.randomUUID(),
+            userId: crypto.randomUUID(),
+          },
+        }),
+        createWorkflowRun({
+          workspaceId,
+          projectId,
+          definitionId,
+          model: buildModel({name: 'Second'}),
+          triggerPayload: {
+            source: 'manual',
+            event: 'fire',
+            subscriptionId: crypto.randomUUID(),
+            userId: crypto.randomUUID(),
+          },
+        }),
+      ]);
+
+      expect([first.number, second.number].sort((a, b) => a - b)).toEqual([1, 2]);
+      const [counter] = await db()
+        .select()
+        .from(workflowRunCounters)
+        .where(eq(workflowRunCounters.definitionId, definitionId));
+      expect(counter?.nextNumber).toBe(3);
+    });
+
+    test('makes the allocated number available to run-creation expressions', async () => {
+      const run = await createWorkflowRun({
+        workspaceId,
+        projectId,
+        definitionId,
+        model: buildModel({
+          jobs: {
+            build: {
+              executionName: `Build #${template('run.number')}`,
+              steps: [{run: 'echo build'}],
+            },
+          },
+        }),
+        triggerPayload: {
+          source: 'manual',
+          event: 'fire',
+          subscriptionId: crypto.randomUUID(),
+          userId: crypto.randomUUID(),
+        },
+      });
+      const [job] = await getJobsByWorkflowRunId(run.id);
+      if (!job) throw new Error('Expected workflow job');
+      const [execution] = await getJobExecutionsByJobId(job.id);
+
+      expect(execution?.name).toBe('Build #1');
+    });
+
+    test('rolls back number allocation when creation rolls back', async () => {
+      await expect(
+        createWorkflowRun({
+          workspaceId,
+          projectId,
+          definitionId,
+          model: buildModel({env: {TOKEN: template('vars.TOKEN')}}),
+          triggerPayload: {
+            source: 'manual',
+            event: 'fire',
+            subscriptionId: crypto.randomUUID(),
+            userId: crypto.randomUUID(),
+          },
+        }),
+      ).rejects.toThrow('Secrets client is not configured.');
+
+      const run = await createWorkflowRun({
+        workspaceId,
+        projectId,
+        definitionId,
+        model: buildModel(),
+        triggerPayload: {
+          source: 'manual',
+          event: 'fire',
+          subscriptionId: crypto.randomUUID(),
+          userId: crypto.randomUUID(),
+        },
+      });
+
+      expect(run.number).toBe(1);
+      const [counter] = await db()
+        .select()
+        .from(workflowRunCounters)
+        .where(eq(workflowRunCounters.definitionId, definitionId));
+      expect(counter?.nextNumber).toBe(2);
+    });
+
+    test('numbers definitions independently within one project', async () => {
+      const otherDefinitionId = crypto.randomUUID();
+      const first = await createWorkflowRun({
+        workspaceId,
+        projectId,
+        definitionId,
+        model: buildModel(),
+        triggerPayload: {
+          source: 'manual',
+          event: 'fire',
+          subscriptionId: crypto.randomUUID(),
+          userId: crypto.randomUUID(),
+        },
+      });
+      const second = await createWorkflowRun({
+        workspaceId,
+        projectId,
+        definitionId: otherDefinitionId,
+        model: buildModel(),
+        triggerPayload: {
+          source: 'manual',
+          event: 'fire',
+          subscriptionId: crypto.randomUUID(),
+          userId: crypto.randomUUID(),
+        },
+      });
+
+      expect(first.number).toBe(1);
+      expect(second.number).toBe(1);
+    });
+
     async function createJobOutputRun() {
       const run = await createWorkflowRun({
         workspaceId,
@@ -219,7 +583,7 @@ describe('workflow run queries', () => {
         env: {RUN_ID: template('run.id')},
         jobs: {
           build: {
-            name: `Build ${template('event.ref')}`,
+            executionName: `Build ${template('event.ref')}`,
             steps: [
               {
                 run: 'npm test',
@@ -257,15 +621,122 @@ describe('workflow run queries', () => {
           {
             expression: 'event.ref',
             roots: ['event'],
-            fillTarget: 'ingest',
+            fillTarget: 'execution-creation',
             evaluatedAt: 'execution-creation',
             value: 'refs/heads/main',
-            field: 'job.name',
+            field: 'job.execution_name',
           },
         ],
       });
     });
 
+    test('loads predicate vars once and persists the run-creation snapshot', async () => {
+      const secrets = createTestSecretsClient();
+      const values = {
+        JOB_IF: 'true',
+        JOB_SUCCESS: 'true',
+        STEP_IF: 'true',
+        GATE_SUCCESS: 'true',
+        LISTENER_ON: 'true',
+        LISTENER_UNTIL: 'true',
+      };
+      await secrets.setSecrets({workspaceId, projectId, values});
+
+      const model = workflowModel({
+        jobs: {
+          build: {
+            if: 'vars.JOB_IF == "true"',
+            success: 'vars.JOB_SUCCESS == "true"',
+            steps: [
+              {
+                if: expression('vars.STEP_IF == "true"'),
+                gate: {success: expression('vars.GATE_SUCCESS == "true"')},
+                run: 'echo build',
+              },
+            ],
+          },
+          listen: {
+            listening: {
+              on: [{source: 'github', event: 'push', filter: 'vars.LISTENER_ON == "true"'}],
+              until: [
+                {source: 'github', event: 'pull_request', filter: 'vars.LISTENER_UNTIL == "true"'},
+              ],
+              onResolve: 'finish',
+            },
+            steps: [{run: 'echo listen'}],
+          },
+        },
+      });
+
+      const run = await createWorkflowRun({
+        workspaceId,
+        projectId,
+        definitionId,
+        model,
+        triggerPayload: {
+          source: 'manual',
+          event: 'fire',
+          subscriptionId: crypto.randomUUID(),
+          userId: crypto.randomUUID(),
+        },
+        secrets,
+      });
+
+      const [attempt] = await listRunAttempts({workflowRunId: run.id, projectId});
+
+      expect(attempt?.vars).toEqual(values);
+    });
+
+    test('evaluates job and step predicates from the persisted vars snapshot', async () => {
+      const secrets = createTestSecretsClient();
+      await secrets.setSecrets({workspaceId, projectId, values: {ENABLED: 'true'}});
+      const model = workflowModel({
+        jobs: {
+          build: {
+            if: 'vars.ENABLED == "true"',
+            steps: [{if: expression('vars.ENABLED == "true"'), run: 'echo build'}],
+          },
+        },
+      });
+
+      const run = await createWorkflowRun({
+        workspaceId,
+        projectId,
+        definitionId,
+        model,
+        triggerPayload: {
+          source: 'manual',
+          event: 'fire',
+          subscriptionId: crypto.randomUUID(),
+          userId: crypto.randomUUID(),
+        },
+        secrets,
+      });
+      await secrets.setSecrets({workspaceId, projectId, values: {ENABLED: 'false'}});
+
+      const [job] = await getJobsByWorkflowRunId(run.id);
+      if (!job) throw new Error('Expected workflow job');
+      const activation = await evaluateJobActivations({
+        runAttemptId: job.workflowRunAttemptId,
+        jobs: [{jobId: job.id, expectedVersion: job.version}],
+      });
+      expect(activation).toEqual([{kind: 'start-job', jobId: job.id}]);
+
+      const [execution] = await getJobExecutionsByJobId(job.id);
+      if (!execution) throw new Error('Expected job execution');
+      const setup = await nextStepForJob(job.id);
+      if (setup.kind !== 'step') throw new Error('Expected setup step');
+      expect(setup).toMatchObject({kind: 'step', step: {type: 'setup'}});
+      await recordStepResult({
+        jobExecutionId: execution.id,
+        stepId: setup.step.id,
+        status: 'succeeded',
+      });
+
+      const guarded = await nextStepForJob(job.id);
+      expect(guarded).toMatchObject({kind: 'step', step: {position: 1}, dispatched: true});
+    });
+
     test('returns the persisted model in run detail', async () => {
       const model = buildModel({
         env: {RUN_ID: template('run.id')},
@@ -335,7 +806,8 @@ describe('workflow run queries', () => {
         runner: 'ubuntu-latest',
         jobs: {
           listen: {
-            name: displayNameSource,
+            name: 'Process review',
+            executionName: displayNameSource,
             listening: {
               on: [{source: 'github', event: 'pull_request_review'}],
               until: [{source: 'github', event: 'pull_request'}],
@@ -370,7 +842,7 @@ describe('workflow run queries', () => {
       const build = runJobs.find((job) => job.key === 'build');
       expect(listen).toMatchObject({
         mode: 'listening',
-        name: displayNameSource,
+        name: 'Process review',
         listeningTimeoutMs: 30 * 24 * 60 * 60 * 1000,
         maxExecutions: 3,
         onResolve: 'cancel',
@@ -405,7 +877,8 @@ describe('workflow run queries', () => {
         runner: 'ubuntu-latest',
         jobs: {
           listen: {
-            name: displayNameSource,
+            name: 'Process review',
+            executionName: displayNameSource,
             listening: {
               on: [{source: 'github', event: 'pull_request_review'}],
               until: [{source: 'github', event: 'pull_request'}],
@@ -561,6 +1034,46 @@ describe('workflow run queries', () => {
           }),
         expected: {field: 'step.name', source: 'vars.REQUIRED'},
       },
+      {
+        field: 'step.working_directory',
+        model: () =>
+          workflowModel({
+            name: 'Missing working directory var',
+            runner: 'ubuntu-latest',
+            jobs: {
+              build: {
+                steps: [{workingDirectory: template('vars.REQUIRED'), run: 'echo ok'}],
+              },
+            },
+          }),
+        expected: {field: 'step.working_directory', source: 'vars.REQUIRED'},
+      },
+      {
+        field: 'checkout.repository',
+        model: () =>
+          workflowModel({
+            name: 'Missing checkout repository var',
+            runner: 'ubuntu-latest',
+            jobs: {
+              build: {
+                steps: [
+                  {
+                    checkout: {
+                      repository: template('vars.REQUIRED'),
+                      fetchDepth: 1,
+                      permissions: {contents: 'read'},
+                      persistCredentials: true,
+                      templates: {
+                        repository: checkoutTemplate(template('vars.REQUIRED')),
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+          }),
+        expected: {field: 'checkout.repository', source: 'vars.REQUIRED'},
+      },
     ] as const)('reports missing variables against $field', async ({model, expected}) => {
       let error: unknown;
       try {
@@ -585,6 +1098,42 @@ describe('workflow run queries', () => {
       expect(error).toMatchObject(expected);
     });
 
+    test('resolves a working directory that references a workspace variable', async () => {
+      const secrets = createTestSecretsClient();
+      await secrets.setSecrets({
+        workspaceId,
+        namespace: '',
+        values: {BUILD_DIR: 'packages/api'},
+      });
+      const model = workflowModel({
+        name: 'Working directory from var',
+        runner: 'ubuntu-latest',
+        jobs: {
+          build: {
+            steps: [{workingDirectory: template('vars.BUILD_DIR'), run: 'echo ok'}],
+          },
+        },
+      });
+
+      const run = await createWorkflowRun({
+        workspaceId,
+        projectId,
+        definitionId,
+        model,
+        triggerPayload: {
+          source: 'manual',
+          event: 'fire',
+          subscriptionId: crypto.randomUUID(),
+          userId: crypto.randomUUID(),
+        },
+        secrets,
+      });
+
+      const [build] = await getJobsByWorkflowRunId(run.id);
+      const [, step] = await getStepsByJobId(build?.id as string);
+      expect(step?.config).toMatchObject({run: 'echo ok', working_directory: 'packages/api'});
+    });
+
     test('writes workflows.workflow_run_attempt.created outbox event in same transaction', async () => {
       const run = await createWorkflowRun({
         workspaceId,
@@ -1186,6 +1735,7 @@ describe('workflow run queries', () => {
       });
 
       expect(second.id).toBe(first.id);
+      expect(second.number).toBe(first.number);
       expect(second.triggerIdempotencyKey).toBe(idempotencyKey);
       expect(second.sourceSnapshot).toEqual({
         content: 'name: Original\njobs: {}\n',
@@ -1202,6 +1752,54 @@ describe('workflow run queries', () => {
         .from(workflowsOutbox)
         .where(sql`${workflowsOutbox.payload}->>'workflowRunId' = ${first.id}`);
       expect(outboxRows).toHaveLength(1);
+      const [counter] = await db()
+        .select()
+        .from(workflowRunCounters)
+        .where(eq(workflowRunCounters.definitionId, definitionId));
+      expect(counter?.nextNumber).toBe(2);
+    });
+
+    test('duplicate triggerIdempotencyKey returns the persisted run name without reevaluating it', async () => {
+      const idempotencyKey = crypto.randomUUID();
+      const first = await createWorkflowRun({
+        workspaceId,
+        projectId,
+        definitionId,
+        model: buildModel({
+          name: 'Deploy application',
+          runName: `Deploy ${template('event.environment')}`,
+        }),
+        triggerPayload: {
+          source: 'github',
+          event: 'deployment',
+          deliveryId: 'delivery-1',
+          data: {environment: 'production'},
+        },
+        triggerIdempotencyKey: idempotencyKey,
+      });
+      const replay = await createWorkflowRun({
+        workspaceId,
+        projectId,
+        definitionId,
+        model: buildModel({
+          name: 'Changed workflow',
+          runName: `Changed ${template('event.environment')}`,
+        }),
+        triggerPayload: {
+          source: 'github',
+          event: 'deployment',
+          deliveryId: 'delivery-2',
+          data: {environment: 'staging'},
+        },
+        triggerIdempotencyKey: idempotencyKey,
+      });
+
+      expect(replay).toMatchObject({
+        id: first.id,
+        name: 'Deploy production',
+        workflowName: 'Deploy application',
+        nameOverride: 'Deploy production',
+      });
     });
 
     test('duplicate triggerIdempotencyKey returns the existing run without re-materializing', async () => {