ci-nodejs.yml

name: Node.js CI
on:
    pull_request:
    push:
        branches:
            - master
    schedule:
        # Where master's coverage for the Node.js checks comes from. The merge queue's
        # trunk-merge/** run gates every commit before it lands, so the push lane does
        # not repeat them.
        # Offset from the other hourly CI crons so the runs do not all fire at once.
        - cron: '13 * * * *'

env:
    OBJECT_STORAGE_ENABLED: true
    OBJECT_STORAGE_ENDPOINT: 'http://localhost:19000'
    OBJECT_STORAGE_ACCESS_KEY_ID: 'object_storage_root_user'
    OBJECT_STORAGE_SECRET_ACCESS_KEY: 'object_storage_root_password'
    OBJECT_STORAGE_SESSION_RECORDING_FOLDER: 'session_recordings'
    OBJECT_STORAGE_BUCKET: 'posthog'
    # set the max buffer size small enough that the functional tests behave the same in CI as when running locally
    SESSION_RECORDING_MAX_BUFFER_SIZE_KB: 1024
    RUNS_ON_INTERNAL_PR: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false }}

concurrency:
    # The hourly lane gets its own group, so it queues behind itself rather than
    # behind master pushes. Sharing the ref group would let a slow hourly run hold
    # the group while pushes pile up pending, and GitHub keeps only the newest
    # pending run per group — so the older push, and its per-commit checks, would
    # be dropped.
    group: ${{ github.workflow }}-${{ github.event_name == 'schedule' && 'scheduled' || github.head_ref || github.ref }}
    cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
    # Job to decide if we should run nodejs services ci
    # See .github/actions/paths-filter/README.md for filter semantics
    changes:
        runs-on: ubuntu-latest
        timeout-minutes: 10
        name: Determine need to run Node.js checks
        permissions:
            contents: read
            pull-requests: read
        outputs:
            nodejs: ${{ steps.nodejs-changes.outputs.nodejs || 'true' }}
            # Jest selection for the tests job. `mode` is 'selective' only when the diff is
            # confined to Node source files jest can resolve; anything else is 'full'.
            test_mode: ${{ steps.select-tests.outputs.mode || 'full' }}
            test_files: ${{ steps.select-tests.outputs.files }}
            # Telemetry (see capture-nodejs-selection). Emitted on every path, so a
            # fallback rate can be read per reason rather than inferred from mode alone.
            test_reason: ${{ steps.select-tests.outputs.reason }}
            test_file_count: ${{ steps.select-tests.outputs.file_count }}
        steps:
            # For pull requests it's not necessary to checkout the code, but we
            # also want this to run on master so we need to checkout
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  clean: false
                  filter: blob:none
                  fetch-depth: 0

            - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
              id: app-token
              if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
              with:
                  client-id: ${{ vars.GH_APP_POSTHOG_PATHS_FILTER_APP_ID }}
                  private-key: ${{ secrets.GH_APP_POSTHOG_PATHS_FILTER_PRIVATE_KEY }}
            - uses: ./.github/actions/paths-filter
              id: filter
              # Skipped on master push and on the hourly schedule: the decision step below
              # treats both as "run everything". See "The hourly master lane" in
              # .agents/skills/authoring-ci-workflows/SKILL.md for why a cron cannot
              # diff, and what breaks if this guard is dropped.
              if: github.event_name != 'push' && github.event_name != 'schedule'
              with:
                  token: ${{ steps.app-token.outputs.token || github.token }}
                  # node_src_files feeds jest --findRelatedTests in the select step below.
                  list-files: 'escape'
                  filters: |
                      nodejs:
                        - .github/workflows/ci-nodejs.yml
                        - .github/actions/setup-uv/**
                        # The report job executes these after Jest uploads its JUnit artifacts.
                        - '.github/actions/report-jest-timings/**'
                        - '.github/scripts/report_test_timings.py'
                        - 'bin/report-jest-timings'
                        # Node DB setup builds sqlx-cli via this composite; changes to it must exercise these jobs.
                        - '.github/actions/setup-sqlx-cli/**'
                        - 'nodejs/**'
                        # The Jest shared-fixtures suite pins the native replay anonymizer against
                        # its Rust tests; a rust-side change (incl. the shared fixtures) must run it.
                        - 'rust/replay-anonymizer/**'
                        - 'rust/replay-anonymizer-node/**'
                        # These native addons are built by Turbo before Node.js tests. Their Rust
                        # dependencies are not part of the ingestion consumer's targeted e2e set.
                        - 'rust/common/hogvm/**'
                        - '**/crosslang/**'
                        # The clientwarnings consumer e2e replays capture's warning envelope from
                        # this shared fixture. Without it the rust filter below decides, and it only
                        # admits ingestion-consumer, which does not depend on the fixture's crate, so
                        # a capture-side envelope change would skip the test that pins the consumer.
                        - 'rust/common/ingestion_warnings/*.json'
                        - 'posthog/clickhouse/**'
                        - 'ee/migrations/**'
                        - 'posthog/management/commands/setup_test_environment.py'
                        - 'posthog/migrations/**'
                        - 'posthog/plugins/**'
                        # Compose files only, no Dockerfile glob: these jobs run the suites from
                        # source via pnpm and the compose stack's only build contexts are rust/,
                        # so no app image is built here. Dockerfile.node is gated separately in
                        # ci-nodejs-container.yml.
                        - 'docker*.yml'
                        # The compose stack mounts this ClickHouse config; the Kafka engine settings
                        # in it set how long every ClickHouse-backed Jest test waits for a row.
                        - 'docker/clickhouse/**'
                      rust:
                        - 'rust/**'
                        - 'proto/**'
                        - '.github/rust-images.yml'
                        - '.github/actions/rust-compute-affected/**'
                      # Node sources jest can resolve. Their paths feed --findRelatedTests.
                      node_src:
                        - 'nodejs/**/*.ts'
                        - 'nodejs/**/*.js'
                        - '!nodejs/**/*.d.ts'
                      # Anything here invalidates jest's view of the module graph, or changes
                      # the native addons every suite links, so no narrowed run can be trusted.
                      node_full:
                        - 'nodejs/jest*.config.js'
                        - 'nodejs/package.json'
                        - 'nodejs/tsconfig*.json'
                        - 'pnpm-lock.yaml'
                        - 'rust/**'
                        - 'proto/**'
                        - '.github/workflows/ci-nodejs.yml'
                        - '.github/actions/setup-uv/**'

            - name: Install rust for affected-crate detection
              # Not needed on schedule either: the decision step below already returns
              # nodejs=true there without consulting the affected-crate set.
              if: github.event_name != 'push' && github.event_name != 'schedule' && steps.filter.outputs.rust == 'true'
              uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
              with:
                  toolchain: 1.91.1

            - name: Compute affected Rust crates
              id: rust-affected
              # Not needed on schedule either: the decision step below already returns
              # nodejs=true there without consulting the affected-crate set.
              if: github.event_name != 'push' && github.event_name != 'schedule' && steps.filter.outputs.rust == 'true'
              uses: ./.github/actions/rust-compute-affected
              with:
                  event-name: ${{ github.event_name }}
                  pr-base-sha: ${{ github.event.pull_request.base.sha }}
                  push-before-sha: ${{ github.event.before }}

            - name: Decide whether Node.js checks should run
              id: nodejs-changes
              env:
                  NODEJS_CHANGED: ${{ steps.filter.outputs.nodejs }}
                  RUST_CHANGED: ${{ steps.filter.outputs.rust }}
                  RUST_REBUILD_ALL: ${{ steps.rust-affected.outputs.rebuild-all }}
                  RUST_AFFECTED_CRATES: ${{ steps.rust-affected.outputs.crates }}
                  RUST_NODE_E2E_CRATES: '["ingestion-consumer"]'
              run: |
                  # `schedule` alongside `push`: the paths filter is skipped on both, so
                  # NODEJS_CHANGED is empty there. Without this the hourly run would decide
                  # nodejs=false and report green having run no tests at all.
                  if [ "${{ github.event_name }}" = "push" ] || [ "${{ github.event_name }}" = "schedule" ]; then
                    echo "nodejs=true" >> "$GITHUB_OUTPUT"
                    exit 0
                  fi

                  if [ "$NODEJS_CHANGED" = "true" ]; then
                    echo "nodejs=true" >> "$GITHUB_OUTPUT"
                    exit 0
                  fi

                  if [ "$RUST_CHANGED" = "true" ]; then
                    if [ "$RUST_REBUILD_ALL" = "true" ]; then
                      echo "nodejs=true" >> "$GITHUB_OUTPUT"
                      exit 0
                    fi

                    if echo "${RUST_AFFECTED_CRATES:-[]}" | jq -e --argjson e2e_crates "$RUST_NODE_E2E_CRATES" '. as $affected | any($e2e_crates[]; . as $crate | $affected | index($crate) != null)' >/dev/null; then
                      echo "nodejs=true" >> "$GITHUB_OUTPUT"
                      exit 0
                    fi
                  fi

                  echo "nodejs=false" >> "$GITHUB_OUTPUT"

            # Narrow the jest run to the tests reachable from the changed Node sources.
            # Verified locally that jest applies --findRelatedTests before --shard, so the
            # shards still partition the selected set exactly rather than a subset of it.
            # Fail-open is always FULL, never skip: this workflow has no draft/ready split
            # and no later run on the PR would cover a miss.
            - name: Select jest tests
              id: select-tests
              env:
                  NODE_FULL: ${{ steps.filter.outputs.node_full }}
                  NODE_SRC: ${{ steps.filter.outputs.node_src }}
                  NODE_SRC_FILES: ${{ steps.filter.outputs.node_src_files }}
                  # Through env, not inline: a branch name is author-controlled.
                  HEAD_REF: ${{ github.head_ref }}
              run: |
                  set -uo pipefail

                  # $1 is a closed category, so the telemetry can be grouped by reason.
                  full() {
                      echo "::notice::$1; running the full jest suite"
                      {
                          echo "mode=full"
                          echo "files="
                          echo "reason=$1"
                          echo "file_count=${count:-}"
                      } >> "$GITHUB_OUTPUT"
                      exit 0
                  }

                  # Master push and the cron skip the paths filter, so every output is empty.
                  [ "${{ github.event_name }}" = "pull_request" ] || full not_a_pull_request
                  # Trunk's merge-queue branches raise a pull_request event like any other, so
                  # they need excluding by name. That run is the gate for master and must never
                  # be narrowed.
                  case "$HEAD_REF" in
                      trunk-merge/*) full merge_queue ;;
                  esac
                  [ "$NODE_FULL" != "true" ] || full config_change
                  [ "$NODE_SRC" = "true" ] || full no_node_sources

                  # Paths arrive repo-relative; jest runs from nodejs/, so strip the prefix.
                  # `list-files: escape` returns one shell-escaped, space-separated list, so
                  # the splitting shellcheck warns about is exactly what turns it into paths.
                  # shellcheck disable=SC2086
                  files=$(printf '%s\n' $NODE_SRC_FILES | sed 's|^nodejs/||' | tr '\n' ' ')
                  # shellcheck disable=SC2086
                  count=$(printf '%s\n' $NODE_SRC_FILES | grep -c . || true)
                  [ "$count" -le 200 ] || full over_ceiling
                  [ -n "${files// /}" ] || full empty_file_list

                  echo "::notice::selective jest over $count changed Node source file(s)"
                  {
                      echo "mode=selective"
                      echo "files=$files"
                      echo "reason="
                      echo "file_count=$count"
                  } >> "$GITHUB_OUTPUT"

    lint:
        # Not on master push — master coverage comes from the hourly run (see `schedule`).
        if: needs.changes.outputs.nodejs == 'true' && github.event_name != 'push'
        name: Node.js Code quality (depot-ubuntu-24.04)
        needs: changes
        runs-on: depot-ubuntu-24.04
        timeout-minutes: 10
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  clean: false

            - name: Mint setup-action GitHub token
              id: setup-gh-token
              if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
              continue-on-error: true
              uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
              with:
                  client-id: ${{ vars.GH_APP_POSTHOG_SETUP_ACTIONS_APP_ID }}
                  private-key: ${{ secrets.GH_APP_POSTHOG_SETUP_ACTIONS_PRIVATE_KEY }}
                  skip-token-revoke: true

            - name: Install pnpm dependencies
              uses: ./.github/actions/pnpm-install
              with:
                  install-command: pnpm --filter=@posthog/nodejs... install --frozen-lockfile
                  token: ${{ steps.setup-gh-token.outputs.token || github.token }}

            - name: Install rust
              uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
              with:
                  toolchain: 1.91.1

            - name: Set sccache WebDAV key prefix (Cargo.lock hash)
              run: echo "SCCACHE_WEBDAV_KEY_PREFIX=cargo-${{ hashFiles('rust/Cargo.lock') }}" >> "$GITHUB_ENV"

            - name: Install sccache
              uses: ./.github/actions/setup-sccache

            - name: Cache Rust dependencies
              uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
              with:
                  shared-key: 'v2-rust-nodejs'
                  workspaces: rust
                  save-if: ${{ github.ref == 'refs/heads/master' }}

            - name: Prepare Node.js workspace
              run: bin/turbo --filter=@posthog/nodejs prepare

            - parallel:
                  - name: Check formatting with prettier
                    run: pnpm --filter=@posthog/nodejs format:check

                  - name: Lint with Oxlint
                    run: pnpm --filter=@posthog/nodejs lint

                  # Guards the cdp/ingestion separation: fails on new lane->lane or shared->lane
                  # imports. Presence-checked so branches without the guard yet are unaffected.
                  - name: Check ingestion boundaries
                    run: |
                        if [ -f nodejs/bin/check-ingestion-boundaries.mjs ]; then
                            node nodejs/bin/check-ingestion-boundaries.mjs
                        else
                            echo "Ingestion boundary guard not present on this branch; skipping."
                        fi

    build:
        # Not on master push — master coverage comes from the hourly run (see `schedule`).
        if: needs.changes.outputs.nodejs == 'true' && github.event_name != 'push'
        name: Node.js Build (depot-ubuntu-24.04)
        needs: changes
        runs-on: depot-ubuntu-24.04
        timeout-minutes: 10
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  clean: false

            - name: Mint setup-action GitHub token
              id: setup-gh-token
              if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
              continue-on-error: true
              uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
              with:
                  client-id: ${{ vars.GH_APP_POSTHOG_SETUP_ACTIONS_APP_ID }}
                  private-key: ${{ secrets.GH_APP_POSTHOG_SETUP_ACTIONS_PRIVATE_KEY }}
                  skip-token-revoke: true

            - name: Install pnpm dependencies
              uses: ./.github/actions/pnpm-install
              with:
                  install-command: pnpm --filter=@posthog/nodejs... install --frozen-lockfile
                  token: ${{ steps.setup-gh-token.outputs.token || github.token }}

            - name: Install rust
              uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
              with:
                  toolchain: 1.91.1

            - name: Set sccache WebDAV key prefix (Cargo.lock hash)
              run: echo "SCCACHE_WEBDAV_KEY_PREFIX=cargo-${{ hashFiles('rust/Cargo.lock') }}" >> "$GITHUB_ENV"

            - name: Install sccache
              uses: ./.github/actions/setup-sccache

            - name: Cache Rust dependencies
              uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
              with:
                  shared-key: 'v2-rust-nodejs'
                  workspaces: rust
                  save-if: ${{ github.ref == 'refs/heads/master' }}

            - name: Prepare Node.js workspace
              run: bin/turbo --filter=@posthog/nodejs prepare

            - name: Check builds correctly
              run: pnpm --filter=@posthog/nodejs build

            - name: Sanity check output
              run: |
                  cd nodejs
                  # We expect it to fail but check that the error isn't "MODULE_NOT_FOUND"
                  if node dist/index.js 2>&1 | grep "MODULE_NOT_FOUND"; then
                      echo "❌ Build is invalid - failed with 'MODULE_NOT_FOUND' error"
                      exit 1
                  else
                      echo "✅ Build is valid - failed as expected without module errors"
                  fi

    tests:
        # Not on master push — master coverage comes from the hourly run (see `schedule`).
        if: needs.changes.outputs.nodejs == 'true' && github.event_name != 'push'
        name: Node.js ${{ matrix.lane }} Tests ${{ matrix.shard }}/${{ matrix.shard_count }} (depot-ubuntu-24.04-4)
        needs: changes
        runs-on: depot-ubuntu-24.04-4
        # Tests fit comfortably in 30, but a rust change misses the turbo cache and cold-builds the
        # replay-anonymizer addon's whole dependency tree first (no rust caching in this job yet).
        timeout-minutes: 45
        strategy:
            fail-fast: false
            matrix:
                include:
                    - lane: parallel
                      shard: 1
                      shard_count: 1
                    - lane: serial
                      shard: 1
                      shard_count: 3
                    - lane: serial
                      shard: 2
                      shard_count: 3
                    - lane: serial
                      shard: 3
                      shard_count: 3
        env:
            DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USER }}
            DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
            REDIS_URL: 'redis://localhost'
            CLICKHOUSE_HOST: 'localhost'
            CLICKHOUSE_DATABASE: 'posthog_test'
            KAFKA_HOSTS: 'kafka:9092'

        steps:
            - name: Code check out
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  clean: false
            - name: Clean up data directories with container permissions
              run: |
                  # Use docker to clean up files created by containers
                  [ -d "data" ] && docker run --rm -v "$(pwd)/data:/data" alpine sh -c "rm -rf /data/seaweedfs /data/minio" || true
              continue-on-error: true

            - name: Log in to Docker Hub
              continue-on-error: true
              if: ${{ env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }}
              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
              with:
                  username: ${{ vars.DOCKERHUB_USER }}
                  password: ${{ secrets.DOCKERHUB_TOKEN }}

            - name: Stop/Start stack with Docker Compose
              env:
                  COMPOSE_FILE: docker-compose.dev.yml:docker-compose.profiles.yml
                  COMPOSE_PROFILES: dev_tools,dynamodb
                  WAIT_FOR_DOCKER_LAUNCH_RETRIES: 3
                  WAIT_FOR_DOCKER_LAUNCH_RETRY_DELAY: 5
              run: |
                  bin/ci-wait-for-docker launch --down

            - name: Wait for Docker services
              env:
                  COMPOSE_FILE: docker-compose.dev.yml:docker-compose.profiles.yml
                  COMPOSE_PROFILES: dev_tools,dynamodb
              run: bin/ci-wait-for-docker wait

            - name: Add service hostnames to /etc/hosts
              run: echo "127.0.0.1 db redis7 kafka clickhouse clickhouse-coordinator objectstorage seaweedfs temporal" | sudo tee -a /etc/hosts

            - name: Mint setup-action GitHub token
              id: setup-gh-token
              if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
              continue-on-error: true
              uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
              with:
                  client-id: ${{ vars.GH_APP_POSTHOG_SETUP_ACTIONS_APP_ID }}
                  private-key: ${{ secrets.GH_APP_POSTHOG_SETUP_ACTIONS_PRIVATE_KEY }}
                  skip-token-revoke: true

            - name: Set up Python
              uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
              with:
                  python-version-file: 'pyproject.toml'
                  token: ${{ steps.setup-gh-token.outputs.token || github.token }}

            - name: Install uv
              id: setup-uv
              uses: ./.github/actions/setup-uv

            - name: Install rust
              uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
              with:
                  toolchain: 1.91.1

            - name: Set sccache WebDAV key prefix (Cargo.lock hash)
              run: echo "SCCACHE_WEBDAV_KEY_PREFIX=cargo-${{ hashFiles('rust/Cargo.lock') }}" >> "$GITHUB_ENV"

            - name: Install sccache
              uses: ./.github/actions/setup-sccache

            - name: Cache Rust dependencies
              uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
              with:
                  shared-key: 'v2-rust-nodejs'
                  workspaces: rust
                  save-if: ${{ github.ref == 'refs/heads/master' }}

            - name: Install sqlx-cli
              uses: ./.github/actions/setup-sqlx-cli

            - name: Install SAML (python3-saml) dependencies
              if: steps.setup-uv.outputs.cache-hit != 'true'
              run: |
                  sudo rm -f /etc/apt/sources.list.d/*twingate*
                  sudo apt-get update
                  sudo apt-get install libxml2-dev libxmlsec1-dev libxmlsec1-openssl

            - name: Install python dependencies
              run: |
                  UV_PROJECT_ENVIRONMENT=$pythonLocation uv sync --frozen --dev

            - name: Download MaxMind Database
              run: |
                  ./bin/download-mmdb

            - name: Install pnpm dependencies
              uses: ./.github/actions/pnpm-install
              with:
                  install-command: pnpm --filter=@posthog/nodejs... install --frozen-lockfile
                  token: ${{ steps.setup-gh-token.outputs.token || github.token }}

            - name: Wait for Clickhouse, Redis, Kafka, DynamoDB, SeaweedFS
              # seaweedfs backs the blob-store integration tests; the profile-scoped
              # stack launch above never starts it (it sits in the replay/agents
              # profiles), so start it explicitly here — no profiles overlay in play.
              # objectstorage starts by default but is listed so --wait blocks on its
              # bootstrap sentinel: it returns InvalidAccessKeyId until that finishes.
              run: docker compose -f docker-compose.dev.yml up kafka redis7 valkey-cluster clickhouse maildev dynamodb objectstorage seaweedfs -d --wait

            - name: Create Kafka topics
              run: docker compose -f docker-compose.dev.yml up kafka-init

            - name: Fetch base branch for diff
              if: github.event_name == 'pull_request'
              env:
                  BASE_REF: ${{ github.base_ref }}
              run: git fetch origin "$BASE_REF" --depth=1

            - name: Check for migrations in this PR
              id: check_migrations
              if: github.event_name == 'pull_request'
              env:
                  BASE_REF: ${{ github.base_ref }}
              run: |
                  if git diff --name-only "origin/$BASE_REF..HEAD" | grep -E '(migrations/|rust/.*migrate)'; then
                    echo "has_migrations=true" >> $GITHUB_OUTPUT
                  else
                    echo "has_migrations=false" >> $GITHUB_OUTPUT
                  fi

            - name: Set up databases (fast path - restore schema)
              if: github.event_name == 'pull_request' && steps.check_migrations.outputs.has_migrations == 'false'
              env:
                  TEST: 'true'
                  SECRET_KEY: 'abcdef' # unsafe - for testing only
                  DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/posthog'
                  BEHAVIORAL_COHORTS_DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/test_behavioral_cohorts'
                  # Downloading an artifact requires the Actions permission, which the setup-actions app does not hold
                  GH_TOKEN: ${{ github.token }}
              run: |
                  # Download pre-migrated schema from CI
                  ./bin/hogli db:download-schema

                  # Create test databases
                  docker compose -f docker-compose.dev.yml exec -T db psql -U posthog -c "DROP DATABASE IF EXISTS test_posthog;"
                  docker compose -f docker-compose.dev.yml exec -T db psql -U posthog -c "CREATE DATABASE test_posthog;"

                  # Restore schema to test database
                  echo "Restoring schema to test_posthog database..."
                  gunzip -c .postgres-backups/schema-latest.sql.gz | docker compose -f docker-compose.dev.yml exec -T db psql -q -U posthog test_posthog
                  echo "✅ Schema restored"

                  # Run Rust migrations for test databases
                  cd nodejs && pnpm run setup:test:rust

                  # Create dedicated persons database for postgres-parity tests
                  pnpm run setup:test:persons-parity

                  # Set up ClickHouse test database and schema
                  cd .. && TEST=1 SECRET_KEY='abcdef' python manage.py setup_test_environment --only-clickhouse

            - name: Set up databases (slow path - run migrations)
              if: github.event_name != 'pull_request' || steps.check_migrations.outputs.has_migrations == 'true'
              env:
                  TEST: 'true'
                  SECRET_KEY: 'abcdef' # unsafe - for testing only
                  DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/posthog'
                  BEHAVIORAL_COHORTS_DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/test_behavioral_cohorts'
              run: |
                  pnpm --filter=@posthog/nodejs setup:test
                  # Create dedicated persons database for postgres-parity tests
                  cd nodejs && pnpm run setup:test:persons-parity

            # Build workspace deps (Rust addons + TS) up front so the Jest step times only tests, not the addon compile.
            - name: Prepare Node.js workspace
              env:
                  SHARD_INDEX: ${{ matrix.shard }}
                  SHARD_COUNT: ${{ matrix.shard_count }}
              run: bin/turbo --filter=@posthog/nodejs prepare

            - name: Test with Jest
              id: run-jest
              # continue-on-error so the quarantine gate below is the verdict — it passes when
              # every failure is an already-quarantined flake, fails otherwise.
              continue-on-error: true
              env:
                  # Below DB name has `test_` prepended, as that's how Django (ran above) creates the test DB
                  DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/test_posthog'
                  BEHAVIORAL_COHORTS_DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/test_behavioral_cohorts'
                  PERSONS_DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/test_persons'
                  PERSONS_READONLY_DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/test_persons'
                  REDIS_URL: 'redis://localhost'
                  NODE_OPTIONS: '--max_old_space_size=4096'
                  SHARD_INDEX: ${{ matrix.shard }}
                  SHARD_COUNT: ${{ matrix.shard_count }}
                  LOG_LEVEL: ${{ runner.debug == '1' && 'info' || 'error' }}
                  # Emit JUnit XML for the Trunk upload below.
                  JEST_JUNIT_OUTPUT_DIR: ${{ github.workspace }}/junit-results
                  JEST_JUNIT_OUTPUT_NAME: junit-nodejs-${{ matrix.lane }}-${{ matrix.shard }}.xml
                  # Trunk attributes flakes by test file; jest-junit's default suite name is the
                  # describe block, so make it the file path instead.
                  JEST_JUNIT_SUITE_NAME: '{filepath}'
                  JEST_JUNIT_ADD_FILE_ATTRIBUTE: 'true'
                  # New compileHog callers must generate and commit their source-addressed fixture.
                  HOG_BYTECODE_CACHE_REQUIRED: 'true'
                  TEST_MODE: ${{ needs.changes.outputs.test_mode }}
                  TEST_FILES: ${{ needs.changes.outputs.test_files }}
              run: |
                  if [ -f nodejs/jest.serial.config.js ]; then
                    # In selective mode append --findRelatedTests to the package script, which
                    # already carries --shard and --testPathIgnorePatterns. jest resolves the
                    # related set first and shards that, so the shards stay disjoint.
                    # --passWithNoTests because a shard can legitimately receive nothing once
                    # the set is narrowed; the serial script does not set it itself.
                    #
                    # No `--` before the appended flags. pnpm forwards the separator itself into
                    # the script's argv, and jest reads everything after a `--` as a test path
                    # pattern, so the flags arrive as patterns that match nothing. The serial lane
                    # then exits 1 on "No tests found", and the parallel lane exits 0 because its
                    # script already carries --passWithNoTests, reporting green over an empty run.
                    if [ "$TEST_MODE" = "selective" ]; then
                      # shellcheck disable=SC2086
                      cd nodejs && pnpm run test:${{ matrix.lane }} --passWithNoTests --findRelatedTests $TEST_FILES
                    else
                      cd nodejs && pnpm run test:${{ matrix.lane }}
                    fi
                  elif [ "${{ matrix.lane }}" = 'serial' ]; then
                    bin/turbo run test --filter=@posthog/nodejs
                  else
                    echo "Parallel Jest config is not present on this branch; skipping."
                  fi

            - name: Test postgres-parity (isolated DB)
              id: run-parity
              continue-on-error: true
              if: (success() || failure()) && matrix.lane == 'serial' && matrix.shard == 1
              env:
                  DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/test_posthog'
                  BEHAVIORAL_COHORTS_DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/test_behavioral_cohorts'
                  PERSONS_DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/test_persons_parity'
                  PERSONS_READONLY_DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/test_persons_parity'
                  REDIS_URL: 'redis://localhost'
                  NODE_OPTIONS: '--max_old_space_size=4096'
                  LOG_LEVEL: ${{ runner.debug == '1' && 'info' || 'error' }}
                  JEST_JUNIT_OUTPUT_DIR: ${{ github.workspace }}/junit-results
                  JEST_JUNIT_OUTPUT_NAME: junit-nodejs-postgres-parity.xml
                  JEST_JUNIT_SUITE_NAME: '{filepath}'
                  JEST_JUNIT_ADD_FILE_ATTRIBUTE: 'true'
              run: cd nodejs && pnpm run test:postgres-parity

            - name: Upload test results
              if: always()
              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
              with:
                  # Attempt-suffixed so a same-run re-run keeps attempt 1's artifact available
                  # for the recovery/failure correlation the signal job does. Retention 1 day:
                  # these are inputs to the signal and slow-test jobs, nothing long-lived.
                  # jest-junit's outputDir resolves against the jest process cwd, which is the
                  # workspace root for the turbo invocation but `nodejs/` if a shard ever runs
                  # jest directly; cover both.
                  # Lane-qualified: serial 1/3 and parallel 1/1 are both shard 1, and the
                  # artifact list returns one entry per name, so a lane-less name hides one.
                  name: junit-results-nodejs-${{ matrix.lane }}-${{ matrix.shard }}${{ github.run_attempt != '1' && format('-attempt{0}', github.run_attempt) || '' }}
                  path: |
                      junit-results/junit-nodejs-*.xml
                      junit-results/posthog-jest-quarantine-*.jsonl
                      nodejs/junit-results/junit-nodejs-*.xml
                      nodejs/junit-results/posthog-jest-quarantine-*.jsonl
                  if-no-files-found: ignore
                  retention-days: 1

            # Best-effort Trunk upload (continue-on-error); the "Fail on test failure" step below is
            # the verdict, so a Trunk outage can't red a passing shard. Internal PRs only (needs the
            # secret).
            # TRUNK_UPLOAD_ENABLED is the master kill-switch: when it is not 'true' this gate
            # skips, so nothing uploads and no known flakes are quarantined. TRUNK_QUARANTINE_ENABLED
            # splits the two — it defaults off, so set it to 'true' to let the verdict step below mask
            # known flakes; otherwise any real failure reds the job (quarantining needs upload on too).
            - name: Quarantine gate
              id: quarantine_gate
              continue-on-error: true
              if: ${{ !cancelled() && env.RUNS_ON_INTERNAL_PR == 'true' && github.repository == 'PostHog/posthog' && github.actor != 'dependabot[bot]' && vars.TRUNK_UPLOAD_ENABLED == 'true' }}
              uses: ./.github/actions/trunk-quarantine-gate
              with:
                  junit-paths: junit-results/junit-*.xml
                  # Worst of the two test steps: the gate must know the run failed even when
                  # only the parity step (shard 1) did. A skipped parity step counts as success.
                  previous-step-outcome: ${{ (steps.run-jest.outcome == 'failure' || steps.run-parity.outcome == 'failure') && 'failure' || 'success' }}
                  token: ${{ secrets.TRUNK_API_TOKEN }}

            # Verdict: red a real failure the gate didn't clear as a quarantined flake. != 'success'
            # also covers the skipped gate on fork/Dependabot. Sits before the logs-on-failure step
            # so a real failure still triggers it via failure().
            - name: Fail on test failure
              if: ${{ !cancelled() && (steps.run-jest.outcome == 'failure' || steps.run-parity.outcome == 'failure') && (vars.TRUNK_QUARANTINE_ENABLED != 'true' || steps.quarantine_gate.outcome != 'success') }}
              shell: bash
              run: exit 1

            - name: Output logs on failure
              if: failure()
              run: |
                  docker compose -f docker-compose.dev.yml logs clickhouse
                  # Echo out the logs stored in the container
                  docker compose -f docker-compose.dev.yml exec clickhouse cat /var/log/clickhouse-server/clickhouse-server.err.log

    rust_ingestion_e2e:
        # Not on master push — master coverage comes from the hourly run (see `schedule`).
        if: needs.changes.outputs.nodejs == 'true' && github.event_name != 'push'
        name: Rust ingestion consumer Node API e2e (depot-ubuntu-24.04-4)
        needs: changes
        runs-on: depot-ubuntu-24.04-4
        timeout-minutes: 30
        env:
            DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USER }}
            DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
            REDIS_URL: 'redis://localhost'
            CLICKHOUSE_HOST: 'localhost'
            CLICKHOUSE_DATABASE: 'posthog_test'
            KAFKA_HOSTS: 'kafka:9092'
        steps:
            - name: Code check out
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  clean: false

            - name: Clean up data directories with container permissions
              run: |
                  # Use docker to clean up files created by containers
                  [ -d "data" ] && docker run --rm -v "$(pwd)/data:/data" alpine sh -c "rm -rf /data/seaweedfs /data/minio" || true
              continue-on-error: true

            - name: Log in to Docker Hub
              continue-on-error: true
              if: ${{ env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }}
              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
              with:
                  username: ${{ vars.DOCKERHUB_USER }}
                  password: ${{ secrets.DOCKERHUB_TOKEN }}

            - name: Stop/Start stack with Docker Compose
              env:
                  COMPOSE_FILE: docker-compose.dev.yml:docker-compose.profiles.yml
                  COMPOSE_PROFILES: dev_tools
                  WAIT_FOR_DOCKER_LAUNCH_RETRIES: 3
                  WAIT_FOR_DOCKER_LAUNCH_RETRY_DELAY: 5
              run: |
                  bin/ci-wait-for-docker launch --down

            - name: Wait for Docker services
              env:
                  COMPOSE_FILE: docker-compose.dev.yml:docker-compose.profiles.yml
                  COMPOSE_PROFILES: dev_tools
              run: bin/ci-wait-for-docker wait

            - name: Add service hostnames to /etc/hosts
              run: echo "127.0.0.1 db redis7 kafka clickhouse clickhouse-coordinator objectstorage seaweedfs temporal" | sudo tee -a /etc/hosts

            - name: Mint setup-action GitHub token
              id: setup-gh-token
              if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
              continue-on-error: true
              uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
              with:
                  client-id: ${{ vars.GH_APP_POSTHOG_SETUP_ACTIONS_APP_ID }}
                  private-key: ${{ secrets.GH_APP_POSTHOG_SETUP_ACTIONS_PRIVATE_KEY }}
                  skip-token-revoke: true

            - name: Set up Python
              uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
              with:
                  python-version-file: 'pyproject.toml'
                  token: ${{ steps.setup-gh-token.outputs.token || github.token }}

            - name: Install uv
              id: setup-uv
              uses: ./.github/actions/setup-uv

            - name: Install rust
              uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
              with:
                  toolchain: 1.91.1

            - name: Set sccache WebDAV key prefix (Cargo.lock hash)
              run: echo "SCCACHE_WEBDAV_KEY_PREFIX=cargo-${{ hashFiles('rust/Cargo.lock') }}" >> "$GITHUB_ENV"

            - name: Install sccache
              uses: ./.github/actions/setup-sccache

            - name: Cache Rust dependencies
              uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
              with:
                  shared-key: 'v2-rust-nodejs'
                  workspaces: rust
                  save-if: ${{ github.ref == 'refs/heads/master' }}

            - name: Install sqlx-cli
              uses: ./.github/actions/setup-sqlx-cli

            - name: Install SAML (python3-saml) dependencies
              if: steps.setup-uv.outputs.cache-hit != 'true'
              run: |
                  sudo rm -f /etc/apt/sources.list.d/*twingate*
                  sudo apt-get update
                  sudo apt-get install libxml2-dev libxmlsec1-dev libxmlsec1-openssl

            - name: Install python dependencies
              run: |
                  UV_PROJECT_ENVIRONMENT=$pythonLocation uv sync --frozen --dev

            - name: Download MaxMind Database
              run: |
                  ./bin/download-mmdb

            - name: Install pnpm dependencies
              uses: ./.github/actions/pnpm-install
              with:
                  install-command: pnpm --filter=@posthog/nodejs... install --frozen-lockfile
                  token: ${{ steps.setup-gh-token.outputs.token || github.token }}

            - name: Wait for Clickhouse, Redis, Kafka
              run: docker compose -f docker-compose.dev.yml up kafka redis7 clickhouse maildev -d --wait

            - name: Create Kafka topics
              run: docker compose -f docker-compose.dev.yml up kafka-init

            - name: Fetch base branch for diff
              if: github.event_name == 'pull_request'
              env:
                  BASE_REF: ${{ github.base_ref }}
              run: git fetch origin "$BASE_REF" --depth=1

            - name: Check for migrations in this PR
              id: check_migrations
              if: github.event_name == 'pull_request'
              env:
                  BASE_REF: ${{ github.base_ref }}
              run: |
                  if git diff --name-only "origin/$BASE_REF..HEAD" | grep -E '(migrations/|rust/.*migrate)'; then
                    echo "has_migrations=true" >> $GITHUB_OUTPUT
                  else
                    echo "has_migrations=false" >> $GITHUB_OUTPUT
                  fi

            - name: Set up databases (fast path - restore schema)
              if: github.event_name == 'pull_request' && steps.check_migrations.outputs.has_migrations == 'false'
              env:
                  TEST: 'true'
                  SECRET_KEY: 'abcdef' # unsafe - for testing only
                  DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/posthog'
                  BEHAVIORAL_COHORTS_DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/test_behavioral_cohorts'
                  # Downloading an artifact requires the Actions permission, which the setup-actions app does not hold
                  GH_TOKEN: ${{ github.token }}
              run: |
                  # Download pre-migrated schema from CI
                  ./bin/hogli db:download-schema

                  # Create test databases
                  docker compose -f docker-compose.dev.yml exec -T db psql -U posthog -c "DROP DATABASE IF EXISTS test_posthog;"
                  docker compose -f docker-compose.dev.yml exec -T db psql -U posthog -c "CREATE DATABASE test_posthog;"

                  # Restore schema to test database
                  echo "Restoring schema to test_posthog database..."
                  gunzip -c .postgres-backups/schema-latest.sql.gz | docker compose -f docker-compose.dev.yml exec -T db psql -q -U posthog test_posthog
                  echo "✅ Schema restored"

                  # Run Rust migrations for test databases
                  cd nodejs && pnpm run setup:test:rust

                  # Set up ClickHouse test database and schema
                  cd .. && TEST=1 SECRET_KEY='abcdef' python manage.py setup_test_environment --only-clickhouse

            - name: Set up databases (slow path - run migrations)
              if: github.event_name != 'pull_request' || steps.check_migrations.outputs.has_migrations == 'true'
              env:
                  TEST: 'true'
                  SECRET_KEY: 'abcdef' # unsafe - for testing only
                  DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/posthog'
                  BEHAVIORAL_COHORTS_DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/test_behavioral_cohorts'
              run: pnpm --filter=@posthog/nodejs setup:test

            # The Node ingestion API worker runs as a real subprocess (tsx src/index.ts), so it
            # needs the compiled workspace dependencies (e.g. @posthog/hogvm/dist) on disk. The
            # regular Jest job gets these via `bin/turbo run test` (^build); here we build them
            # explicitly since we invoke the test directly.
            - name: Build Node.js workspace dependencies
              run: bin/turbo --filter=@posthog/nodejs prepare

            # ingestion-consumer depends on ingestion-worker-proto, whose build script runs protoc.
            - name: Install protoc
              uses: ./.github/actions/setup-protoc

            - name: Pre-build Rust ingestion consumer
              working-directory: rust
              run: cargo build -p ingestion-consumer

            - name: Test Rust ingestion consumer with Node ingestion API
              env:
                  DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/test_posthog'
                  BEHAVIORAL_COHORTS_DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/test_behavioral_cohorts'
                  PERSONS_DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/test_persons'
                  PERSONS_READONLY_DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/test_persons'
                  REDIS_URL: 'redis://localhost'
                  NODE_OPTIONS: '--max_old_space_size=4096'
                  LOG_LEVEL: ${{ runner.debug == '1' && 'info' || 'error' }}
              run: |
                  if [ -f nodejs/tests/service-e2e/rust-ingestion-consumer.serial.test.ts ] || [ -f nodejs/tests/service-e2e/rust-ingestion-consumer.test.ts ]; then
                    cd nodejs && pnpm run test:rust-ingestion-e2e
                  else
                    echo "Rust ingestion service e2e test is not present on this branch; skipping."
                  fi

            - name: Output logs on failure
              if: failure()
              run: |
                  docker compose -f docker-compose.dev.yml logs clickhouse
                  # Echo out the logs stored in the container
                  docker compose -f docker-compose.dev.yml exec clickhouse cat /var/log/clickhouse-server/clickhouse-server.err.log

    report-test-speed:
        name: Node.js test-speed report
        needs: [tests]
        runs-on: ubuntu-latest
        timeout-minutes: 10
        continue-on-error: true
        permissions:
            actions: read
            contents: read
        # Prints the per-shard/per-test slow-down breakdown to the job log and summary.
        # It runs only the PR's reporter against uploaded JUnit and has no write permissions.
        if: >-
            !cancelled() &&
            needs.tests.result != 'skipped' &&
            github.repository == 'PostHog/posthog' &&
            (
            (github.event_name != 'pull_request' && github.ref == 'refs/heads/master') ||
            (github.event_name == 'pull_request' &&
            github.event.pull_request.head.repo.full_name == 'PostHog/posthog')
            )
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
                  fetch-depth: 1
            - name: Check for trusted test reporter
              id: test-reporter
              shell: bash
              run: |
                  available=false
                  if [[ -f .github/scripts/report_test_timings.py && -f bin/report-jest-timings && -d tools/owners ]] && grep -q -- '--timings' .github/scripts/report_test_timings.py; then
                    available=true
                  fi
                  if [[ "$available" != "true" ]]; then
                    echo "Trusted timings reporter is not available on the checked-out ref; skipping speed report."
                  fi
                  echo "available=$available" >> "$GITHUB_OUTPUT"
            # Direct install: Timing updates target the PR head, which may predate the local action.
            - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
              if: steps.test-reporter.outputs.available == 'true'
              with:
                  version: '0.12.13'
            - name: Download Jest results
              if: steps.test-reporter.outputs.available == 'true'
              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
              with:
                  path: ./junit-artifacts
                  pattern: junit-results-nodejs-*
            - name: Render test-speed report
              if: steps.test-reporter.outputs.available == 'true'
              uses: ./.github/actions/report-jest-timings
              with:
                  artifacts: ./junit-artifacts

    # Jest-selection telemetry -> DevEx project (347861), alongside the equivalent
    # events for the backend (posthog-ci-test-selection), the frontend
    # (posthog-ci-jest-selection) and Playwright (posthog-ci-e2e-spec-selection).
    # Without it the fallback rate of this selector is only readable by opening runs
    # one at a time, and this workflow has no other telemetry.
    # Emitted on full runs too — the merge queue's trunk-merge/** run raises a
    # pull_request event, so `mode=full` there is the baseline selective runs are
    # measured against. This workflow captures no job durations, so a saving is read
    # off the tests job's own conclusion and the run in the Actions API, not from here.
    # Telemetry never reds CI (continue-on-error).
    # hogli-lint: not-a-required-gate — reads results to describe the run, gates nothing
    capture-nodejs-selection:
        name: Capture Node.js jest selection
        needs: [changes, tests]
        runs-on: ubuntu-latest
        timeout-minutes: 5
        # Nothing to report on a PR that never ran the suite. Forks and Dependabot never
        # have the secret.
        if: >-
            !cancelled() && github.run_attempt == '1'
            && github.event_name == 'pull_request'
            && github.actor != 'dependabot[bot]'
            && github.event.pull_request.head.repo.full_name == 'PostHog/posthog'
            && (needs.tests.result == 'success' || needs.tests.result == 'failure')
        steps:
            - name: Capture Node.js jest selection to DevEx PostHog
              continue-on-error: true
              uses: PostHog/posthog-github-action@58dea254b598fb5d469c0699c98af8288a7f7650 # v1.2.0
              with:
                  posthog-token: ${{ secrets.POSTHOG_DEVEX_PROJECT_API_TOKEN }}
                  event: 'posthog-ci-nodejs-selection'
                  properties: |
                      {
                        "mode": ${{ toJSON(needs.changes.outputs.test_mode) }},
                        "selected_file_count": ${{ needs.changes.outputs.test_file_count || 'null' }},
                        "full_run_reason_category": ${{ toJSON(needs.changes.outputs.test_reason || '') }},
                        "tests_result": ${{ toJSON(needs.tests.result) }},
                        "pr_draft": ${{ toJSON(github.event.pull_request.draft) }},
                        "merge_queue": ${{ startsWith(github.head_ref, 'trunk-merge/') }},
                        "event_type": ${{ toJSON(github.event.action) }},
                        "branch": ${{ toJSON(github.head_ref || github.ref_name) }},
                        "sha": ${{ toJSON(github.sha) }},
                        "pr_number": ${{ github.event.pull_request.number || 'null' }},
                        "run_id": ${{ toJSON(github.run_id) }}
                      }

    node_tests:
        # report-test-speed is deliberately not in needs: it is visible but non-gating.
        needs: [changes, tests, rust_ingestion_e2e, build, lint]
        name: Node.js Tests Pass
        runs-on: ubuntu-latest
        timeout-minutes: 5
        if: ${{ !cancelled() }}
        steps:
            - run: exit 0
            - name: Check outcomes
              run: |
                  # Change detection gates every job below. A failure there skips them all, and
                  # this gate reads a skip as a pass, so test its result directly.
                  if [[ "${{ needs.changes.result }}" != "success" && "${{ needs.changes.result }}" != "skipped" ]]; then
                    echo "Change detection did not succeed (result: ${{ needs.changes.result }})."
                    exit 1
                  fi
                  if [[ "${{ needs.tests.result }}" != "success" && "${{ needs.tests.result }}" != "skipped" ]]; then
                    echo "One or more jobs in the Node.js test matrix failed."
                    exit 1
                  fi
                  echo "All jobs in the Node.js test matrix passed."
                  if [[ "${{ needs.rust_ingestion_e2e.result }}" != "success" && "${{ needs.rust_ingestion_e2e.result }}" != "skipped" ]]; then
                    echo "Rust ingestion consumer Node API e2e failed."
                    exit 1
                  fi
                  echo "Rust ingestion consumer Node API e2e passed."
                  if [[ "${{ needs.build.result }}" != "success" && "${{ needs.build.result }}" != "skipped" ]]; then
                    echo "Node.js build failed."
                    exit 1
                  fi
                  echo "Node.js build passed."
                  if [[ "${{ needs.lint.result }}" != "success" && "${{ needs.lint.result }}" != "skipped" ]]; then
                    echo "Node.js lint failed."
                    exit 1
                  fi
                  echo "Node.js lint passed."