CI: add basic workflow (#27)

This adds a very basic CI workflow, running tests and compliance-tests.
Compliance tests currently don't all pass, so that's non-fatal.

The workflow will create a summary of the differences of passed/failed
compliance tests between main and the PR branch.

Notable side-quests: 
* ci: make test-compliance non-failure
* ComplianceSuite/Makefile: don't require rq and gsed

That'll make it run without a setup step on the Github runners.

* ci: use xcode-select method for swift version

   I have tried various other methods (docker image, setup-swift action),
   but each had its own problems. We can revisit this when setup-swift
   supports 6.2, or when this project can run its compliance tests on Linux.
   (The latter is an issue tracked elsewhere.)

Signed-off-by: Stephan Renatus <[email protected]>

Author: srenatus

.github/workflows/pull-request.yaml

@@ -0,0 +1,75 @@
+name: Check
+
+on:
+  workflow_dispatch: {}
+  pull_request: {}
+
+# When a new revision is pushed to a PR, cancel all in-progress CI runs for that
+# PR. See https://docs.github.com/en/actions/using-jobs/using-concurrency
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ci:
+    name: 'make all'
+    runs-on: macos-latest
+    permissions:
+      contents: read
+    steps:
+      - run: sudo xcode-select -s /Applications/Xcode_26.0.app
+      - run: swift --version
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - run: make all
+      - name: make fmt lint (ComplianceSuite)
+        run: make fmt lint
+        working-directory: ComplianceSuite
+      - run: make test-compliance || true # NB: This doesn't succeed yet!
+
+  diff:
+    name: diff compliance tests (vs main)
+    runs-on: macos-latest
+    permissions:
+      contents: read
+    steps:
+      - run: sudo xcode-select -s /Applications/Xcode_26.0.app
+      - run: swift --version
+      - name: checkout PR
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          path: pr/swift-opa
+          fetch-depth: 0 # fetch all history for all branches and tags
+      - name: checkout main
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          repository: open-policy-agent/swift-opa
+          ref: main
+          path: main/swift-opa
+      - name: compliance tests (main)
+        run: |
+          (make test-compliance || true) > results
+          ../../../pr/swift-opa/ComplianceSuite/tools/passed.sh < results > ../../../main-passed
+          ../../../pr/swift-opa/ComplianceSuite/tools/failed.sh < results > ../../../main-failed
+        working-directory: main/swift-opa/ComplianceSuite
+      - name: compliance tests (pr)
+        run: |
+          (make test-compliance || true) > results
+          ./tools/passed.sh < results > ../../../pr-passed
+          ./tools/failed.sh < results > ../../../pr-failed
+        working-directory: pr/swift-opa/ComplianceSuite
+      - name: summary diff
+        run: |
+          diff_and_print() {
+            local file1="$1"
+            local file2="$2"
+            local header="$3"
+
+            if ! diff -q "$file1" "$file2" > /dev/null 2>&1; then
+              echo "## $header"
+              echo '```diff'
+              diff "$file1" "$file2" || true
+              echo '```'
+            fi
+          }
+          diff_and_print main-passed pr-passed 'passed (main vs PR)' >> $GITHUB_STEP_SUMMARY
+          diff_and_print main-failed pr-failed 'failed (main vs PR)' >> $GITHUB_STEP_SUMMARY

ComplianceSuite/Makefile

@@ -23,17 +23,13 @@ test-compliance:
 test-failed:
 	@OPA_COMPLIANCE_TESTS="$(OPA_COMPLIANCE_TESTS)" \
 		swift test --filter ComplianceTests.ComplianceTests \
-		| rg '❌' | rg -v builtinNotFound \
-		| gsed -nre 's/.*❌ (.*) ->.*/\1/p' \
-		| sort | uniq
+		| ./tools/failed.sh
 
 .PHONY: test-passed
 test-passed:
 	@OPA_COMPLIANCE_TESTS="$(OPA_COMPLIANCE_TESTS)" \
 		swift test --filter ComplianceTests.ComplianceTests \
-		| rg '✅' \
-		| gsed -nre 's/.*✅ (.*) ->.*/\1/p' \
-		| sort | uniq
+		| ./tools/passed.sh
 
 .PHONY: clean
 clean:

ComplianceSuite/tools/failed.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+sed -n '/❌/ { /builtinUndefinedError/! s/.*❌ \(.*\) ->.*/\1/p; }' \
+  | sort | uniq

ComplianceSuite/tools/passed.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+sed -n '/✅/ { s/.*✅ \(.*\) ->.*/\1/p; }' \
+  | sort | uniq

Tests/RegoTests/IREvaluatorTests.swift

@@ -148,7 +148,8 @@ struct IREvaluatorTests {
 
     @Test(arguments: validTestCases)
     func testValidEvaluations(tc: TestCase) async throws {
-        var engine = OPA.Engine(bundlePaths: tc.sourceBundles.map({ OPA.Engine.BundlePath(name: $0.lastPathComponent, url: $0) }))
+        var engine = OPA.Engine(
+            bundlePaths: tc.sourceBundles.map({ OPA.Engine.BundlePath(name: $0.lastPathComponent, url: $0) }))
         let bufferTracer = OPA.Trace.BufferedQueryTracer(level: .full)
         let actual = try await engine.prepareForEvaluation(query: tc.query).evaluate(
             input: tc.input,
@@ -175,7 +176,8 @@ struct IREvaluatorTests {
 
     @Test(arguments: errorTestCases)
     func testInvalidEvaluations(tc: ErrorCase) async throws {
-        var engine = OPA.Engine(bundlePaths: tc.sourceBundles.map({ OPA.Engine.BundlePath(name: $0.lastPathComponent, url: $0) }))
+        var engine = OPA.Engine(
+            bundlePaths: tc.sourceBundles.map({ OPA.Engine.BundlePath(name: $0.lastPathComponent, url: $0) }))
 
         await #expect(Comment(rawValue: tc.description)) {
             let _ = try await engine.prepareForEvaluation(query: tc.query).evaluate(input: tc.input)