name: Test Platform

on:
  workflow_call:
    inputs:
      target:
        description: Platform label used for artifacts and caches.
        required: true
        type: string
      runner:
        description: GitHub Actions runner label.
        required: true
        type: string
      os:
        description: Operating-system family (linux or darwin).
        required: true
        type: string
      agentd_target:
        description: Rust target for native Linux agentd tests.
        required: false
        default: ""
        type: string

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  CARGO_NET_RETRY: "10"
  CARGO_HTTP_TIMEOUT: "120"
  CARGO_HTTP_MULTIPLEXING: "false"

jobs:
  test:
    name: Test (${{ inputs.target }})
    runs-on: ${{ inputs.runner }}
    timeout-minutes: 45
    env:
      CARGO_INCREMENTAL: "0"
      # Workspace test binaries exhaust hosted-runner disks with full debug info.
      # Match the integration archive while preserving file:line backtraces.
      CARGO_PROFILE_DEV_DEBUG: "line-tables-only"
      CARGO_PROFILE_TEST_DEBUG: "line-tables-only"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Free disk space (hosted Linux)
        if: inputs.os == 'linux' && runner.environment == 'github-hosted'
        run: |
          # Workspace tests do not use Android, .NET, or Haskell SDKs. Only
          # disposable hosted runners may remove these preinstalled tools.
          df -h /
          sudo rm -rf -- /usr/local/lib/android /usr/share/dotnet /opt/ghc
          df -h /

      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Install build deps (Linux)
        if: inputs.os == 'linux'
        run: sudo apt-get update && sudo apt-get install -y musl-tools libcap-ng-dev strace python3-dev

      - name: Configure Python linking (Linux)
        if: inputs.os == 'linux'
        id: python
        run: |
          # Rust tests embed Python, so select the interpreter whose headers and
          # shared library were installed together by apt, not a toolcache Python.
          echo 'PYO3_PYTHON=/usr/bin/python3' >> "$GITHUB_ENV"
          # PyO3 caches its linker configuration. Include the system Python
          # configuration so runner image upgrades cannot restore stale libpython paths.
          python_config=$(/usr/bin/python3 -m sysconfig | sha256sum | cut -d ' ' -f 1)
          echo "cache-key=system-python-${python_config}" >> "$GITHUB_OUTPUT"

      - uses: Swatinem/rust-cache@c8037a86dde8214a8310e9f54a8fc61ab362aa31 # v2
        with:
          cache-bin: false
          cache-targets: true
          key: ${{ steps.python.outputs.cache-key }}

      # Reuse the runtime already built by Check Platform. The SDK build script
      # discovers build/ in CI, so unit tests no longer repeat the release/LTO
      # msb, agentd, and libkrunfw build.
      - name: Download runtime artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: msb-${{ inputs.target }}
          path: build/

      - name: Test agentd (Linux)
        if: inputs.os == 'linux'
        run: |
          rustup target add --toolchain stable ${{ inputs.agentd_target }}
          cargo +stable test --manifest-path crates/agentd/Cargo.toml --target ${{ inputs.agentd_target }}

      - name: Test privileged agentd resource limits (Linux)
        if: inputs.os == 'linux'
        run: |
          cargo +stable test --manifest-path crates/agentd/Cargo.toml \
            --target ${{ inputs.agentd_target }} \
            --config 'target.${{ inputs.agentd_target }}.runner = ["bash", "${{ github.workspace }}/scripts/ci/run-agentd-privileged-tests.sh"]' \
            --lib nonroot_rlimits -- --ignored

      - name: Set up mold (Linux host link)
        if: inputs.os == 'linux'
        uses: rui314/setup-mold@da13e0b42e392e3a45d1215033a2270b849d7d36 # 2.41.0

      - name: Test workspace
        run: cargo +stable test --workspace --exclude microsandbox-agentd