fix(ci): skip release instead of erroring when both fixtures are cached (#2036)

* fix(ci): skip release instead of erroring when both fixtures are cached (#2034)

map(select(.build)) yields an empty include list when both the iOS and
Android fingerprints already have a trusted artifact, and GitHub Actions
rejects an empty strategy.matrix at the workflow level -- so release was
never created and the run was marked failure on every push since #1996
merged. Publish has-work alongside matrix and gate release on it, so the
both-cached steady state now completes with release skipped instead of
erroring the whole workflow.

* test(ci): fold has-work regression into the existing fingerprint test

Reviewer feedback on #2036: the standalone four-case test duplicated the
harness above it and only two states are meaningful for this regression.
Reuse the same parsed workflow, temp dir, resolver stub, and Node stub;
keep neither-cached (both platforms, has-work=true) and both-cached
(empty matrix, has-work=false, release gated). Drops the single-cache
permutations, which exercise #1996's unchanged filtering rather than
this fix.

* test(ci): cover the single-cache matrix cardinality (#2036 review)

Reduced coverage to 0-cached and 2-cached, leaving the 1-cached
cardinality unchecked -- a mistaken \`length > 1\` in the has-work
check would pass while wrongly suppressing a valid single-platform
build. Generalize the Node stub to report caching per artifact-name
suffix and add the iOS-cached case to the same reused harness.

* test(ci): extract the has-work value instead of comparing raw output lines

Thermo-nuclear review: matrix was already parsed out of its GITHUB_OUTPUT
line (prefix stripped, JSON-parsed), but hasWork returned the raw
"has-work=true" line, so assertions compared against a redundant
'has-work=true' string instead of the actual value. Slice the prefix
the same way matrix does.

Author: thymikee

.github/workflows/test-app-build-cache.yml

@@ -33,6 +33,7 @@ jobs:
     timeout-minutes: 10
     outputs:
       matrix: ${{ steps.fingerprint.outputs.matrix }}
+      has-work: ${{ steps.fingerprint.outputs.has-work }}
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -94,10 +95,12 @@ jobs:
               }
             ] | { include: map(select(.build)) }')"
           echo "matrix=$MATRIX" >> "$GITHUB_OUTPUT"
+          echo "has-work=$(jq -r '.include | length > 0' <<<"$MATRIX")" >> "$GITHUB_OUTPUT"
 
   release:
     name: ${{ matrix.name }}
     needs: fingerprint
+    if: needs.fingerprint.outputs.has-work == 'true'
     runs-on: ${{ matrix.runsOn }}
     timeout-minutes: 60
     concurrency:

test/ci/trusted-fixture-artifact.test.mjs

@@ -305,14 +305,22 @@ test('Android APK repack signs the output and preserves its package id', (t) =>
   assert.match(mismatch.stderr, /did not preserve the source signing certificate/);
 });
 
-test('producer maps each platform to its resolved lookup and matrix artifact name', (t) => {
+test('producer maps each platform to its resolved lookup and matrix artifact name, and gates has-work when both are cached', (t) => {
   const workflow = parse(fs.readFileSync('.github/workflows/test-app-build-cache.yml', 'utf8'));
   const fingerprintStep = workflow.jobs.fingerprint.steps.find((step) => step.id === 'fingerprint');
+  // #2034: an empty `include` matrix is legal JSON but GitHub Actions rejects it as
+  // `strategy.matrix`, so `release` must be skipped -- not handed a zero-length
+  // matrix -- whenever both fixtures are already cached.
+  assert.equal(
+    workflow.jobs.fingerprint.outputs['has-work'],
+    '${{ steps.fingerprint.outputs.has-work }}',
+  );
+  assert.equal(workflow.jobs.release.if, "needs.fingerprint.outputs.has-work == 'true'");
+
   const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'fixture-producer-name-'));
   t.after(() => fs.rmSync(tempRoot, { force: true, recursive: true }));
   const actionDir = path.join(tempRoot, '.github/actions/setup-fixture-app');
   const binDir = path.join(tempRoot, 'bin');
-  const outputPath = path.join(tempRoot, 'output');
   const resolverLog = path.join(tempRoot, 'resolver-calls');
   const nodeLog = path.join(tempRoot, 'node-calls');
   fs.mkdirSync(actionDir, { recursive: true });
@@ -326,43 +334,79 @@ test('producer maps each platform to its resolved lookup and matrix artifact nam
       '',
     ].join('\n'),
   );
-  fs.writeFileSync(
-    path.join(binDir, 'node'),
-    ['#!/bin/sh', 'printf "%s\\n" "$*" >> "$TEST_NODE_LOG"', ''].join('\n'),
-  );
+  // cachedPlatforms: which platform artifact-name suffixes (".ios", ".android")
+  // the lookup should report as already cached.
+  const writeNodeStub = (cachedPlatforms) =>
+    fs.writeFileSync(
+      path.join(binDir, 'node'),
+      [
+        '#!/bin/sh',
+        'printf "%s\\n" "$*" >> "$TEST_NODE_LOG"',
+        'case "$4" in',
+        ...cachedPlatforms.map((platform) => `  *.${platform}) printf "111" ;;`),
+        '  *) true ;;',
+        'esac',
+        '',
+      ].join('\n'),
+    );
+  writeNodeStub([]);
   fs.chmodSync(path.join(binDir, 'node'), 0o755);
+
   const run = fingerprintStep.run
     .replaceAll('${{ github.event.pull_request.head.sha || github.sha }}', 'current-head')
     .replaceAll('${{ github.repository }}', 'octo/repo')
     .replaceAll('${{ github.event_name }}', 'pull_request')
     .replaceAll('${{ github.event.pull_request.head.repo.full_name }}', 'octo/repo');
-  const result = spawnSync('bash', ['-c', run], {
-    cwd: tempRoot,
-    encoding: 'utf8',
-    env: {
-      ...process.env,
-      GITHUB_OUTPUT: outputPath,
-      PATH: `${binDir}:${process.env.PATH}`,
-      TEST_NODE_LOG: nodeLog,
-      TEST_RESOLVER_LOG: resolverLog,
-    },
-  });
-  assert.equal(result.status, 0, result.stderr);
-  const matrixLine = fs.readFileSync(outputPath, 'utf8').trim();
-  assert.match(matrixLine, /^matrix=/);
-  const matrix = JSON.parse(matrixLine.slice('matrix='.length));
+  const runFingerprint = (outputName) => {
+    const outputPath = path.join(tempRoot, outputName);
+    const result = spawnSync('bash', ['-c', run], {
+      cwd: tempRoot,
+      encoding: 'utf8',
+      env: {
+        ...process.env,
+        GITHUB_OUTPUT: outputPath,
+        PATH: `${binDir}:${process.env.PATH}`,
+        TEST_NODE_LOG: nodeLog,
+        TEST_RESOLVER_LOG: resolverLog,
+      },
+    });
+    assert.equal(result.status, 0, result.stderr);
+    const lines = fs.readFileSync(outputPath, 'utf8').trim().split('\n');
+    return {
+      hasWork: lines.find((line) => line.startsWith('has-work=')).slice('has-work='.length),
+      matrix: JSON.parse(lines.find((line) => line.startsWith('matrix=')).slice('matrix='.length)),
+    };
+  };
+
+  const neitherCached = runFingerprint('output-neither-cached');
   assert.deepEqual(
-    matrix.include.map(({ platform, artifactName }) => ({ platform, artifactName })),
+    neitherCached.matrix.include.map(({ platform, artifactName }) => ({ platform, artifactName })),
     [
       { platform: 'ios', artifactName: 'fingerprint.ios-hash.ios' },
       { platform: 'android', artifactName: 'fingerprint.android-hash.android' },
     ],
   );
+  assert.equal(neitherCached.hasWork, 'true');
   assert.deepEqual(fs.readFileSync(resolverLog, 'utf8').trim().split('\n'), ['ios', 'android']);
   assert.deepEqual(fs.readFileSync(nodeLog, 'utf8').trim().split('\n'), [
     '.github/actions/setup-fixture-app/trusted-artifact.mjs find octo/repo fingerprint.ios-hash.ios current-head',
     '.github/actions/setup-fixture-app/trusted-artifact.mjs find octo/repo fingerprint.android-hash.android current-head',
   ]);
+
+  // A mistaken `length > 1` in the has-work check would pass here while
+  // wrongly suppressing this valid single-platform build.
+  writeNodeStub(['ios']);
+  const iosCached = runFingerprint('output-ios-cached');
+  assert.deepEqual(
+    iosCached.matrix.include.map(({ platform }) => platform),
+    ['android'],
+  );
+  assert.equal(iosCached.hasWork, 'true');
+
+  writeNodeStub(['ios', 'android']);
+  const bothCached = runFingerprint('output-both-cached');
+  assert.deepEqual(bothCached.matrix, { include: [] });
+  assert.equal(bothCached.hasWork, 'false');
 });
 
 test('artifact name resolver scopes both platforms and rejects invalid output', (t) => {