php.yml

name: build

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      sqlite_timer_qualification:
        description: 'Also execute the original real two-worker SQLite timer workload'
        type: boolean
        default: false

permissions:
  contents: read

concurrency:
  group: build-${{ github.event_name }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  action-policy:
    name: Central action policy preflight
    if: ${{ github.server_url == 'https://github.com' }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
    - name: Check out candidate source
      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      with:
        persist-credentials: false
    - name: Check out central action policy
      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      with:
        repository: durable-workflow/.github
        ref: main
        path: .central-action-policy
        persist-credentials: false
    - name: Set up Python
      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
      with:
        python-version: "3.13"
    - name: Bootstrap patched pip trust
      uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
    - name: Install policy dependencies
      run: "python -m pip install --only-binary :all: PyYAML==6.0.2"
    - name: Require centrally approved immutable action commits
      run: >-
        python .central-action-policy/scripts/qualification_policy.py validate
        --policy .central-action-policy/qualification/policy.json
        --target workflow
        --workflow-directory .github/workflows

  preflight:
    name: Validate repository contracts
    runs-on: ubuntu-latest
    timeout-minutes: 2
    outputs:
      laravel_source_matrix: ${{ steps.laravel-matrix.outputs.matrix }}

    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      with:
        fetch-depth: 0
        persist-credentials: false

    - name: Verify build and feature selection contracts
      run: python scripts/ci/test-build-routing.py

    - name: Require APT retries off before networked APT (CVE-2026-109518)
      run: python -I scripts/ci/test-apt-no-retries.py

    - name: Verify complete feature inventories
      run: php scripts/ci/verify-feature-shards.php

    - name: Validate workflow YAML syntax
      run: yq eval-all '.' .github/workflows/*.yml >/dev/null

    - name: Validate GitHub Actions expressions
      run: |
        docker run --rm --network none --user "$(id -u):$(id -g)" \
          --cpus 1 --memory 256m --memory-swap 256m \
          --volume "$PWD:/repo:ro" --workdir /repo \
          rhysd/actionlint@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 \
          -shellcheck= -pyflakes= .github/workflows/*.yml

    - name: Validate CI script syntax
      run: |
        bash -n \
          scripts/ci/laravel-embedded-upgrade-smoke.sh \
          scripts/ci/check-packagist-release.sh \
          scripts/ci/check-platform-conformance-mirror.sh \
          scripts/ci/test-platform-conformance-resolver-audit.sh
        php -l scripts/ci/compare-platform-conformance-mirrors.php
        php -l scripts/ci/check-v2-coverage.php
        php -l scripts/ci/list-worker-protocol-resolvers.php
        php -l scripts/ci/check-laravel-dependency-security.php
        php -l scripts/ci/laravel-embedded-upgrade-matrix.php
        php -l scripts/ci/verify-history-export-source-identity.php
        php scripts/ci/check-v2-coverage.php --self-test
        python - <<'PY'
        import ast
        from pathlib import Path

        for path in Path("scripts/ci").glob("*.py"):
            ast.parse(path.read_text(), filename=str(path))
        PY

    - name: Verify platform conformance resolver audit
      run: scripts/ci/test-platform-conformance-resolver-audit.sh

    - name: Validate Laravel dependency security policy
      run: php scripts/ci/check-laravel-dependency-security.php --policy-only

    - name: Validate committed Composer lock inventory
      run: php scripts/ci/check-committed-composer-locks.php --inventory-only

    - name: Install payload consumer dependencies
      run: composer install --prefer-dist --no-progress --no-dev --no-scripts

    - name: Derive bounded Laravel source qualification
      id: laravel-matrix
      run: echo "matrix=$(php scripts/ci/laravel-embedded-upgrade-matrix.php --scope=source)" >> "$GITHUB_OUTPUT"

    - name: Require durable replay and codec evidence
      env:
        CORPUS_BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
      run: |
        arguments=()
        if [[ "$CORPUS_BASE_REF" =~ ^[0-9a-f]{40}$ ]] && [[ ! "$CORPUS_BASE_REF" =~ ^0+$ ]]; then
          arguments+=(--base-ref "$CORPUS_BASE_REF")
        fi
        python scripts/ci/validate-regression-corpus.py \
          --skip-counterfactual \
          "${arguments[@]}"
        python scripts/ci/test-regression-corpus-policy.py

    - name: Scan public boundary
      shell: bash
      env:
        BUILD_EVENT_NAME: ${{ github.event_name }}
        BUILD_BEFORE_SHA: ${{ github.event.before }}
        BUILD_HEAD_SHA: ${{ github.sha }}
        PULL_REQUEST_BASE_SHA: ${{ github.event.pull_request.base.sha }}
        PULL_REQUEST_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        PULL_REQUEST_BASE_REF: ${{ github.event.pull_request.base.ref }}
      run: |
        set -euo pipefail

        baseline=""
        if [ "$BUILD_EVENT_NAME" = "pull_request" ]; then
          range="${PULL_REQUEST_BASE_SHA}..${PULL_REQUEST_HEAD_SHA}"
          base_ref="origin/${PULL_REQUEST_BASE_REF}"
          if git rev-parse --verify --quiet "${base_ref}^{commit}" >/dev/null; then
            baseline="$base_ref"
          else
            baseline="$PULL_REQUEST_BASE_SHA"
          fi
        elif [[ "$BUILD_BEFORE_SHA" =~ ^[0-9a-f]{40}$ ]] \
          && [[ ! "$BUILD_BEFORE_SHA" =~ ^0+$ ]] \
          && git cat-file -e "${BUILD_BEFORE_SHA}^{commit}"; then
          range="${BUILD_BEFORE_SHA}..${BUILD_HEAD_SHA}"
        elif git rev-parse --verify --quiet "${BUILD_HEAD_SHA}^" >/dev/null; then
          range="${BUILD_HEAD_SHA}^..${BUILD_HEAD_SHA}"
        else
          range="$BUILD_HEAD_SHA"
        fi

        PUBLIC_BOUNDARY_GIT_RANGE="$range" \
          PUBLIC_BOUNDARY_GIT_BASELINE="$baseline" \
          scripts/check-public-boundary.sh

  regression-corpus:
    needs: preflight
    runs-on: ubuntu-latest
    # Each new fixture adds two full consumer runs after the baseline.
    # Four fixtures already exceed six minutes on the hosted runner.
    timeout-minutes: 12
    env:
      # The runner's system PHP loads Xdebug. Each official consumer run takes
      # several times longer with it, and the validator runs the consumer
      # 1 + 2N times for N new fixtures.
      XDEBUG_MODE: 'off'

    services:
      redis:
        image: redis
        ports:
        - 6379

    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      with:
        fetch-depth: 0
        persist-credentials: false

    - name: Cache Composer packages
      if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25  # v5
      with:
        path: vendor
        key: ${{ github.event_name }}-${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
        restore-keys: |
          ${{ github.event_name }}-${{ runner.os }}-php-

    - name: Install dependencies
      run: composer install --prefer-dist --no-progress

    - name: Prepare official consumer runtime
      env:
        REDIS_PUBLISHED_PORT: ${{ job.services.redis.ports['6379'] }}
      run: |
        if [ -d /dev/shm ] && [ -w /dev/shm ]; then
          temporary_root=/dev/shm
        else
          temporary_root="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
        fi
        run_token="${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-1}"
        corpus_db="${temporary_root}/workflow-regression-corpus-${run_token}.sqlite"
        touch "$corpus_db"

        if getent hosts redis > /dev/null 2>&1; then
          redis_host=redis
          redis_port=6379
        elif [ -n "$REDIS_PUBLISHED_PORT" ]; then
          redis_host=127.0.0.1
          redis_port="$REDIS_PUBLISHED_PORT"
        else
          echo "::error::Unable to resolve Redis service endpoint" >&2
          exit 1
        fi

        {
          echo "CORPUS_DB_PATH=$corpus_db"
          echo "APP_KEY=base64:i3g6f+dV8FfsIkcxqd7gbiPn2oXk5r00sTmdD6V5utI="
          echo "DB_CONNECTION=sqlite"
          echo "DB_DATABASE=$corpus_db"
          echo "CACHE_DRIVER=redis"
          echo "CACHE_STORE=redis"
          echo "QUEUE_CONNECTION=sync"
          echo "QUEUE_FAILED_DRIVER=null"
          echo "REDIS_HOST=$redis_host"
          echo "REDIS_PORT=$redis_port"
          echo "REDIS_PASSWORD="
        } >> "$GITHUB_ENV"

    - name: Prove new regression evidence against base and current bindings
      env:
        CORPUS_BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
      run: |
        arguments=()
        if [[ "$CORPUS_BASE_REF" =~ ^[0-9a-f]{40}$ ]] && [[ ! "$CORPUS_BASE_REF" =~ ^0+$ ]]; then
          arguments+=(--base-ref "$CORPUS_BASE_REF")
        fi
        python scripts/ci/validate-regression-corpus.py "${arguments[@]}"

    - name: Remove regression-corpus database
      if: ${{ always() }}
      run: |
        if [ -n "${CORPUS_DB_PATH:-}" ] \
          && [[ "${CORPUS_DB_PATH##*/}" == workflow-regression-corpus-*.sqlite ]]; then
          rm -f -- "$CORPUS_DB_PATH"
        fi

  quality:
    needs: preflight
    runs-on: ubuntu-latest
    timeout-minutes: 13

    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      with:
          fetch-depth: 10
          persist-credentials: false

    - name: Validate composer.json and composer.lock
      run: composer validate --strict

    - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38  # v6
      with:
        node-version: '22'

    - name: Check tracing overhead recipe
      run: |
        composer --working-dir=.github/tracing-performance validate --strict --no-check-all --no-check-publish
        node --test .github/tracing-performance/probe.test.mjs .github/tracing-performance/analyze.test.mjs

    - name: Cache Composer packages
      if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25  # v5
      with:
        path: vendor
        key: ${{ github.event_name }}-${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
        restore-keys: |
          ${{ github.event_name }}-${{ runner.os }}-php-

    - name: Install dependencies
      run: composer install --prefer-dist --no-progress

    - name: Check coding style via ECS
      run: vendor/bin/ecs check

    - name: Run static analysis via PHPStan
      run: vendor/bin/phpstan analyse src tests

  laravel-embedded-upgrade-source:
    name: Laravel ${{ matrix.laravel }} / PHP ${{ matrix.php }} embedded upgrade
    needs: preflight
    if: ${{ github.event_name != 'pull_request' }}
    runs-on: ubuntu-latest
    timeout-minutes: 25

    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.preflight.outputs.laravel_source_matrix) }}

    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      with:
        persist-credentials: false

    - name: Disable APT download retries (CVE-2026-109518)
      run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null
    - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240  # v2
      with:
        php-version: ${{ matrix.php }}
        tools: composer

    - name: Run the clean stable-v1 to source-v2 journey
      env:
        LARAVEL_VERSION: ${{ matrix.laravel }}
        WORKFLOW_V2_PATH: ${{ github.workspace }}
        WORKFLOW_SQLITE_TIMER_QUALIFICATION: ${{ inputs.sqlite_timer_qualification && '1' || '0' }}
        WORKFLOW_QUEUE_QUALIFICATION_EVIDENCE: ${{ github.workspace }}/sqlite-queue-qualification.json
      run: scripts/ci/laravel-embedded-upgrade-smoke.sh

    - name: Retain original two-worker outcomes including failures
      if: always() && inputs.sqlite_timer_qualification
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
      with:
        name: sqlite-source-queue-job-${{ strategy.job-index }}-php-${{ matrix.php }}
        path: sqlite-queue-qualification.json
        if-no-files-found: error
        retention-days: 90

  tracing-http:
    needs: preflight
    runs-on: ubuntu-latest
    timeout-minutes: 8
    env:
      OTEL_PHP_FIBERS_ENABLED: 'false'

    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      with:
        persist-credentials: false

    - name: Disable APT download retries (CVE-2026-109518)
      run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null
    - name: Set up the optional application instrumentation
      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240  # v2
      with:
        php-version: '8.5'
        extensions: pdo_sqlite, opentelemetry-1.4.2
        tools: composer
        coverage: none
      env:
        fail-fast: true

    - name: Install ordinary package and client instrumentation dependencies
      run: |
        composer install --prefer-dist --no-progress
        composer install --working-dir=.github/tracing-http --prefer-dist --no-progress --no-plugins --no-scripts
        composer audit --working-dir=.github/tracing-http

    - name: Verify real HTTP propagation through independent activity workers
      run: >-
        vendor/bin/phpunit --no-configuration
        --bootstrap .github/tracing-http/bootstrap.php
        --do-not-record-test-run-history --fail-on-warning --fail-on-skipped
        tests/Unit/V2/HttpExecutionTracingTest.php
        tests/Unit/V2/ExporterExecutionTracingTest.php

  pr-unit-contracts:
    needs: preflight
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    timeout-minutes: 13
    env:
      XDEBUG_MODE: 'off'

    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      with:
          fetch-depth: 10
          persist-credentials: false

    - name: Cache Composer packages
      if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25  # v5
      with:
        path: vendor
        key: ${{ github.event_name }}-${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
        restore-keys: |
          ${{ github.event_name }}-${{ runner.os }}-php-

    - name: Install dependencies
      run: composer install --prefer-dist --no-progress

    - name: Run embedded database-queue recovery controls
      run: |
        mkdir -p build/test-results
        vendor/bin/phpunit tests/Unit/V2/DatabaseQueueRecoveryTest.php \
          tests/Unit/V2/EmbeddedSqliteTaskContentionTest.php \
          tests/Unit/V2/ProjectionSqliteContentionTest.php \
          --fail-on-warning --log-junit build/test-results/pr-database-queue-recovery.xml

    - name: Run file-backed SQLite concurrency controls
      env:
        DB_CONNECTION: sqlite
        DB_DATABASE: ${{ runner.temp }}/workflow-overlap-release.sqlite
        CACHE_DRIVER: array
        CACHE_STORE: array
        QUEUE_CONNECTION: sync
        REDIS_HOST: ''
      run: |
        touch "$DB_DATABASE"
        vendor/bin/phpunit tests/Unit/WorkflowOverlapReleaseTest.php \
          tests/Unit/WorkflowOptionsTest.php \
          tests/Unit/V2/LegacyOverlapOptionsBoundaryTest.php \
          tests/Unit/V2/HostServiceQueryDispatchTest.php \
          tests/Unit/V2/HostServiceQueryLifecycleTest.php \
          tests/Unit/V2/HostServiceQueryConcurrentReplayTest.php \
          tests/Unit/V2/HostServiceQuerySqliteWriteRetryTest.php --testdox --fail-on-warning

        php -d zend.enable_gc=0 vendor/bin/phpunit \
          tests/Unit/SqliteWalFixtureCleanupTest.php \
          tests/Unit/V2/HostServiceQueryConcurrentReplayTest.php \
          tests/Unit/V2/HostServiceQuerySqliteWriteRetryTest.php \
          tests/Unit/V2/HostServiceQueryDispatchTest.php \
          tests/Unit/V2/HostServiceQueryLifecycleTest.php \
          tests/Unit/V2/LocalActivityRetryDispatchTest.php \
          tests/Unit/V2/MemoTest.php --testdox --fail-on-warning

    - name: Run retained execution authority and process-loss controls
      run: >-
        vendor/bin/phpunit tests/Unit/V2/EmbeddedContinuationTest.php
        tests/Unit/V2/WorkflowContinuationCacheTest.php
        tests/Unit/V2/EmbeddedContinuationProcessTest.php
        --testdox --fail-on-warning
        --log-junit build/test-results/pr-retained-execution.xml

    - name: Run growing continuation worker setup controls
      env:
        PROFILE_EMBEDDED_CONTINUATION: setup
      run: >-
        vendor/bin/phpunit tests/Performance/EmbeddedContinuationGrowthProfileTest.php
        --testdox --fail-on-warning --display-phpunit-deprecations
        --log-junit build/test-results/pr-continuation-growth.xml

    - name: Run minimally observed continuation setup controls
      env:
        PROFILE_EMBEDDED_CONTINUATION: setup
        DWF_GROWTH_OBSERVERS: 'off'
      run: >-
        vendor/bin/phpunit tests/Performance/EmbeddedContinuationGrowthProfileTest.php
        --filter '10-events_(1-workers_1-runs|4-workers_8-runs)_(replay|retained)_repeat-1'
        --testdox --fail-on-warning --fail-on-empty-test-suite
        --log-junit build/test-results/pr-continuation-minimal-observers.xml

    - name: Resolve bounded pull-request test selection
      run: >-
        php scripts/ci/select-pr-tests.php
        --config=.github/pr-test-selection.json
        --weights=.github/feature-test-timings.json
        --weight-profile=mysql
        --output-dir=build/pr-selection

    - name: Run database-independent unit contracts
      run: |
        mkdir -p build/test-results
        xargs -a build/pr-selection/unit-files.txt \
          vendor/bin/phpunit --testdox \
          --log-junit build/test-results/pr-unit-contracts.xml

    - name: Run workflow command normalizer unit cases
      run: >-
        vendor/bin/phpunit tests/Unit/V2/WorkflowCommandNormalizerTest.php
        --fail-on-warning --log-junit build/test-results/pr-workflow-command-normalizer.xml
      env:
        REDIS_HOST: 127.0.0.1

    - name: Run embedded local retry queue and rollback controls
      run: >-
        vendor/bin/phpunit tests/Unit/V2/LocalActivityRetryDispatchTest.php
        --fail-on-warning --log-junit build/test-results/pr-local-activity-retry.xml

    - name: Run cancellation timeline unit cases
      run: >-
        vendor/bin/phpunit tests/Unit/V2/CancellationHistoryTimelineTest.php
        --fail-on-warning --log-junit build/test-results/pr-cancellation-timeline.xml

  # Runs the same unit suite as coverage-unit, without coverage, so a pull
  # request cannot merge a unit test that only fails after merge.
  pr-unit:
    needs: preflight
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    timeout-minutes: 25
    env:
      XDEBUG_MODE: 'off'

    services:
      redis:
        image: redis
        ports:
        - 6379

    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      with:
          fetch-depth: 10
          persist-credentials: false

    - name: Cache Composer packages
      if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25  # v5
      with:
        path: vendor
        key: ${{ github.event_name }}-${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
        restore-keys: |
          ${{ github.event_name }}-${{ runner.os }}-php-

    - name: Install dependencies
      run: composer install --prefer-dist --no-progress

    - name: Create SQLite database and export the coverage-unit test defaults
      env:
        REDIS_PUBLISHED_PORT: ${{ job.services.redis.ports['6379'] }}
      run: |
        if [ -d /dev/shm ] && [ -w /dev/shm ]; then
          temporary_root=/dev/shm
        else
          temporary_root="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
        fi
        unit_db="${temporary_root}/workflow-pr-unit-${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-1}.sqlite"
        touch "$unit_db"
        {
          echo "UNIT_DB_PATH=$unit_db"
          echo "TMPDIR=$temporary_root"
          echo "REDIS_HOST=127.0.0.1"
          echo "REDIS_PORT=$REDIS_PUBLISHED_PORT"
          echo "APP_KEY=base64:i3g6f+dV8FfsIkcxqd7gbiPn2oXk5r00sTmdD6V5utI="
          echo "REDIS_PASSWORD="
          echo "QUEUE_FAILED_DRIVER=null"
        } >> "$GITHUB_ENV"

    - name: Run the unit suite
      run: >-
        vendor/bin/phpunit --testsuite unit
        --log-junit build/test-results/pr-unit.xml
      env:
        DB_CONNECTION: sqlite
        DB_DATABASE: ${{ env.UNIT_DB_PATH }}
        QUEUE_CONNECTION: sync

    - name: Remove SQLite database
      if: ${{ always() }}
      run: rm -f "$UNIT_DB_PATH" "$UNIT_DB_PATH-journal" "$UNIT_DB_PATH-wal" "$UNIT_DB_PATH-shm"

  pr-tracing:
    needs: preflight
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    timeout-minutes: 13
    env:
      XDEBUG_MODE: 'off'

    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      with:
          fetch-depth: 10
          persist-credentials: false

    - name: Cache Composer packages
      if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25  # v5
      with:
        path: vendor
        key: ${{ github.event_name }}-${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
        restore-keys: |
          ${{ github.event_name }}-${{ runner.os }}-php-

    - name: Install dependencies
      run: composer install --prefer-dist --no-progress

    - name: Prepare tracing report directory
      run: mkdir -p build/test-results

    - name: Run optional embedded tracing controls
      run: >-
        vendor/bin/phpunit tests/Unit/V2/ActivityExecutionTracingTest.php
        tests/Unit/V2/IncomingHttpTracingTest.php
        tests/Unit/V2/RecoveryExecutionTracingTest.php
        tests/Unit/V2/TransitionExecutionTracingTest.php
        tests/Unit/V2/FailureOutcomeExecutionTracingTest.php
        tests/Unit/V2/FanOutExecutionTracingTest.php
        tests/Unit/V2/LargeFanOutExecutionTracingTest.php
        tests/Unit/V2/TaskOutcomeCarrierTest.php
        tests/Unit/V2/ChildRetryExecutionTracingTest.php
        tests/Unit/V2/CancellationExecutionTracingTest.php
        tests/Unit/V2/SignalStartExecutionTracingTest.php
        tests/Unit/V2/SignalLinkExecutionTracingTest.php
        tests/Unit/V2/UpdateLinkExecutionTracingTest.php
        tests/Unit/V2/TimingExecutionTracingTest.php
        tests/Unit/V2/AdmissionExecutionTracingTest.php
        tests/Unit/V2/DispatchExecutionTracingTest.php
        tests/Unit/V2/ScheduleExecutionTracingTest.php
        --fail-on-warning --log-junit build/test-results/pr-activity-tracing.xml

    - name: Upload tracing test report
      if: always()
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
      with:
        name: pr-embedded-tracing
        path: build/test-results/pr-activity-tracing.xml
        if-no-files-found: error
        retention-days: 5

  pr-feature-mysql:
    needs: preflight
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    timeout-minutes: 13

    services:
      mysql:
        image: mysql
        env:
          MYSQL_ROOT_PASSWORD: password
        options: >-
          --tmpfs /var/lib/mysql:rw,noexec,nosuid,size=1024m
        ports:
        - 3306

      redis:
        image: redis
        ports:
        - 6379

    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      with:
          fetch-depth: 20
          persist-credentials: false

    - name: Resolve changed files
      env:
        BASE_SHA: ${{ github.event.pull_request.base.sha }}
        HEAD_SHA: ${{ github.event.pull_request.head.sha }}
      run: |
        mkdir -p build/pr-selection
        if [ -n "$BASE_SHA" ] && [ -n "$HEAD_SHA" ] \
          && git cat-file -e "${BASE_SHA}^{commit}" \
          && git cat-file -e "${HEAD_SHA}^{commit}"; then
          git diff --name-only --diff-filter=ACMRT "$BASE_SHA" "$HEAD_SHA" \
            > build/pr-selection/changed-files.txt
        else
          : > build/pr-selection/changed-files.txt
          echo "Changed-file targeting unavailable; using the high-signal fallback."
        fi

    - name: Resolve bounded pull-request test selection
      run: >-
        php scripts/ci/select-pr-tests.php
        --config=.github/pr-test-selection.json
        --weights=.github/feature-test-timings.json
        --weight-profile=mysql
        --changed-files=build/pr-selection/changed-files.txt
        --output-dir=build/pr-selection

    - name: Cache Composer packages
      if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25  # v5
      with:
        path: vendor
        key: ${{ github.event_name }}-${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
        restore-keys: |
          ${{ github.event_name }}-${{ runner.os }}-php-

    - name: Install dependencies
      run: composer install --prefer-dist --no-progress

    - name: Resolve service endpoints and export test defaults
      env:
        MYSQL_PUBLISHED_PORT: ${{ job.services.mysql.ports['3306'] }}
        REDIS_PUBLISHED_PORT: ${{ job.services.redis.ports['6379'] }}
      run: |
        resolve_service() {
          service="$1"
          container_port="$2"
          published_port="$3"
          prefix="$4"

          if getent hosts "$service" > /dev/null 2>&1; then
            echo "${prefix}_HOST=${service}"
            echo "${prefix}_PORT=${container_port}"
          elif [ -n "$published_port" ]; then
            echo "${prefix}_HOST=127.0.0.1"
            echo "${prefix}_PORT=${published_port}"
          else
            echo "::error::Unable to resolve ${service} or determine its published port" >&2
            exit 1
          fi
        }

        {
          resolve_service mysql 3306 "$MYSQL_PUBLISHED_PORT" DB
          resolve_service redis 6379 "$REDIS_PUBLISHED_PORT" REDIS
          echo "APP_KEY=base64:i3g6f+dV8FfsIkcxqd7gbiPn2oXk5r00sTmdD6V5utI="
          echo "DB_DATABASE=testbench"
          echo "DB_USERNAME=root"
          echo "DB_PASSWORD=password"
          echo "QUEUE_FAILED_DRIVER=null"
          echo "REDIS_PASSWORD="
          echo "CACHE_DRIVER=redis"
          echo "CACHE_STORE=redis"
        } >> "$GITHUB_ENV"

    - name: Create MySQL database
      run: >-
        mysql
        -e 'SET GLOBAL innodb_flush_log_at_trx_commit=2; SET GLOBAL sync_binlog=0; CREATE DATABASE testbench'
        -h"$DB_HOST" -uroot -ppassword -P "$DB_PORT"

    - name: Run bounded MySQL smoke selection
      id: pr_mysql_suite
      run: |
        mkdir -p build/test-results
        cat build/pr-selection/summary.txt
        set +e
        # shellcheck disable=SC2016
        timeout --foreground 8m bash -euo pipefail -c '
          filter=$(cat build/pr-selection/mysql-fallback-filter.txt)
          xargs -a build/pr-selection/mysql-fallback-files.txt \
            vendor/bin/phpunit --testdox --testsuite feature \
            --filter "$filter" \
            --log-junit build/test-results/pr-smoke-fallback.xml

          if [ -s build/pr-selection/mysql-changed-files.txt ]; then
            xargs -a build/pr-selection/mysql-changed-files.txt \
              vendor/bin/phpunit --testdox --testsuite feature \
              --log-junit build/test-results/pr-smoke-changed.xml
          fi
        '
        status=$?
        set -e

        for report in build/test-results/pr-smoke-*.xml; do
          [ -f "$report" ] || continue
          name=$(basename "$report" .xml)
          php scripts/ci/summarize-junit-times.php \
            --input="$report" \
            --output="build/test-results/${name}-timing.md" \
            --csv="build/test-results/${name}-timing.csv"
          cat "build/test-results/${name}-timing.md"

          if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
            cat "build/test-results/${name}-timing.md" >> "$GITHUB_STEP_SUMMARY"
          fi
        done

        exit "$status"
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Run delayed task and real SQS adapter controls
      run: >-
        vendor/bin/phpunit tests/Unit/V2/DelayedTaskTransportTest.php
        tests/Unit/V2/SqsDelayAdapterTest.php
        --testsuite unit
        --fail-on-warning --log-junit build/test-results/pr-sqs-delay-adapter.xml
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Run scoped Activity fencing and original stop receipt cases
      run: >-
        vendor/bin/phpunit tests/Feature/V2/V2ScopedActivityCancellationTest.php
        --testsuite feature
        --fail-on-warning --log-junit build/test-results/pr-smoke-scoped-activities.xml
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Run scoped timer fencing and late fire cases
      run: >-
        vendor/bin/phpunit tests/Feature/V2/V2ScopedTimerCancellationTest.php
        --testsuite feature
        --fail-on-warning --log-junit build/test-results/pr-smoke-scoped-timers.xml
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Run canonical operation scope delivery boundary cases
      run: >-
        vendor/bin/phpunit tests/Feature/V2/V2CancellationScopeDeliveryTest.php
        --testsuite feature
        --fail-on-warning --log-junit build/test-results/pr-smoke-scope-delivery.xml
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Run canonical operation scope request authority cases
      run: >-
        vendor/bin/phpunit tests/Feature/V2/V2CancellationScopeRequestsTest.php
        --testsuite feature
        --fail-on-warning --log-junit build/test-results/pr-smoke-scope-requests.xml
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Run canonical operation scope admission cases
      run: >-
        vendor/bin/phpunit tests/Feature/V2/V2CancellationScopeHistoryTest.php
        --testsuite feature
        --fail-on-warning --log-junit build/test-results/pr-smoke-scope-admission.xml
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Run activity cancellation policy and portable admission cases
      run: >-
        vendor/bin/phpunit tests/Feature/V2/V2PortableCancellationDeliveryTest.php
        --testsuite feature
        --filter '/testInternal.*(ActivityWait|ActivityAbandon)|testPortableRemoteActivityPolicy/'
        --fail-on-warning --log-junit build/test-results/pr-smoke-activity-cancellation-wait.xml
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Run local callback original-claim receipt cases
      run: >-
        vendor/bin/phpunit tests/Feature/V2/V2PortableCancellationDeliveryTest.php
        --testsuite feature
        --filter '/(testLocalStopReceipt|testLocalOriginalOwner|testLateLocalReceipt)/'
        --fail-on-warning --log-junit build/test-results/pr-smoke-local-claim.xml
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Run portable local preparation cases
      run: >-
        vendor/bin/phpunit tests/Feature/V2/V2PortableLocalActivityPreparationTest.php
        --testsuite feature
        --fail-on-warning --log-junit build/test-results/pr-smoke-local-preparation.xml
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Run portable local retained-claim checkpoint cases
      run: >-
        vendor/bin/phpunit tests/Feature/V2/V2PortableLocalActivityCheckpointTest.php
        --testsuite feature
        --fail-on-warning --log-junit build/test-results/pr-smoke-local-checkpoint.xml
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Run portable local prepared outcome cases
      run: >-
        vendor/bin/phpunit tests/Feature/V2/V2PortableLocalActivityOutcomeTest.php
        --testsuite feature
        --fail-on-warning --log-junit build/test-results/pr-smoke-local-outcomes.xml
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Run portable local cold recovery cases
      run: >-
        vendor/bin/phpunit tests/Feature/V2/V2PortableLocalActivityRecoveryTest.php
        --testsuite feature
        --fail-on-warning --log-junit build/test-results/pr-smoke-local-recovery.xml
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Run portable local supervisor control cases
      run: >-
        vendor/bin/phpunit tests/Feature/V2/V2PortableLocalActivityControlTest.php
        --testsuite feature
        --fail-on-warning --log-junit build/test-results/pr-smoke-local-control.xml
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Run portable local cleanup and application heartbeat cases
      run: >-
        vendor/bin/phpunit tests/Feature/V2/V2PortableLocalActivityCleanupTest.php
        --testsuite feature
        --fail-on-warning --log-junit build/test-results/pr-smoke-local-cleanup.xml
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Run service scheduling and completion contracts
      run: >-
        vendor/bin/phpunit tests/Unit/V2/DefaultServiceControlPlaneWorkflowBindingTest.php
        tests/Unit/V2/ServiceCallEffectIdentityTest.php
        tests/Unit/V2/WebhookInputValidationTest.php
        tests/Unit/V2/WorkflowExecutorServiceOperationTest.php
        tests/Unit/V2/DefaultWorkflowTaskBridgeServiceOperationTest.php
        tests/Unit/V2/ServiceCallSchedulerTest.php
        --fail-on-warning --log-junit build/test-results/pr-smoke-service-scheduling.xml
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Upload pull-request MySQL smoke timing report
      if: ${{ always() && github.server_url == 'https://github.com' }}
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
      with:
        name: pr-feature-timing-mysql
        path: |
          build/pr-selection/*
          build/test-results/pr-smoke-*

    - name: Upload laravel.log if pull-request MySQL smoke fails
      if: ${{ github.server_url == 'https://github.com' && (failure() || steps.pr_mysql_suite.outcome == 'failure') }}
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
      with:
        name: laravel-log-pr-mysql
        path: vendor/orchestra/testbench-core/laravel/storage/logs/laravel.log

  feature-mysql:
    needs: preflight
    if: ${{ github.event_name != 'pull_request' }}
    runs-on: ubuntu-latest
    timeout-minutes: 21

    strategy:
      fail-fast: false
      matrix:
        shard: [0, 1, 2, 3, 4, 5]

    services:
      mysql:
        image: mysql
        env:
          MYSQL_ROOT_PASSWORD: password
        # Keep disposable test data on tmpfs so schema setup and committed-row
        # truncation are not gated by the container overlay's fsync latency.
        options: >-
          --tmpfs /var/lib/mysql:rw,noexec,nosuid,size=1024m
        ports:
        - 3306

      redis:
        image: redis
        ports:
        - 6379

    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      with:
          fetch-depth: 10
          persist-credentials: false

    - name: Disable APT download retries (CVE-2026-109518)
      run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null
    - name: Set up PHP coverage driver
      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240  # v2
      with:
        php-version: '8.3'
        coverage: pcov

    - name: Cache Composer packages
      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25  # v5
      with:
        path: vendor
        key: ${{ github.event_name }}-${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
        restore-keys: |
          ${{ github.event_name }}-${{ runner.os }}-php-

    - name: Install dependencies
      run: composer install --prefer-dist --no-progress

    - name: Resolve service endpoints and export test defaults
      env:
        MYSQL_PUBLISHED_PORT: ${{ job.services.mysql.ports['3306'] }}
        REDIS_PUBLISHED_PORT: ${{ job.services.redis.ports['6379'] }}
      run: |
        resolve_service() {
          service="$1"
          container_port="$2"
          published_port="$3"
          prefix="$4"

          if getent hosts "$service" > /dev/null 2>&1; then
            echo "${prefix}_HOST=${service}"
            echo "${prefix}_PORT=${container_port}"
          elif [ -n "$published_port" ]; then
            echo "${prefix}_HOST=127.0.0.1"
            echo "${prefix}_PORT=${published_port}"
          else
            echo "::error::Unable to resolve ${service} or determine its published port" >&2
            exit 1
          fi
        }

        {
          resolve_service mysql 3306 "$MYSQL_PUBLISHED_PORT" DB
          resolve_service redis 6379 "$REDIS_PUBLISHED_PORT" REDIS
          echo "APP_KEY=base64:i3g6f+dV8FfsIkcxqd7gbiPn2oXk5r00sTmdD6V5utI="
          echo "DB_DATABASE=testbench"
          echo "DB_USERNAME=root"
          echo "DB_PASSWORD=password"
          echo "QUEUE_FAILED_DRIVER=null"
          echo "REDIS_PASSWORD="
          # Testbench defaults cache to array (per-process, in-memory). The V2
          # TaskWatchdog throttle set by Tests\TestCase::setUp needs to be
          # visible to the two queue:work worker processes so their wake()
          # poll short-circuits — array cache means the workers never see the
          # test's throttle and runPass races the test's DB state (originally
          # diagnosed as the #427 PG "hang" and the MySQL Mode-B flakes).
          # The local docker stack uses tests/.env.feature which already sets
          # CACHE_DRIVER=redis for the same reason; mirror it here.
          echo "CACHE_DRIVER=redis"
          echo "CACHE_STORE=redis"
        } >> "$GITHUB_ENV"

    - name: Create MySQL database
      run: >-
        mysql
        -e 'SET GLOBAL innodb_flush_log_at_trx_commit=2; SET GLOBAL sync_binlog=0; SET GLOBAL max_connections=500; CREATE DATABASE testbench'
        -h"$DB_HOST" -uroot -ppassword -P "$DB_PORT"

    - name: Run feature test suite (MySQL shard ${{ matrix.shard }})
      id: mysql_suite
      timeout-minutes: 15
      run: |
        mkdir -p build/test-results
        php scripts/ci/split-feature-tests.php \
          --dir=tests/Feature \
          --shard=${{ matrix.shard }} \
          --shards=6 \
          --weights=.github/feature-test-timings.json \
          --weight-profile=mysql \
          --summary="build/test-results/mysql-shard-${{ matrix.shard }}-summary.txt" \
          > /tmp/mysql-shard-files
        cat /tmp/mysql-shard-files
        cp /tmp/mysql-shard-files "build/test-results/mysql-shard-${{ matrix.shard }}-files.txt"
        # Unit coverage includes every source file. Shards contribute collected
        # PCOV data only: static maps for unloaded files can disagree with PCOV.
        started_at=$(date +%s)
        set +e
        timeout --foreground 15m xargs -a /tmp/mysql-shard-files \
          vendor/bin/phpunit --configuration phpunit.feature-coverage.xml --testdox --testsuite feature \
          --coverage-clover "build/test-results/mysql-shard-${{ matrix.shard }}-coverage.xml" \
          --log-junit "build/test-results/mysql-shard-${{ matrix.shard }}.xml"
        status=$?
        elapsed=$(( $(date +%s) - started_at ))
        set -e
        printf 'mysql shard=%s exit=%s elapsed_seconds=%s\n' '${{ matrix.shard }}' "$status" "$elapsed" \
          | tee "build/test-results/mysql-shard-${{ matrix.shard }}-elapsed.txt"
        if [ -f "build/test-results/mysql-shard-${{ matrix.shard }}.xml" ]; then
          php scripts/ci/summarize-junit-times.php \
            --input="build/test-results/mysql-shard-${{ matrix.shard }}.xml" \
            --output="build/test-results/mysql-shard-${{ matrix.shard }}-timing.md" \
            --csv="build/test-results/mysql-shard-${{ matrix.shard }}-timing.csv"
        fi
        exit "$status"
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Emit MySQL shard diagnostics
      if: ${{ always() }}
      env:
        SUITE_OUTCOME: ${{ steps.mysql_suite.outcome }}
      run: |
        cat "build/test-results/mysql-shard-${{ matrix.shard }}-elapsed.txt" 2>/dev/null || true
        cat "build/test-results/mysql-shard-${{ matrix.shard }}-timing.md" 2>/dev/null || true
        if [ "$SUITE_OUTCOME" != "success" ]; then
          echo "MySQL shard ${{ matrix.shard }} failed; assigned files:"
          cat "build/test-results/mysql-shard-${{ matrix.shard }}-files.txt" 2>/dev/null || true
          tail -n 300 vendor/orchestra/testbench-core/laravel/storage/logs/laravel.log 2>/dev/null || true
        fi

    - name: Upload MySQL feature timing report
      if: ${{ always() && github.server_url == 'https://github.com' }}
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
      with:
        name: feature-timing-mysql-${{ matrix.shard }}
        path: build/test-results/mysql-shard-${{ matrix.shard }}*

    - name: Verify bounded dashboard reads on MySQL
      if: ${{ matrix.shard == 0 }}
      run: vendor/bin/phpunit tests/Unit/V2/OperatorDashboardReadBoundsTest.php --fail-on-warning
      env:
        DB_CONNECTION: mysql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Upload laravel.log if MySQL tests fail
      if: ${{ github.server_url == 'https://github.com' && (failure() || steps.mysql_suite.outcome == 'failure') }}
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
      with:
        name: laravel-log-mysql-${{ matrix.shard }}
        path: vendor/orchestra/testbench-core/laravel/storage/logs/laravel.log

  # Runs on pull requests too, so a feature test cannot pass the PR and fail
  # only after merge (#1095). MySQL keeps the coverage-collecting shards.
  feature-postgresql:
    needs: preflight
    runs-on: ubuntu-latest
    timeout-minutes: 20

    strategy:
      fail-fast: false
      matrix:
        shard: [0, 1, 2, 3, 4, 5]

    services:
      postgres:
        image: postgres
        env:
          POSTGRES_USER: root
          POSTGRES_PASSWORD: password
          POSTGRES_DB: testbench
          POSTGRES_INITDB_ARGS: --no-sync
        ports:
        - 5432

      redis:
        image: redis
        ports:
        - 6379

    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      with:
          fetch-depth: 10
          persist-credentials: false

    - name: Cache Composer packages
      if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25  # v5
      with:
        path: vendor
        key: ${{ github.event_name }}-${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
        restore-keys: |
          ${{ github.event_name }}-${{ runner.os }}-php-

    - name: Install dependencies
      run: composer install --prefer-dist --no-progress

    - name: Resolve service endpoints and export test defaults
      env:
        POSTGRES_PUBLISHED_PORT: ${{ job.services.postgres.ports['5432'] }}
        REDIS_PUBLISHED_PORT: ${{ job.services.redis.ports['6379'] }}
      run: |
        resolve_service() {
          service="$1"
          container_port="$2"
          published_port="$3"
          prefix="$4"

          if getent hosts "$service" > /dev/null 2>&1; then
            echo "${prefix}_HOST=${service}"
            echo "${prefix}_PORT=${container_port}"
          elif [ -n "$published_port" ]; then
            echo "${prefix}_HOST=127.0.0.1"
            echo "${prefix}_PORT=${published_port}"
          else
            echo "::error::Unable to resolve ${service} or determine its published port" >&2
            exit 1
          fi
        }

        {
          resolve_service postgres 5432 "$POSTGRES_PUBLISHED_PORT" DB
          resolve_service redis 6379 "$REDIS_PUBLISHED_PORT" REDIS
          echo "APP_KEY=base64:i3g6f+dV8FfsIkcxqd7gbiPn2oXk5r00sTmdD6V5utI="
          echo "DB_DATABASE=testbench"
          echo "DB_USERNAME=root"
          echo "DB_PASSWORD=password"
          echo "QUEUE_FAILED_DRIVER=null"
          echo "REDIS_PASSWORD="
          # Testbench defaults cache to array (per-process, in-memory). The V2
          # TaskWatchdog throttle set by Tests\TestCase::setUp needs to be
          # visible to the two queue:work worker processes so their wake()
          # poll short-circuits — array cache means the workers never see the
          # test's throttle and runPass races the test's DB state (originally
          # diagnosed as the #427 PG "hang" and the MySQL Mode-B flakes).
          # The local docker stack uses tests/.env.feature which already sets
          # CACHE_DRIVER=redis for the same reason; mirror it here.
          echo "CACHE_DRIVER=redis"
          echo "CACHE_STORE=redis"
        } >> "$GITHUB_ENV"

    - name: Run feature test suite (PostgreSQL shard ${{ matrix.shard }})
      id: pgsql_suite
      timeout-minutes: 17
      run: |
        mkdir -p build/test-results
        php scripts/ci/split-feature-tests.php \
          --dir=tests/Feature \
          --shard=${{ matrix.shard }} \
          --shards=6 \
          --weights=.github/feature-test-timings.json \
          --weight-profile=postgresql \
          --summary="build/test-results/pgsql-shard-${{ matrix.shard }}-summary.txt" \
          > /tmp/pgsql-shard-files
        cat /tmp/pgsql-shard-files
        cp /tmp/pgsql-shard-files "build/test-results/pgsql-shard-${{ matrix.shard }}-files.txt"
        started_at=$(date +%s)
        set +e
        timeout --foreground 15m xargs -a /tmp/pgsql-shard-files \
          vendor/bin/phpunit --testdox --testsuite feature \
          --log-junit "build/test-results/pgsql-shard-${{ matrix.shard }}.xml"
        status=$?
        elapsed=$(( $(date +%s) - started_at ))
        set -e
        printf 'postgresql shard=%s exit=%s elapsed_seconds=%s\n' '${{ matrix.shard }}' "$status" "$elapsed" \
          | tee "build/test-results/pgsql-shard-${{ matrix.shard }}-elapsed.txt"
        if [ -f "build/test-results/pgsql-shard-${{ matrix.shard }}.xml" ]; then
          php scripts/ci/summarize-junit-times.php \
            --input="build/test-results/pgsql-shard-${{ matrix.shard }}.xml" \
            --output="build/test-results/pgsql-shard-${{ matrix.shard }}-timing.md" \
            --csv="build/test-results/pgsql-shard-${{ matrix.shard }}-timing.csv"
        fi
        exit "$status"
      env:
        DB_CONNECTION: pgsql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off
        # Safety net kept after #427: libpq honors PGOPTIONS on every
        # connection, so any runaway query or lock wait fails loudly inside
        # the bounded shard budget. The numbers are well above legitimate
        # individual query cost but well below the step budget, so a future
        # regression surfaces with the offending SQL in laravel.log rather
        # than a silent hang.
        PGOPTIONS: "-c synchronous_commit=off -c statement_timeout=120000 -c lock_timeout=30000 -c idle_in_transaction_session_timeout=60000"

    - name: Verify bounded dashboard reads on PostgreSQL
      if: ${{ matrix.shard == 0 }}
      run: vendor/bin/phpunit tests/Unit/V2/OperatorDashboardReadBoundsTest.php --fail-on-warning
      env:
        DB_CONNECTION: pgsql
        QUEUE_CONNECTION: redis
        XDEBUG_MODE: off

    - name: Emit PostgreSQL shard diagnostics
      if: ${{ always() }}
      env:
        SUITE_OUTCOME: ${{ steps.pgsql_suite.outcome }}
      run: |
        cat "build/test-results/pgsql-shard-${{ matrix.shard }}-elapsed.txt" 2>/dev/null || true
        cat "build/test-results/pgsql-shard-${{ matrix.shard }}-timing.md" 2>/dev/null || true
        if [ "$SUITE_OUTCOME" != "success" ]; then
          echo "PostgreSQL shard ${{ matrix.shard }} failed; assigned files:"
          cat "build/test-results/pgsql-shard-${{ matrix.shard }}-files.txt" 2>/dev/null || true
          tail -n 300 vendor/orchestra/testbench-core/laravel/storage/logs/laravel.log 2>/dev/null || true
        fi

    - name: Upload PostgreSQL feature timing report
      if: ${{ always() && github.server_url == 'https://github.com' }}
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
      with:
        name: feature-timing-postgresql-${{ matrix.shard }}
        path: build/test-results/pgsql-shard-${{ matrix.shard }}*

    - name: Upload laravel.log if PostgreSQL tests fail
      if: ${{ github.server_url == 'https://github.com' && (failure() || steps.pgsql_suite.outcome == 'failure') }}
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
      with:
        name: laravel-log-postgresql-${{ matrix.shard }}
        path: vendor/orchestra/testbench-core/laravel/storage/logs/laravel.log

  feature-mariadb:
    needs: preflight
    if: ${{ github.event_name != 'pull_request' }}
    runs-on: ubuntu-latest

    services:
      mariadb:
        image: mariadb:10.5
        env:
          MARIADB_ROOT_PASSWORD: password
          MARIADB_DATABASE: testbench
        options: >-
          --health-cmd "mariadb-admin ping -ppassword"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 10
        ports:
        - 3306

      redis:
        image: redis
        ports:
        - 6379

    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      with:
          fetch-depth: 10
          persist-credentials: false

    - name: Cache Composer packages
      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25  # v5
      with:
        path: vendor
        key: ${{ github.event_name }}-${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
        restore-keys: |
          ${{ github.event_name }}-${{ runner.os }}-php-

    - name: Install dependencies
      run: composer install --prefer-dist --no-progress

    - name: Resolve service endpoints and export test defaults
      env:
        MARIADB_PUBLISHED_PORT: ${{ job.services.mariadb.ports['3306'] }}
        REDIS_PUBLISHED_PORT: ${{ job.services.redis.ports['6379'] }}
      run: |
        resolve_service() {
          service="$1"
          container_port="$2"
          published_port="$3"
          prefix="$4"

          if getent hosts "$service" > /dev/null 2>&1; then
            echo "${prefix}_HOST=${service}"
            echo "${prefix}_PORT=${container_port}"
          elif [ -n "$published_port" ]; then
            echo "${prefix}_HOST=127.0.0.1"
            echo "${prefix}_PORT=${published_port}"
          else
            echo "::error::Unable to resolve ${service} or determine its published port" >&2
            exit 1
          fi
        }

        {
          resolve_service mariadb 3306 "$MARIADB_PUBLISHED_PORT" DB
          resolve_service redis 6379 "$REDIS_PUBLISHED_PORT" REDIS
        } >> "$GITHUB_ENV"

    - name: Run locking, readiness and replay regressions on MariaDB 10.5
      run: |
        vendor/bin/phpunit --testdox --testsuite feature \
          --filter '/(testHistoryPayloadPaginatedUsesConfiguredSummaryCountersWithoutHydratingHistory|testHistoryPayloadPaginatedUsesBoundedAggregatesWhenSummaryIsMissingOrStale|testEmbeddedHeartbeatAndTimeoutEnforcementUseOneConcurrentLockOrder)/' \
          tests/Feature/V2/V2WorkflowTaskBridgeTest.php \
          tests/Feature/V2/V2ActivityTimeoutTest.php
        DB_CONNECTION=mariadb vendor/bin/phpunit --testdox --testsuite feature \
          --filter '/(testSnapshotSummarizesDurableBacklogRepairCompatibilityAndWorkerFleet|testPublicReplayerCanReplayLiveRun|testPublicReplayerCanReplayHistoryExportBundle|testHistoryPayloadPaginatedUsesConfiguredSummaryCountersWithoutHydratingHistory|testHistoryPayloadPaginatedUsesBoundedAggregatesWhenSummaryIsMissingOrStale|testEmbeddedHeartbeatAndTimeoutEnforcementUseOneConcurrentLockOrder)/' \
          tests/Feature/V2/V2OperatorMetricsTest.php \
          tests/Feature/V2/V2WorkflowReplayerTest.php \
          tests/Feature/V2/V2WorkflowTaskBridgeTest.php \
          tests/Feature/V2/V2ActivityTimeoutTest.php
      env:
        APP_KEY: base64:i3g6f+dV8FfsIkcxqd7gbiPn2oXk5r00sTmdD6V5utI=
        DB_CONNECTION: mysql
        DB_DATABASE: testbench
        DB_USERNAME: root
        DB_PASSWORD: password
        CACHE_DRIVER: redis
        CACHE_STORE: redis
        QUEUE_CONNECTION: redis
        QUEUE_FAILED_DRIVER: 'null'
        REDIS_PASSWORD: ''
        XDEBUG_MODE: off

    - name: Verify bounded dashboard reads on MariaDB
      run: |
        vendor/bin/phpunit tests/Unit/V2/OperatorDashboardReadBoundsTest.php --fail-on-warning
        DB_CONNECTION=mariadb vendor/bin/phpunit tests/Unit/V2/OperatorDashboardReadBoundsTest.php --fail-on-warning
      env:
        APP_KEY: base64:i3g6f+dV8FfsIkcxqd7gbiPn2oXk5r00sTmdD6V5utI=
        DB_CONNECTION: mysql
        DB_DATABASE: testbench
        DB_USERNAME: root
        DB_PASSWORD: password
        CACHE_DRIVER: redis
        CACHE_STORE: redis
        QUEUE_CONNECTION: redis
        QUEUE_FAILED_DRIVER: 'null'
        REDIS_PASSWORD: ''
        XDEBUG_MODE: off

    - name: Upload Laravel log if MariaDB tests fail
      if: ${{ github.server_url == 'https://github.com' && failure() }}
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
      with:
        name: laravel-log-mariadb
        path: vendor/orchestra/testbench-core/laravel/storage/logs/laravel.log

  coverage-unit:
    needs: preflight
    if: ${{ github.event_name != 'pull_request' }}
    runs-on: ubuntu-latest
    outputs:
      unit_artifact_id: ${{ steps.unit_coverage.outputs.artifact-id }}

    env:
      COVERAGE_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}

    services:
      redis:
        image: redis
        ports:
        - 6379

    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
      with:
          fetch-depth: 10
          persist-credentials: false
          ref: ${{ env.COVERAGE_COMMIT }}

    - name: Disable APT download retries (CVE-2026-109518)
      run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null
    - name: Set up PHP coverage driver
      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240  # v2
      with:
        php-version: '8.3'
        coverage: pcov

    - name: Cache Composer packages
      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25  # v5
      with:
        path: vendor
        key: ${{ github.event_name }}-${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
        restore-keys: |
          ${{ github.event_name }}-${{ runner.os }}-php-

    - name: Install dependencies
      run: composer install --prefer-dist --no-progress

    - name: Create SQLite database on fast temporary storage
      run: |
        if [ -d /dev/shm ] && [ -w /dev/shm ]; then
          temporary_root=/dev/shm
        else
          temporary_root="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
        fi
        run_token="${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-1}"
        coverage_db="${temporary_root}/workflow-coverage-${run_token}.sqlite"
        touch "$coverage_db"
        echo "COVERAGE_DB_PATH=$coverage_db" >> "$GITHUB_ENV"
        echo "TMPDIR=$temporary_root" >> "$GITHUB_ENV"

    - name: Resolve service endpoint and export coverage test defaults
      env:
        REDIS_PUBLISHED_PORT: ${{ job.services.redis.ports['6379'] }}
      run: |
        resolve_service() {
          service="$1"
          container_port="$2"
          published_port="$3"
          prefix="$4"

          if getent hosts "$service" > /dev/null 2>&1; then
            echo "${prefix}_HOST=${service}"
            echo "${prefix}_PORT=${container_port}"
          elif [ -n "$published_port" ]; then
            echo "${prefix}_HOST=127.0.0.1"
            echo "${prefix}_PORT=${published_port}"
          else
            echo "::error::Unable to resolve ${service} or determine its published port" >&2
            exit 1
          fi
        }

        {
          resolve_service redis 6379 "$REDIS_PUBLISHED_PORT" REDIS
          echo "APP_KEY=base64:i3g6f+dV8FfsIkcxqd7gbiPn2oXk5r00sTmdD6V5utI="
          echo "REDIS_PASSWORD="
          echo "QUEUE_FAILED_DRIVER=null"
        } >> "$GITHUB_ENV"

    - name: Code Coverage
      run: >-
        php scripts/ci/run-with-resource-metrics.php
        --output=build/test-results/coverage-resource-metrics.md
        -- php vendor/bin/phpunit --testdox
        --coverage-clover=coverage.xml --testsuite unit
      env:
        DB_CONNECTION: sqlite
        DB_DATABASE: ${{ env.COVERAGE_DB_PATH }}
        QUEUE_CONNECTION: sync
        XDEBUG_MODE: off

    - name: Require the complete unit source inventory
      run: >-
        php scripts/ci/check-v2-coverage.php
        --contract=resources/v2-unit-coverage-contract.json
        --output=build/coverage/unit-coverage-summary.json

    - name: Retain unit coverage for the combined gate
      id: unit_coverage
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
      with:
        name: unit-coverage
        path: coverage.xml
        if-no-files-found: error
        retention-days: 1

    - name: Upload coverage resource metrics
      if: ${{ always() && github.server_url == 'https://github.com' }}
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
      with:
        name: coverage-resource-metrics
        path: build/test-results/coverage-resource-metrics.md

    - name: Remove SQLite database from tmpfs
      if: ${{ always() }}
      run: rm -f "$COVERAGE_DB_PATH" "$COVERAGE_DB_PATH-journal" "$COVERAGE_DB_PATH-wal" "$COVERAGE_DB_PATH-shm"

  # Only aggregation needs the MySQL results. Collect unit coverage in parallel.
  coverage:
    needs:
    - preflight
    - feature-mysql
    - coverage-unit
    if: ${{ github.event_name != 'pull_request' }}
    runs-on: ubuntu-latest
    outputs:
      sonar_artifact_id: ${{ steps.sonar_coverage.outputs.artifact-id }}

    env:
      COVERAGE_BRANCH: ${{ github.head_ref || github.ref_name }}
      COVERAGE_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}

    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      with:
        fetch-depth: 10
        persist-credentials: false
        ref: ${{ env.COVERAGE_COMMIT }}

    - name: Disable APT download retries (CVE-2026-109518)
      run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null
    - name: Set up PHP for coverage aggregation
      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
      with:
        php-version: '8.3'
        coverage: none

    - name: Download unit coverage from this run
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
      with:
        artifact-ids: ${{ needs.coverage-unit.outputs.unit_artifact_id }}
        digest-mismatch: error

    - name: Download MySQL feature coverage
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
      with:
        pattern: feature-timing-mysql-*
        path: build/feature-coverage
        merge-multiple: true

    - name: Enforce the v2 coverage ratchet
      run: >-
        php scripts/ci/check-v2-coverage.php
        --clover=coverage.xml
        --clover=build/feature-coverage/mysql-shard-0-coverage.xml
        --clover=build/feature-coverage/mysql-shard-1-coverage.xml
        --clover=build/feature-coverage/mysql-shard-2-coverage.xml
        --clover=build/feature-coverage/mysql-shard-3-coverage.xml
        --clover=build/feature-coverage/mysql-shard-4-coverage.xml
        --clover=build/feature-coverage/mysql-shard-5-coverage.xml

    - name: Send Clover reports to the isolated Sonar job
      id: sonar_coverage
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
      with:
        name: sonar-coverage
        path: |
          coverage.xml
          build/feature-coverage/mysql-shard-0-coverage.xml
          build/feature-coverage/mysql-shard-1-coverage.xml
          build/feature-coverage/mysql-shard-2-coverage.xml
          build/feature-coverage/mysql-shard-3-coverage.xml
          build/feature-coverage/mysql-shard-4-coverage.xml
          build/feature-coverage/mysql-shard-5-coverage.xml
        if-no-files-found: error
        retention-days: 1

    - name: Upload machine-readable v2 coverage summary
      if: ${{ always() && github.server_url == 'https://github.com' }}
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
      with:
        name: v2-coverage-summary
        path: build/coverage/v2-coverage-summary.json

    - name: Verify pinned Codecov CLI
      if: ${{ github.server_url == 'https://github.com' }}
      run: |
        curl --fail --location --proto '=https' --proto-redir '=https' --retry 3 --connect-timeout 10 --max-time 60 \
          https://github.com/codecov/codecov-cli/releases/download/v11.3.1/codecovcli_linux \
          --output "$RUNNER_TEMP/codecovcli"
        printf '%s  %s\n' \
          ca1d64196d2d34771084afe76ea657d581bf628e31d993ff8e52ea09cc88a56d \
          "$RUNNER_TEMP/codecovcli" | sha256sum --check --strict
        chmod +x "$RUNNER_TEMP/codecovcli"

    - name: Upload coverage to Codecov
      id: codecov
      if: ${{ github.server_url == 'https://github.com' }}
      continue-on-error: true
      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7
      with:
        binary: ${{ runner.temp }}/codecovcli
        flags: v2
        files: ./coverage.xml,./build/feature-coverage/mysql-shard-0-coverage.xml,./build/feature-coverage/mysql-shard-1-coverage.xml,./build/feature-coverage/mysql-shard-2-coverage.xml,./build/feature-coverage/mysql-shard-3-coverage.xml,./build/feature-coverage/mysql-shard-4-coverage.xml,./build/feature-coverage/mysql-shard-5-coverage.xml
        fail_ci_if_error: true
        name: v2
        override_branch: ${{ env.COVERAGE_BRANCH }}
        override_commit: ${{ env.COVERAGE_COMMIT }}

    - name: Report unavailable external coverage upload
      if: ${{ steps.codecov.outcome == 'failure' }}
      run: echo '::warning title=Codecov upload unavailable::Runtime tests and coverage thresholds remain required. Raw coverage evidence is retained in this run.'

  sonar-coverage:
    name: SonarQube analysis
    needs: [coverage]
    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      with:
        fetch-depth: 0
        persist-credentials: false
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
      with:
        artifact-ids: ${{ needs.coverage.outputs.sonar_artifact_id }}
        path: .sonar-coverage
        digest-mismatch: error
    - uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
      env:
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      with:
        args: -Dsonar.qualitygate.wait=true -Dsonar.qualitygate.timeout=300

  build:
    runs-on: ubuntu-latest
    timeout-minutes: 2
    needs:
    - preflight
    - regression-corpus
    - quality
    - tracing-http
    - pr-unit-contracts
    - pr-unit
    - pr-tracing
    - pr-feature-mysql
    - feature-mysql
    - feature-mariadb
    - feature-postgresql
    - coverage-unit
    - coverage
    - laravel-embedded-upgrade-source
    - action-policy
    if: always()

    steps:
    - name: Require central action policy preflight
      if: ${{ github.server_url == 'https://github.com' }}
      env:
        ACTION_POLICY_RESULT: ${{ needs.action-policy.result }}
      run: test "$ACTION_POLICY_RESULT" = success

    - name: Require repository preflight
      run: test "${{ needs.preflight.result }}" = "success"

    - name: Require the actual HTTP tracing consumer
      run: test "${{ needs.tracing-http.result }}" = "success"

    - name: Check pull-request gate
      if: ${{ github.event_name == 'pull_request' }}
      run: |
        test "${{ needs.regression-corpus.result }}" = "success"
        test "${{ needs.quality.result }}" = "success"
        test "${{ needs.pr-unit-contracts.result }}" = "success"
        test "${{ needs.pr-unit.result }}" = "success"
        test "${{ needs.pr-tracing.result }}" = "success"
        test "${{ needs.pr-feature-mysql.result }}" = "success"
        test "${{ needs.feature-mysql.result }}" = "skipped"
        test "${{ needs.feature-mariadb.result }}" = "skipped"
        test "${{ needs.feature-postgresql.result }}" = "success"
        test "${{ needs.coverage-unit.result }}" = "skipped"
        test "${{ needs.coverage.result }}" = "skipped"
        test "${{ needs.laravel-embedded-upgrade-source.result }}" = "skipped"
        echo "Pull-request validation succeeded."

    - name: Check target-branch matrix
      if: ${{ github.event_name != 'pull_request' }}
      run: |
        test "${{ needs.regression-corpus.result }}" = "success"
        test "${{ needs.quality.result }}" = "success"
        test "${{ needs.pr-unit-contracts.result }}" = "skipped"
        test "${{ needs.pr-unit.result }}" = "skipped"
        test "${{ needs.pr-tracing.result }}" = "skipped"
        test "${{ needs.pr-feature-mysql.result }}" = "skipped"
        test "${{ needs.feature-mysql.result }}" = "success"
        test "${{ needs.feature-mariadb.result }}" = "success"
        test "${{ needs.feature-postgresql.result }}" = "success"
        test "${{ needs.coverage-unit.result }}" = "success"
        test "${{ needs.coverage.result }}" = "success"
        test "${{ needs.laravel-embedded-upgrade-source.result }}" = "success"
        echo "The target-branch test matrix succeeded for this SHA."