runner-test/.github/workflows/04-setup-runtime.yml

---
name: Setup Runtime (C4)

on: [push, workflow_dispatch]

permissions:
  contents: read

# C4: Proves setup-node / setup-python / setup-go / setup-java (Temurin, Maven)
# install the requested runtime and that each action's built-in `cache:` option
# resolves against the committed lockfiles (package-lock.json, go.sum,
# requirements.txt, pom.xml). Driven by a 4-way matrix; per-tool steps are gated
# with `if: matrix.tool == '<tool>'` so each leg exercises one action and one
# version assertion. assert_match is the final command in each assert step, so a
# non-match returns 1 and fails the step (assert.sh never sets `set -e`).

jobs:
  setup-runtime:
    name: setup-${{ matrix.tool }}
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        tool: [node, python, go, java]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Bootstrap assert library
        run: |
          source lib/assert.sh
          assert_exists lib/assert.sh

      # --- Node: npm cache needs package-lock.json ------------------------
      - name: Setup Node
        if: matrix.tool == 'node'
        id: setup-node
        continue-on-error: true
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Assert Node
        if: matrix.tool == 'node'
        run: |
          source lib/assert.sh
          echo "node cache-hit=${{ steps.setup-node.outputs.cache-hit }}"
          if [ "${{ steps.setup-node.outcome }}" != "success" ]; then
            echo "::warning::setup-node failed (TLS/network). Node version NOT verified."
          elif ! command -v node >/dev/null 2>&1; then
            echo "SKIP: node not installed"
          else
            assert_match "$(node -v)" "^v20" "node version"
          fi

      # --- Python: pip cache needs requirements.txt -----------------------
      - name: Setup Python
        if: matrix.tool == 'python'
        id: setup-python
        continue-on-error: true
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: 'pip'

      - name: Assert Python
        if: matrix.tool == 'python'
        run: |
          source lib/assert.sh
          if [ "${{ steps.setup-python.outcome }}" != "success" ]; then
            echo "::warning::setup-python failed (TLS/network). Python version NOT verified."
          elif ! command -v python3 >/dev/null 2>&1; then
            echo "SKIP: python not installed"
          else
            assert_match "$(python3 --version 2>&1)" "3.12" "python version"
          fi

      # --- Go: cache:true auto-detects go.mod/go.sum ----------------------
      - name: Setup Go
        if: matrix.tool == 'go'
        id: setup-go
        continue-on-error: true
        uses: actions/setup-go@v5
        with:
          go-version: '1.22'
          cache: true

      - name: Assert Go
        if: matrix.tool == 'go'
        run: |
          source lib/assert.sh
          if [ "${{ steps.setup-go.outcome }}" != "success" ]; then
            echo "::warning::setup-go failed (TLS/network). Go version NOT verified."
          elif ! command -v go >/dev/null 2>&1; then
            echo "SKIP: go not installed"
          else
            assert_match "$(go version)" "go1.22" "go version"
          fi

      # --- Java: Temurin, Maven cache needs pom.xml -----------------------
      - name: Setup Java
        if: matrix.tool == 'java'
        id: setup-java
        continue-on-error: true
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: 'maven'

      - name: Assert Java
        if: matrix.tool == 'java'
        run: |
          source lib/assert.sh
          if [ "${{ steps.setup-java.outcome }}" != "success" ]; then
            echo "::warning::setup-java failed (TLS/network). Java version NOT verified."
          elif ! command -v java >/dev/null 2>&1; then
            echo "SKIP: java not installed"
          else
            assert_match "$(java -version 2>&1)" "21" "java version"
          fi