name: Regression Tests

on:
  push:
    branches:
      - main
      - v3.3/dev
      - v3.3/master
      - lts/v4.25.x
    paths:
      - 'rules/**'
      - 'tests/**'
      - '.github/**'
  pull_request:
    branches:
      - main
      - v3.3/dev
      - v3.3/master
      - lts/v4.25.x
    paths:
      - 'rules/**'
      - 'tests/**'
      - 'util/**'
      - '.github/**'
  merge_group:

permissions:
  contents: read

# Pin tool versions to prevent problems
env:
  GO_FTW_VERSION: '2.3.0'

jobs:
  regression:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        modsec_version: [modsec2-apache, modsec3-nginx]
    steps:
      - name: "Checkout repo"
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false

      - name: "Install dependencies"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release download -R coreruleset/go-ftw "v${{ env.GO_FTW_VERSION }}" \
            -p "ftw_${{ env.GO_FTW_VERSION }}_linux_amd64.tar.gz" -O - | tar -xzvf - ftw

      - name: "Run tests for ${{ matrix.modsec_version }}"
        run: |
          mkdir -p "tests/logs/${{ matrix.modsec_version }}/{nginx,apache2}"
          docker compose -f ./tests/docker-compose.yml up -d "${{ matrix.modsec_version }}"
          echo "Waiting for container to become ready"
          curl --retry 5 --retry-connrefused --retry-delay 2 localhost || true
          sleep 5
          docker compose -f ./tests/docker-compose.yml logs
          if ! [ "$(docker inspect ${{ matrix.modsec_version }} --format='{{.State.Running}}')" = "true" ]; then
            echo "Web server failed to start. Aborting."
            exit 1
          fi

          ./ftw check -d tests/regression/tests
          ./ftw run \
            -d tests/regression/tests \
            --log-file "tests/logs/${{ matrix.modsec_version }}/error.log" \
            --overrides tests/regression/${{ matrix.modsec_version == 'modsec2-apache' && 'httpd' || 'nginx' }}-overrides.yaml \
            --show-failures-only \
            --store-failure-waf-logs

      - name: "Change permissions of artifacts for upload"
        if: failure()
        run: |
          # Files created from the container will belong to root
          sudo chmod -R a+r tests/logs

      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
        if: failure()
        with:
          name: waf-logs-${{ matrix.modsec_version }}
          path: tests/logs/${{ matrix.modsec_version }}

      - name: Clean docker-compose
        run: |
          docker compose -f ./tests/docker-compose.yml stop "${{ matrix.modsec_version }}"
          docker compose -f ./tests/docker-compose.yml down