fleet/.github/workflows/test-fma-darwin-pr-only.yml

name: Test Fleet Maintained Apps - Darwin (PR Only)

on:
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - ee/maintained-apps/inputs/**
      - ee/maintained-apps/outputs/**
      - cmd/maintained-apps/validate/**
      - .github/workflows/test-fma-darwin-pr-only.yml
      - .github/workflows/test-fma-darwin-validate.yml
      - .github/scripts/partition-fma-apps.sh
      - .github/scripts/detect-new-fmas-in-pr.sh
      - .github/scripts/filter-apps-json.sh
  workflow_dispatch: # Manual trigger
    inputs:
      log_level:
        description: "Log level (debug, info, warn, error)"
        required: false
        default: "info"
        type: choice
        options:
          - debug
          - info
          - warn
          - error

permissions:
  contents: read

jobs:
  # Detect which apps changed and shard them on a cheap Linux runner. The
  # (much more expensive) macOS runners below only spin up when there are
  # darwin apps to validate — Windows-only FMA PRs no longer boot a macOS
  # runner just to discover there is nothing to do. Large PRs are split into
  # shards that validate in parallel.
  detect-changed-apps:
    runs-on: ubuntu-latest
    outputs:
      has_darwin_apps: ${{ steps.partition.outputs.has_apps }}
      matrix: ${{ steps.partition.outputs.matrix }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout Fleet
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0 # Need full history to compare with base branch
          persist-credentials: false

      - name: Detect changed apps
        id: detect-changed
        env:
          GITHUB_BASE_REF: ${{ github.event.pull_request.base.ref || github.base_ref || 'main' }}
        run: |
          # fetch-depth 0 normally brings in the base branch already; fetch it
          # explicitly as a fallback so origin/$GITHUB_BASE_REF exists.
          git fetch origin "$GITHUB_BASE_REF" || true
          bash .github/scripts/detect-new-fmas-in-pr.sh

      - name: Shard Darwin apps
        id: partition
        env:
          CHANGED_APPS: ${{ steps.detect-changed.outputs.CHANGED_APPS }}
        run: |
          bash .github/scripts/partition-fma-apps.sh darwin "${CHANGED_APPS:-[]}" 30

  validate:
    needs: detect-changed-apps
    if: needs.detect-changed-apps.outputs.has_darwin_apps == 'true'
    name: ${{ matrix.name }}
    strategy:
      # Don't cancel the other shards' validation if one fails.
      fail-fast: false
      matrix:
        include: ${{ fromJSON(needs.detect-changed-apps.outputs.matrix) }}
    uses: ./.github/workflows/test-fma-darwin-validate.yml
    permissions:
      contents: read
    with:
      runner: ${{ matrix.runner }}
      slugs: ${{ matrix.slugs }}
      log_level: ${{ github.event.inputs.log_level || 'info' }}

  # Stable-named summary check (matches the old single-job name) so PR gating
  # doesn't depend on the dynamic per-shard matrix job names.
  test-fma-pr-only:
    needs: [detect-changed-apps, validate]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Check validation results
        env:
          DETECT_RESULT: ${{ needs.detect-changed-apps.result }}
          VALIDATE_RESULT: ${{ needs.validate.result }}
        run: |
          echo "detect-changed-apps: $DETECT_RESULT"
          echo "validate: $VALIDATE_RESULT"
          if [ "$DETECT_RESULT" != "success" ]; then
            echo "Detecting changed apps failed"
            exit 1
          fi
          # validate is skipped when the PR changes no darwin apps.
          if [ "$VALIDATE_RESULT" != "success" ] && [ "$VALIDATE_RESULT" != "skipped" ]; then
            echo "Validation failed"
            exit 1
          fi
          echo "All Darwin FMA validations passed"