name: Weekly test health

# The weekly home for checks that need CI history (CEO-18): `bun run
# test:health --enforce` reads the last 7 days of GitHub Actions history and
# fails when a free test file flakes in more than 5% of main free-tests runs
# over a window of at least 20 runs (W7a), or when more than 5 free test files
# are missing from scripts/free-test-durations.json (CEO-10: stale seed).
# Metrics whose inputs are unavailable never fail the run; they are listed in
# the job summary. Runs Monday after the periodic census (06:00 UTC), on a
# free hosted runner, and runs even when the census is cancelled or red.
#
# Tracking issue (DX-9): an enforced failure upserts one issue; a run with
# unavailable inputs keeps it open and lists them; it closes only when every
# enforced check has evidence and passes. Only main runs touch the issue.
# Pinned by test/test-health-workflow.test.ts.

on:
  schedule:
    - cron: '0 10 * * 1'
  workflow_dispatch:

permissions:
  contents: read
  actions: read
  issues: write

concurrency:
  group: test-health-${{ github.ref }}
  cancel-in-progress: true

jobs:
  health:
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.4.2
      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Measure test health
        id: health
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set +e
          bun run test:health --since-days 7 --enforce --json --summary "$RUNNER_TEMP/health.md" > "$RUNNER_TEMP/health.json"
          status=$?
          set -e
          cat "$RUNNER_TEMP/health.md" >> "$GITHUB_STEP_SUMMARY" || true
          action=$(jq -r '.issueAction // "keep-open"' "$RUNNER_TEMP/health.json" 2>/dev/null || echo keep-open)
          echo "exit=$status" >> "$GITHUB_OUTPUT"
          echo "issue_action=$action" >> "$GITHUB_OUTPUT"

      - name: Update the tracking issue
        if: always() && github.ref == 'refs/heads/main'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ISSUE_ACTION: ${{ steps.health.outputs.issue_action || 'keep-open' }}
        run: |
          set -euo pipefail
          TITLE="Weekly test health: enforced check needs triage"
          RUN_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
          BODY_FILE="$RUNNER_TEMP/issue.md"
          { echo "Run: $RUN_URL"; echo; cat "$RUNNER_TEMP/health.md" 2>/dev/null || echo "(no report: the test:health step did not produce one)"; } > "$BODY_FILE"
          EXISTING=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open --search "in:title \"$TITLE\"" --json number --jq '.[0].number // empty')
          case "$ISSUE_ACTION" in
            upsert)
              if [ -n "$EXISTING" ]; then gh issue comment "$EXISTING" --repo "$GITHUB_REPOSITORY" --body-file "$BODY_FILE";
              else gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body-file "$BODY_FILE"; fi ;;
            close)
              if [ -n "$EXISTING" ]; then gh issue close "$EXISTING" --repo "$GITHUB_REPOSITORY" --comment "Every enforced check has evidence and passes: $RUN_URL"; fi ;;
            *)
              if [ -n "$EXISTING" ]; then gh issue comment "$EXISTING" --repo "$GITHUB_REPOSITORY" --body-file "$BODY_FILE"; fi ;;
          esac

      - name: Fail when an enforced check failed
        if: always() && steps.health.outputs.exit != '0'
        run: exit 1