prowler/.github/workflows/test-impact-analysis.yml

name: Test Impact Analysis

on:
  workflow_call:
    outputs:
      run-all:
        description: "Whether to run all tests (critical path changed)"
        value: ${{ jobs.analyze.outputs.run-all }}
      sdk-tests:
        description: "SDK test paths to run"
        value: ${{ jobs.analyze.outputs.sdk-tests }}
      api-tests:
        description: "API test paths to run"
        value: ${{ jobs.analyze.outputs.api-tests }}
      ui-e2e:
        description: "UI E2E test paths to run"
        value: ${{ jobs.analyze.outputs.ui-e2e }}
      modules:
        description: "Comma-separated list of affected modules"
        value: ${{ jobs.analyze.outputs.modules }}
      has-tests:
        description: "Whether there are any tests to run"
        value: ${{ jobs.analyze.outputs.has-tests }}
      has-sdk-tests:
        description: "Whether there are SDK tests to run"
        value: ${{ jobs.analyze.outputs.has-sdk-tests }}
      has-api-tests:
        description: "Whether there are API tests to run"
        value: ${{ jobs.analyze.outputs.has-api-tests }}
      has-ui-e2e:
        description: "Whether there are UI E2E tests to run"
        value: ${{ jobs.analyze.outputs.has-ui-e2e }}

permissions: {}

jobs:
  analyze:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      run-all: ${{ steps.impact.outputs.run-all }}
      sdk-tests: ${{ steps.impact.outputs.sdk-tests }}
      api-tests: ${{ steps.impact.outputs.api-tests }}
      ui-e2e: ${{ steps.impact.outputs.ui-e2e }}
      modules: ${{ steps.impact.outputs.modules }}
      has-tests: ${{ steps.impact.outputs.has-tests }}
      has-sdk-tests: ${{ steps.set-flags.outputs.has-sdk-tests }}
      has-api-tests: ${{ steps.set-flags.outputs.has-api-tests }}
      has-ui-e2e: ${{ steps.set-flags.outputs.has-ui-e2e }}
    permissions:
      contents: read

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            pypi.org:443
            files.pythonhosted.org:443

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch

      - name: Get changed files
        id: changed-files
        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5

      - name: Setup Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.12'

      - name: Install PyYAML
        run: pip install pyyaml

      - name: Analyze test impact
        id: impact
        run: |
          echo "Changed files:"
          echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n'
          echo ""
          python .github/scripts/test-impact.py ${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}
        env:
          STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}

      - name: Set convenience flags
        id: set-flags
        run: |
          if [[ -n "${STEPS_IMPACT_OUTPUTS_SDK_TESTS}" ]]; then
            echo "has-sdk-tests=true" >> $GITHUB_OUTPUT
          else
            echo "has-sdk-tests=false" >> $GITHUB_OUTPUT
          fi

          if [[ -n "${STEPS_IMPACT_OUTPUTS_API_TESTS}" ]]; then
            echo "has-api-tests=true" >> $GITHUB_OUTPUT
          else
            echo "has-api-tests=false" >> $GITHUB_OUTPUT
          fi

          if [[ -n "${STEPS_IMPACT_OUTPUTS_UI_E2E}" ]]; then
            echo "has-ui-e2e=true" >> $GITHUB_OUTPUT
          else
            echo "has-ui-e2e=false" >> $GITHUB_OUTPUT
          fi
        env:
          STEPS_IMPACT_OUTPUTS_SDK_TESTS: ${{ steps.impact.outputs.sdk-tests }}
          STEPS_IMPACT_OUTPUTS_API_TESTS: ${{ steps.impact.outputs.api-tests }}
          STEPS_IMPACT_OUTPUTS_UI_E2E: ${{ steps.impact.outputs.ui-e2e }}

      - name: Summary
        run: |
          echo "## Test Impact Analysis" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          if [[ "${STEPS_IMPACT_OUTPUTS_RUN_ALL}" == "true" ]]; then
            echo "🚨 **Critical path changed - running ALL tests**" >> $GITHUB_STEP_SUMMARY
          else
            echo "### Affected Modules" >> $GITHUB_STEP_SUMMARY
            echo "\`${STEPS_IMPACT_OUTPUTS_MODULES}\`" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY

            echo "### Tests to Run" >> $GITHUB_STEP_SUMMARY
            echo "| Category | Paths |" >> $GITHUB_STEP_SUMMARY
            echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
            echo "| SDK Tests | \`${STEPS_IMPACT_OUTPUTS_SDK_TESTS:-none}\` |" >> $GITHUB_STEP_SUMMARY
            echo "| API Tests | \`${STEPS_IMPACT_OUTPUTS_API_TESTS:-none}\` |" >> $GITHUB_STEP_SUMMARY
            echo "| UI E2E | \`${STEPS_IMPACT_OUTPUTS_UI_E2E:-none}\` |" >> $GITHUB_STEP_SUMMARY
          fi

        env:
          STEPS_IMPACT_OUTPUTS_RUN_ALL: ${{ steps.impact.outputs.run-all }}
          STEPS_IMPACT_OUTPUTS_SDK_TESTS: ${{ steps.impact.outputs.sdk-tests }}
          STEPS_IMPACT_OUTPUTS_API_TESTS: ${{ steps.impact.outputs.api-tests }}
          STEPS_IMPACT_OUTPUTS_UI_E2E: ${{ steps.impact.outputs.ui-e2e }}
          STEPS_IMPACT_OUTPUTS_MODULES: ${{ steps.impact.outputs.modules }}