name: auth

on:
  pull_request:
    paths:
    - 'FirebaseAuth**'
    - 'FirebaseAuth/Interop/*.h'
    - '.github/workflows/auth.yml'
    - 'scripts/gha-encrypted/AuthSample/SwiftApplication.plist.gpg'
    - 'Gemfile*'
  schedule:
    # Run every day at 1am (PST) - cron uses UTC times
    - cron:  '0 9 * * *'

concurrency:
    group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
    cancel-in-progress: true

jobs:

  pod-lib-lint:
    # Don't run on private repo unless it is a PR.
    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'

    strategy:
      matrix:
        podspec: [FirebaseAuthInterop.podspec, FirebaseAuth.podspec]
        # TODO: macos tests are blocked by https://github.com/erikdoe/ocmock/pull/532
        target: [ios, tvos, macos --skip-tests, watchos]
        os: [macos-12, macos-13]
        include:
          - os: macos-12
            xcode: Xcode_14.2
            tests: --skip-tests
          - os: macos-13
            xcode: Xcode_15.1
            tests:
    runs-on: ${{ matrix.os }}
    steps:
    - uses: actions/checkout@v4
    - uses: ruby/setup-ruby@v1
    - name: Setup Bundler
      run: scripts/setup_bundler.sh
    - name: Configure test keychain
      run: scripts/configure_test_keychain.sh
    - name: Xcode
      run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
    - name: Build and test
# TODO: Restore warnings check after resolution of #11693
#      run: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb ${{ matrix.podspec }} --platforms=${{ matrix.target }}
      run: |
        scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb ${{ matrix.podspec }} --platforms=${{ matrix.target }} \
         ${{ matrix.tests }} --allow-warnings

  integration-tests:
    # Don't run on private repo unless it is a PR.
    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'

    env:
      plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
    runs-on: macos-12
    steps:
    - uses: actions/checkout@v4
    - uses: mikehardy/buildcache-action@c87cea0ccd718971d6cc39e672c4f26815b6c126
      with:
        cache_key: integration-tests${{ matrix.os }}
    - uses: ruby/setup-ruby@v1
    - name: Setup Bundler
      run: scripts/setup_bundler.sh
    - name: Prereqs
      run: scripts/install_prereqs.sh Auth iOS
    - name: Install Secrets
      run: |
        scripts/decrypt_gha_secret.sh scripts/gha-encrypted/AuthCredentials.h.gpg \
          FirebaseAuth/Tests/SampleSwift/ObjCApiTests/AuthCredentials.h "$plist_secret"
        scripts/decrypt_gha_secret.sh scripts/gha-encrypted/AuthSample/SwiftApplication.plist.gpg \
          FirebaseAuth/Tests/SampleSwift/SwiftApplication.plist "$plist_secret"
        scripts/decrypt_gha_secret.sh scripts/gha-encrypted/AuthSample/AuthCredentials.h.gpg \
          FirebaseAuth/Tests/SampleSwift/AuthCredentials.h "$plist_secret"
        scripts/decrypt_gha_secret.sh scripts/gha-encrypted/AuthSample/GoogleService-Info.plist.gpg \
          FirebaseAuth/Tests/SampleSwift/GoogleService-Info.plist "$plist_secret"
        scripts/decrypt_gha_secret.sh scripts/gha-encrypted/AuthSample/GoogleService-Info_multi.plist.gpg \
          FirebaseAuth/Tests/SampleSwift/GoogleService-Info_multi.plist "$plist_secret"
        scripts/decrypt_gha_secret.sh scripts/gha-encrypted/AuthSample/Sample.entitlements.gpg \
          FirebaseAuth/Tests/SampleSwift/Sample.entitlements "$plist_secret"
        scripts/decrypt_gha_secret.sh scripts/gha-encrypted/AuthSample/Credentials.swift.gpg \
          FirebaseAuth/Tests/SampleSwift/SwiftApiTests/Credentials.swift "$plist_secret"

    - name: BuildAndTest # can be replaced with pod lib lint with CocoaPods 1.10
      run: ([ -z $plist_secret ] || scripts/third_party/travis/retry.sh scripts/build.sh Auth iOS)

  spm:
    # Don't run on private repo unless it is a PR.
    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
    strategy:
      matrix:
        target: [iOS, tvOS, macOS, catalyst, watchOS]
        os: [macos-12, macos-13]
        include:
          - os: macos-12
            xcode: Xcode_14.2
            test: spm
          - os: macos-13
            xcode: Xcode_15.1
            test: spmbuildonly
    runs-on: ${{ matrix.os }}
    steps:
    - uses: actions/checkout@v4
    - uses: mikehardy/buildcache-action@c87cea0ccd718971d6cc39e672c4f26815b6c126
      with:
        cache_key: spm${{ matrix.os }}-${{ matrix.xcode }}-${{ matrix.target }}
    - name: Xcode
      run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
    - name: Initialize xcodebuild
      run: scripts/setup_spm_tests.sh
    - name: Unit Tests
      run: scripts/third_party/travis/retry.sh ./scripts/build.sh AuthUnit ${{ matrix.target }} ${{ matrix.test }}

  catalyst:
    # Don't run on private repo unless it is a PR.
    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
    runs-on: macos-12
    steps:
    - uses: actions/checkout@v4
    - uses: mikehardy/buildcache-action@c87cea0ccd718971d6cc39e672c4f26815b6c126
      with:
        cache_key: catalyst${{ matrix.os }}
    - uses: ruby/setup-ruby@v1
    - name: Setup Bundler
      run: scripts/setup_bundler.sh
    - name: Setup project and Build for Catalyst
      # Only build the unit tests on Catalyst. Their keychain reliance causes several failures.
      run: scripts/test_catalyst.sh FirebaseAuth build FirebaseAuth-Unit-unit

  quickstart:
    # Don't run on private repo unless it is a PR.
    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'

    env:
      plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
      signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
    runs-on: macos-12
    steps:
    - uses: actions/checkout@v4
    - uses: ruby/setup-ruby@v1
    - name: Setup quickstart
      run: scripts/setup_quickstart.sh authentication
    - name: Install Secret GoogleService-Info.plist
      run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-auth.plist.gpg \
          quickstart-ios/authentication/GoogleService-Info.plist "$plist_secret"
    - name: Test swift quickstart
      run: ([ -z $plist_secret ] || scripts/third_party/travis/retry.sh scripts/test_quickstart.sh Authentication false)

  # TODO(@sunmou99): currently have issue with this job, will re-enable it once the issue resolved.
  # quickstart-ftl-cron-only:
  #   # Don't run on private repo.
  #   if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'

  #   env:
  #     plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
  #     signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
  #   runs-on: macos-12
  #   steps:
  #   - uses: actions/checkout@v4
  #   - uses: ruby/setup-ruby@v1
  #   - name: Setup quickstart
  #     run: scripts/setup_quickstart.sh authentication
  #   - name: Install Secret GoogleService-Info.plist
  #     run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-auth.plist.gpg \
  #         quickstart-ios/authentication/GoogleService-Info.plist "$plist_secret"
  #   - name: Build swift quickstart
  #     run: ([ -z $plist_secret ] || scripts/third_party/travis/retry.sh scripts/test_quickstart_ftl.sh Authentication)
  #   - id: ftl_test
  #     uses: FirebaseExtended/github-actions/firebase-test-lab@v1.2
  #     with:
  #       credentials_json: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_CREDENTIALS }}
  #       testapp_dir: quickstart-ios/build-for-testing
  #       test_type: "xctest"

  auth-cron-only:
    # Don't run on private repo.
    if: github.event_name == 'schedule' && github.repository == 'Firebase/firebase-ios-sdk'

    runs-on: macos-12
    strategy:
      matrix:
        # The macos and tvos tests can hang, and watchOS doesn't have tests.
        target: [ios, tvos --skip-tests, macos --skip-tests, watchos --skip-tests]
        flags: [
          '--use-static-frameworks'
        ]
    needs: pod-lib-lint
    steps:
    - uses: actions/checkout@v4
    - uses: ruby/setup-ruby@v1
    - name: Setup Bundler
      run: scripts/setup_bundler.sh
    - name: Configure test keychain
      run: scripts/configure_test_keychain.sh
    - name: PodLibLint Auth Cron
      run: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb FirebaseAuth.podspec --platforms=${{ matrix.target }} ${{ matrix.flags }}