docs_tests.yml

name: Docs Code Tests

permissions:
  contents: read

on:
  schedule:
    # Run every Sunday at midnight CET
    - cron: "0 23 * * 6"
  push:
    # Only run when pushed to the testing-ci branch
    branches:
      - testing-ci
  workflow_dispatch:
    inputs:
      python_client_branch:
        description: 'Python client branch (leave empty to use pinned version from pyproject.toml)'
        required: false
        default: ''
      typescript_client_branch:
        description: 'TypeScript client branch (leave empty to use the workflow default below)'
        required: false
        default: ''
      java_client_branch:
        description: 'Java client branch (leave empty to use the workflow default below)'
        required: false
        default: ''
      csharp_client_branch:
        description: 'C# client branch (leave empty to use the workflow default below)'
        required: false
        default: ''

env:
  # Centralize versions for easier maintenance
  PYTHON_VERSION: "3.10"
  WEAVIATE_VERSION: "1.35.0"
  OLLAMA_VERSION: "0.9.6"
  CLIP_MODEL_TAG: "sentence-transformers-clip-ViT-B-32"
  KEYCLOAK_VERSION: "24.0.3"

jobs:
  test-agents:
    name: Test Agents
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up test environment
        uses: ./.github/actions/setup-test-env
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Record test start time
        run: echo "TEST_START_TIME=$(date +%s)" >> $GITHUB_ENV

      - name: Run tests
        id: run-tests
        continue-on-error: true
        env:
          DOCS_GITHUB_ENV: "true"
          # Weaviate connection settings
          WEAVIATE_URL: ${{ secrets.WEAVIATE_URL }}
          WEAVIATE_HOST: ${{ secrets.WEAVIATE_HOST }}
          WEAVIATE_HOSTNAME: ${{ secrets.WEAVIATE_HOSTNAME }}
          WEAVIATE_HTTP_HOST: ${{ secrets.WEAVIATE_HTTP_HOST }}
          WEAVIATE_GRPC_HOST: ${{ secrets.WEAVIATE_GRPC_HOST }}
          WEAVIATE_API_KEY: ${{ secrets.WEAVIATE_API_KEY }}
          WEAVIATE_LOCAL_API_KEY: ${{ secrets.WEAVIATE_LOCAL_API_KEY }}
          # API Keys
          COHERE_API_KEY: ${{ secrets.COHERE_API_KEY }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          HUGGINGFACE_API_KEY: ${{ secrets.HUGGINGFACE_API_KEY }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          # WCD credentials
          WCD_USERNAME: ${{ secrets.WCD_USERNAME }}
          WCD_PASSWORD: ${{ secrets.WCD_PASSWORD }}
        run: |
          echo "🧪 Running agents tests..."
          uv run pytest -m "agents" -v --tb=short --durations=10 -s --junitxml=pytest-results.xml
          echo "✅ Tests completed"

      - name: Handle test results
        if: always()
        uses: ./.github/actions/handle-test-results
        with:
          test-outcome: ${{ steps.run-tests.outcome }}
          test-type: 'Agents'
          languages-tested: 'Python, TypeScript'
          slack-bot-token: ${{ secrets.TESTING_CI_SLACK_BOT }}

  test-python:
    name: Test Python
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Free disk space
        run: |
          sudo rm -rf /usr/share/dotnet &
          sudo rm -rf /opt/ghc &
          sudo rm -rf /usr/local/share/boost &
          sudo rm -rf "$AGENT_TOOLSDIRECTORY" &
          sudo rm -rf /usr/local/lib/android &
          sudo rm -rf /usr/local/share/powershell &
          sudo rm -rf /usr/local/share/chromium &
          wait

      - name: Set up test environment
        uses: ./.github/actions/setup-test-env
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Override Python client branch
        if: ${{ inputs.python_client_branch != '' }}
        run: |
          echo "📦 Installing weaviate-client from branch: ${{ inputs.python_client_branch }}"
          uv pip install --reinstall "git+https://github.com/weaviate/weaviate-python-client.git@${{ inputs.python_client_branch }}"
          echo "✅ Branch override installed"

      - name: Start services
        run: |
          echo "🚀 Starting Weaviate and Ollama services..."
          mkdir -p ~/.ollama
          ./tests/start-weaviate.sh

          sleep 5
          echo "✅ Services started:"
          docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"

      - name: Ensure Ollama models are available
        run: |
          echo "🤖 Checking Ollama models..."
          for model in snowflake-arctic-embed nomic-embed-text llama3.2; do
            if ! docker exec tests-ollama-1 ollama list 2>/dev/null | grep -q "$model"; then
              echo "⬇️ Pulling model: $model"
              docker exec tests-ollama-1 ollama pull "$model"
            fi
          done
          echo "✅ All models ready"

      - name: Wait for all services to be ready
        run: |
          echo "⏳ Waiting for services to be ready..."

          declare -A services=(
            ["8099"]="Weaviate Main"
            ["8580"]="Weaviate RBAC"
            ["8080"]="Weaviate Instance 1"
            ["8090"]="Weaviate Instance 2"
            ["8280"]="Weaviate Instance 3"
            ["8180"]="Weaviate Instance 4"
            ["8181"]="Weaviate Instance 5"
            ["8182"]="Weaviate Instance 6"
          )

          for port in "${!services[@]}"; do
            service_name="${services[$port]}"
            echo -n "Checking $service_name (port $port)... "

            if timeout 60 bash -c "until curl -sf http://localhost:$port/v1/.well-known/ready &>/dev/null; do sleep 2; done"; then
              echo "✅ Ready"
            else
              echo "⚠️ Not responding (may be optional)"
            fi
          done

          echo "✅ Service check completed"

      - name: Configure Keycloak
        run: |
          echo "🔧 Configuring Keycloak..."

          # OIDC tokens are issued with iss=http://keycloak:8081/... (the
          # docker-internal hostname, set via KC_HOSTNAME). Clients running
          # on the runner host need to resolve that name too — the C# and
          # Java clients fetch /.well-known/openid-configuration which
          # points at the keycloak: hostname.
          echo "127.0.0.1 keycloak" | sudo tee -a /etc/hosts

          sleep 5
          uv run python _includes/code/python/keycloak_helper_script.py

          echo "🔑 Obtaining OIDC bearer token..."
          TOKEN_JSON=$(curl -sf -X POST \
            "http://localhost:8081/realms/weaviate-test/protocol/openid-connect/token" \
            -d "grant_type=password" \
            -d "client_id=weaviate" \
            -d "client_secret=weaviate-client-secret-123" \
            -d "username=test-admin" \
            -d "password=password123" \
            -d "scope=openid")
          ACCESS_TOKEN=$(echo "$TOKEN_JSON" | python3 -c "import json,sys; print(json.load(sys.stdin)['access_token'])")
          EXPIRES_IN=$(echo "$TOKEN_JSON" | python3 -c "import json,sys; print(json.load(sys.stdin).get('expires_in', 60))")
          echo "::add-mask::$ACCESS_TOKEN"
          echo "WEAVIATE_OIDC_ACCESS_TOKEN=$ACCESS_TOKEN" >> $GITHUB_ENV
          echo "WEAVIATE_OIDC_EXPIRES_IN=$EXPIRES_IN" >> $GITHUB_ENV

          echo "✅ Keycloak configuration completed"

      - name: Record test start time
        run: echo "TEST_START_TIME=$(date +%s)" >> $GITHUB_ENV

      - name: Run Python tests
        id: run-tests
        continue-on-error: true
        env:
          DOCS_GITHUB_ENV: "true"
          WEAVIATE_URL: ${{ secrets.WEAVIATE_URL }}
          WEAVIATE_HOST: ${{ secrets.WEAVIATE_HOST }}
          WEAVIATE_HOSTNAME: ${{ secrets.WEAVIATE_HOSTNAME }}
          WEAVIATE_HTTP_HOST: ${{ secrets.WEAVIATE_HTTP_HOST }}
          WEAVIATE_GRPC_HOST: ${{ secrets.WEAVIATE_GRPC_HOST }}
          WEAVIATE_API_KEY: ${{ secrets.WEAVIATE_API_KEY }}
          WEAVIATE_LOCAL_API_KEY: ${{ secrets.WEAVIATE_LOCAL_API_KEY }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          COHERE_API_KEY: ${{ secrets.COHERE_API_KEY }}
          HUGGINGFACE_API_KEY: ${{ secrets.HUGGINGFACE_API_KEY }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          WCD_USERNAME: ${{ secrets.WCD_USERNAME }}
          WCD_PASSWORD: ${{ secrets.WCD_PASSWORD }}
        run: |
          echo "🧪 Running Python tests..."
          uv run pytest -m "(pyv4 or pyv3) and not agents" -v --tb=short --durations=10 -s --junitxml=pytest-results.xml
          echo "✅ Tests completed"

      - name: Handle test results
        if: always()
        uses: ./.github/actions/handle-test-results
        with:
          test-outcome: ${{ steps.run-tests.outcome }}
          test-type: 'Python'
          languages-tested: 'Python'
          slack-bot-token: ${{ secrets.TESTING_CI_SLACK_BOT }}

      - name: Stop services
        if: always()
        run: |
          echo "🛑 Stopping services..."
          ./tests/stop-weaviate.sh 2>/dev/null || echo "⚠️ Some services may have already stopped"

      - name: Cleanup Docker resources
        if: always()
        run: |
          for compose_file in tests/docker-compose*.yml; do
            if [[ -f "$compose_file" ]]; then
              docker compose -f "$compose_file" down -v --remove-orphans 2>/dev/null || true
            fi
          done
          docker system prune -f --volumes 2>/dev/null || true

  test-typescript:
    name: Test TypeScript
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Free disk space
        run: |
          sudo rm -rf /usr/share/dotnet &
          sudo rm -rf /opt/ghc &
          sudo rm -rf /usr/local/share/boost &
          sudo rm -rf "$AGENT_TOOLSDIRECTORY" &
          sudo rm -rf /usr/local/lib/android &
          wait

      - name: Set up test environment
        uses: ./.github/actions/setup-test-env
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Override TypeScript client branch
        run: |
          TS_BRANCH="${{ inputs.typescript_client_branch || 'v3.13.1' }}"
          echo "📦 Building weaviate-client from branch: $TS_BRANCH"
          git clone --depth 1 -b "$TS_BRANCH" https://github.com/weaviate/typescript-client.git /tmp/ts-client
          cd /tmp/ts-client
          npm install
          npm run build
          # `yarn add file:` won't replace node_modules/weaviate-client when a
          # peer dep (weaviate-agents) pins the same registry version, so the
          # registry tarball wins. Use `yarn link` to force a symlink instead.
          yarn link
          cd "$GITHUB_WORKSPACE"
          yarn link weaviate-client
          echo "✅ Branch override linked"

      - name: Start services
        run: |
          echo "🚀 Starting Weaviate and Ollama services..."
          mkdir -p ~/.ollama
          ./tests/start-weaviate.sh

          sleep 5
          echo "✅ Services started:"
          docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"

      - name: Ensure Ollama models are available
        run: |
          echo "🤖 Checking Ollama models..."
          for model in snowflake-arctic-embed nomic-embed-text llama3.2; do
            if ! docker exec tests-ollama-1 ollama list 2>/dev/null | grep -q "$model"; then
              echo "⬇️ Pulling model: $model"
              docker exec tests-ollama-1 ollama pull "$model"
            fi
          done
          echo "✅ All models ready"

      - name: Wait for all services to be ready
        run: |
          echo "⏳ Waiting for services to be ready..."

          declare -A services=(
            ["8099"]="Weaviate Main"
            ["8580"]="Weaviate RBAC"
            ["8080"]="Weaviate Instance 1"
            ["8090"]="Weaviate Instance 2"
            ["8280"]="Weaviate Instance 3"
            ["8180"]="Weaviate Instance 4"
            ["8181"]="Weaviate Instance 5"
            ["8182"]="Weaviate Instance 6"
          )

          for port in "${!services[@]}"; do
            service_name="${services[$port]}"
            echo -n "Checking $service_name (port $port)... "

            if timeout 60 bash -c "until curl -sf http://localhost:$port/v1/.well-known/ready &>/dev/null; do sleep 2; done"; then
              echo "✅ Ready"
            else
              echo "⚠️ Not responding (may be optional)"
            fi
          done

          echo "✅ Service check completed"

      - name: Configure Keycloak
        run: |
          echo "🔧 Configuring Keycloak..."

          # OIDC tokens are issued with iss=http://keycloak:8081/... (the
          # docker-internal hostname, set via KC_HOSTNAME). Clients running
          # on the runner host need to resolve that name too — the C# and
          # Java clients fetch /.well-known/openid-configuration which
          # points at the keycloak: hostname.
          echo "127.0.0.1 keycloak" | sudo tee -a /etc/hosts

          sleep 5
          uv run python _includes/code/python/keycloak_helper_script.py

          echo "🔑 Obtaining OIDC bearer token..."
          TOKEN_JSON=$(curl -sf -X POST \
            "http://localhost:8081/realms/weaviate-test/protocol/openid-connect/token" \
            -d "grant_type=password" \
            -d "client_id=weaviate" \
            -d "client_secret=weaviate-client-secret-123" \
            -d "username=test-admin" \
            -d "password=password123" \
            -d "scope=openid")
          ACCESS_TOKEN=$(echo "$TOKEN_JSON" | python3 -c "import json,sys; print(json.load(sys.stdin)['access_token'])")
          EXPIRES_IN=$(echo "$TOKEN_JSON" | python3 -c "import json,sys; print(json.load(sys.stdin).get('expires_in', 60))")
          echo "::add-mask::$ACCESS_TOKEN"
          echo "WEAVIATE_OIDC_ACCESS_TOKEN=$ACCESS_TOKEN" >> $GITHUB_ENV
          echo "WEAVIATE_OIDC_EXPIRES_IN=$EXPIRES_IN" >> $GITHUB_ENV

          echo "✅ Keycloak configuration completed"

      - name: Record test start time
        run: echo "TEST_START_TIME=$(date +%s)" >> $GITHUB_ENV

      - name: Run TypeScript tests
        id: run-tests
        continue-on-error: true
        env:
          DOCS_GITHUB_ENV: "true"
          WEAVIATE_URL: ${{ secrets.WEAVIATE_URL }}
          WEAVIATE_HOST: ${{ secrets.WEAVIATE_HOST }}
          WEAVIATE_HOSTNAME: ${{ secrets.WEAVIATE_HOSTNAME }}
          WEAVIATE_HTTP_HOST: ${{ secrets.WEAVIATE_HTTP_HOST }}
          WEAVIATE_GRPC_HOST: ${{ secrets.WEAVIATE_GRPC_HOST }}
          WEAVIATE_API_KEY: ${{ secrets.WEAVIATE_API_KEY }}
          WEAVIATE_LOCAL_API_KEY: ${{ secrets.WEAVIATE_LOCAL_API_KEY }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          COHERE_API_KEY: ${{ secrets.COHERE_API_KEY }}
          HUGGINGFACE_API_KEY: ${{ secrets.HUGGINGFACE_API_KEY }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          WCD_USERNAME: ${{ secrets.WCD_USERNAME }}
          WCD_PASSWORD: ${{ secrets.WCD_PASSWORD }}
        run: |
          echo "🧪 Running TypeScript tests..."
          uv run pytest -m "ts and not agents" -v --tb=short --durations=10 -s --junitxml=pytest-results.xml
          echo "✅ Tests completed"

      - name: Handle test results
        if: always()
        uses: ./.github/actions/handle-test-results
        with:
          test-outcome: ${{ steps.run-tests.outcome }}
          test-type: 'TypeScript'
          languages-tested: 'TypeScript'
          slack-bot-token: ${{ secrets.TESTING_CI_SLACK_BOT }}

      - name: Stop services
        if: always()
        run: |
          echo "🛑 Stopping services..."
          ./tests/stop-weaviate.sh 2>/dev/null || echo "⚠️ Some services may have already stopped"

      - name: Cleanup Docker resources
        if: always()
        run: |
          for compose_file in tests/docker-compose*.yml; do
            if [[ -f "$compose_file" ]]; then
              docker compose -f "$compose_file" down -v --remove-orphans 2>/dev/null || true
            fi
          done
          docker system prune -f --volumes 2>/dev/null || true

  test-java:
    name: Test Java
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Free disk space
        run: |
          sudo rm -rf /usr/share/dotnet &
          sudo rm -rf /opt/ghc &
          sudo rm -rf /usr/local/share/boost &
          sudo rm -rf "$AGENT_TOOLSDIRECTORY" &
          sudo rm -rf /usr/local/lib/android &
          wait

      - name: Set up test environment
        uses: ./.github/actions/setup-test-env
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: 'maven'

      - name: Clone and build Java client SNAPSHOT
        run: |
          JAVA_BRANCH="${{ inputs.java_client_branch || '6.3.0' }}"
          echo "📦 Building Java client SNAPSHOT from branch: $JAVA_BRANCH"
          git clone --depth 1 -b "$JAVA_BRANCH" https://github.com/weaviate/java-client.git /tmp/java-client
          cd /tmp/java-client
          mvn install -DskipTests -Dmaven.javadoc.skip=true -q
          echo "✅ Java client SNAPSHOT installed"

      - name: Start services
        run: |
          echo "🚀 Starting Weaviate and Ollama services..."
          mkdir -p ~/.ollama
          ./tests/start-weaviate.sh

          sleep 5
          echo "✅ Services started:"
          docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"

      - name: Ensure Ollama models are available
        run: |
          echo "🤖 Checking Ollama models..."
          for model in snowflake-arctic-embed nomic-embed-text llama3.2; do
            if ! docker exec tests-ollama-1 ollama list 2>/dev/null | grep -q "$model"; then
              echo "⬇️ Pulling model: $model"
              docker exec tests-ollama-1 ollama pull "$model"
            fi
          done
          echo "✅ All models ready"

      - name: Wait for all services to be ready
        run: |
          echo "⏳ Waiting for services to be ready..."

          declare -A services=(
            ["8099"]="Weaviate Main"
            ["8580"]="Weaviate RBAC"
            ["8080"]="Weaviate Instance 1"
            ["8090"]="Weaviate Instance 2"
            ["8280"]="Weaviate Instance 3"
            ["8180"]="Weaviate Instance 4"
            ["8181"]="Weaviate Instance 5"
            ["8182"]="Weaviate Instance 6"
          )

          for port in "${!services[@]}"; do
            service_name="${services[$port]}"
            echo -n "Checking $service_name (port $port)... "

            if timeout 60 bash -c "until curl -sf http://localhost:$port/v1/.well-known/ready &>/dev/null; do sleep 2; done"; then
              echo "✅ Ready"
            else
              echo "⚠️ Not responding (may be optional)"
            fi
          done

          echo "✅ Service check completed"

      - name: Configure Keycloak
        run: |
          echo "🔧 Configuring Keycloak..."

          # OIDC tokens are issued with iss=http://keycloak:8081/... (the
          # docker-internal hostname, set via KC_HOSTNAME). Clients running
          # on the runner host need to resolve that name too — the C# and
          # Java clients fetch /.well-known/openid-configuration which
          # points at the keycloak: hostname.
          echo "127.0.0.1 keycloak" | sudo tee -a /etc/hosts

          sleep 5
          uv run python _includes/code/python/keycloak_helper_script.py

          echo "🔑 Obtaining OIDC bearer token..."
          TOKEN_JSON=$(curl -sf -X POST \
            "http://localhost:8081/realms/weaviate-test/protocol/openid-connect/token" \
            -d "grant_type=password" \
            -d "client_id=weaviate" \
            -d "client_secret=weaviate-client-secret-123" \
            -d "username=test-admin" \
            -d "password=password123" \
            -d "scope=openid")
          ACCESS_TOKEN=$(echo "$TOKEN_JSON" | python3 -c "import json,sys; print(json.load(sys.stdin)['access_token'])")
          EXPIRES_IN=$(echo "$TOKEN_JSON" | python3 -c "import json,sys; print(json.load(sys.stdin).get('expires_in', 60))")
          echo "::add-mask::$ACCESS_TOKEN"
          echo "WEAVIATE_OIDC_ACCESS_TOKEN=$ACCESS_TOKEN" >> $GITHUB_ENV
          echo "WEAVIATE_OIDC_EXPIRES_IN=$EXPIRES_IN" >> $GITHUB_ENV

          echo "✅ Keycloak configuration completed"

      - name: Record test start time
        run: echo "TEST_START_TIME=$(date +%s)" >> $GITHUB_ENV

      - name: Run Java tests
        id: run-tests
        continue-on-error: true
        env:
          DOCS_GITHUB_ENV: "true"
          WEAVIATE_URL: ${{ secrets.WEAVIATE_URL }}
          WEAVIATE_HOST: ${{ secrets.WEAVIATE_HOST }}
          WEAVIATE_HOSTNAME: ${{ secrets.WEAVIATE_HOSTNAME }}
          WEAVIATE_HTTP_HOST: ${{ secrets.WEAVIATE_HTTP_HOST }}
          WEAVIATE_GRPC_HOST: ${{ secrets.WEAVIATE_GRPC_HOST }}
          WEAVIATE_API_KEY: ${{ secrets.WEAVIATE_API_KEY }}
          WEAVIATE_LOCAL_API_KEY: ${{ secrets.WEAVIATE_LOCAL_API_KEY }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          COHERE_API_KEY: ${{ secrets.COHERE_API_KEY }}
          HUGGINGFACE_API_KEY: ${{ secrets.HUGGINGFACE_API_KEY }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          echo "🧪 Running Java tests..."
          uv run pytest -m "java" -v --tb=short --durations=10 -s --junitxml=pytest-results.xml
          echo "✅ Tests completed"

      - name: Handle test results
        if: always()
        uses: ./.github/actions/handle-test-results
        with:
          test-outcome: ${{ steps.run-tests.outcome }}
          test-type: 'Java'
          languages-tested: 'Java'
          slack-bot-token: ${{ secrets.TESTING_CI_SLACK_BOT }}

      - name: Stop services
        if: always()
        run: |
          echo "🛑 Stopping services..."
          ./tests/stop-weaviate.sh 2>/dev/null || echo "⚠️ Some services may have already stopped"

      - name: Cleanup Docker resources
        if: always()
        run: |
          for compose_file in tests/docker-compose*.yml; do
            if [[ -f "$compose_file" ]]; then
              docker compose -f "$compose_file" down -v --remove-orphans 2>/dev/null || true
            fi
          done
          docker system prune -f --volumes 2>/dev/null || true

  test-csharp:
    name: Test C#
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Free disk space
        run: |
          sudo rm -rf /opt/ghc &
          sudo rm -rf /usr/local/share/boost &
          sudo rm -rf "$AGENT_TOOLSDIRECTORY" &
          sudo rm -rf /usr/local/lib/android &
          wait

      - name: Set up test environment
        uses: ./.github/actions/setup-test-env
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Set up .NET 9.0
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '9.0.x'

      - name: Clone C# client
        run: |
          CSHARP_BRANCH="${{ inputs.csharp_client_branch || '1.1.1' }}"
          echo "📦 Cloning C# client from branch: $CSHARP_BRANCH"
          git clone --depth 1 -b "$CSHARP_BRANCH" https://github.com/weaviate/csharp-client.git "${{ github.workspace }}/../csharp-client"
          echo "✅ C# client cloned to $(realpath "${{ github.workspace }}/../csharp-client")"

      - name: Start services
        run: |
          echo "🚀 Starting Weaviate and Ollama services..."
          mkdir -p ~/.ollama
          ./tests/start-weaviate.sh

          sleep 5
          echo "✅ Services started:"
          docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"

      - name: Ensure Ollama models are available
        run: |
          echo "🤖 Checking Ollama models..."
          for model in snowflake-arctic-embed nomic-embed-text llama3.2; do
            if ! docker exec tests-ollama-1 ollama list 2>/dev/null | grep -q "$model"; then
              echo "⬇️ Pulling model: $model"
              docker exec tests-ollama-1 ollama pull "$model"
            fi
          done
          echo "✅ All models ready"

      - name: Wait for all services to be ready
        run: |
          echo "⏳ Waiting for services to be ready..."

          declare -A services=(
            ["8099"]="Weaviate Main"
            ["8580"]="Weaviate RBAC"
            ["8080"]="Weaviate Instance 1"
            ["8090"]="Weaviate Instance 2"
            ["8280"]="Weaviate Instance 3"
            ["8180"]="Weaviate Instance 4"
            ["8181"]="Weaviate Instance 5"
            ["8182"]="Weaviate Instance 6"
          )

          for port in "${!services[@]}"; do
            service_name="${services[$port]}"
            echo -n "Checking $service_name (port $port)... "

            if timeout 60 bash -c "until curl -sf http://localhost:$port/v1/.well-known/ready &>/dev/null; do sleep 2; done"; then
              echo "✅ Ready"
            else
              echo "⚠️ Not responding (may be optional)"
            fi
          done

          echo "✅ Service check completed"

      - name: Configure Keycloak
        run: |
          echo "🔧 Configuring Keycloak..."

          # OIDC tokens are issued with iss=http://keycloak:8081/... (the
          # docker-internal hostname, set via KC_HOSTNAME). Clients running
          # on the runner host need to resolve that name too — the C# and
          # Java clients fetch /.well-known/openid-configuration which
          # points at the keycloak: hostname.
          echo "127.0.0.1 keycloak" | sudo tee -a /etc/hosts

          sleep 5
          uv run python _includes/code/python/keycloak_helper_script.py

          echo "🔑 Obtaining OIDC bearer token..."
          TOKEN_JSON=$(curl -sf -X POST \
            "http://localhost:8081/realms/weaviate-test/protocol/openid-connect/token" \
            -d "grant_type=password" \
            -d "client_id=weaviate" \
            -d "client_secret=weaviate-client-secret-123" \
            -d "username=test-admin" \
            -d "password=password123" \
            -d "scope=openid")
          ACCESS_TOKEN=$(echo "$TOKEN_JSON" | python3 -c "import json,sys; print(json.load(sys.stdin)['access_token'])")
          EXPIRES_IN=$(echo "$TOKEN_JSON" | python3 -c "import json,sys; print(json.load(sys.stdin).get('expires_in', 60))")
          echo "::add-mask::$ACCESS_TOKEN"
          echo "WEAVIATE_OIDC_ACCESS_TOKEN=$ACCESS_TOKEN" >> $GITHUB_ENV
          echo "WEAVIATE_OIDC_EXPIRES_IN=$EXPIRES_IN" >> $GITHUB_ENV

          echo "✅ Keycloak configuration completed"

      - name: Record test start time
        run: echo "TEST_START_TIME=$(date +%s)" >> $GITHUB_ENV

      - name: Run C# tests
        id: run-tests
        continue-on-error: true
        env:
          DOCS_GITHUB_ENV: "true"
          WEAVIATE_URL: ${{ secrets.WEAVIATE_URL }}
          WEAVIATE_HOST: ${{ secrets.WEAVIATE_HOST }}
          WEAVIATE_HOSTNAME: ${{ secrets.WEAVIATE_HOSTNAME }}
          WEAVIATE_HTTP_HOST: ${{ secrets.WEAVIATE_HTTP_HOST }}
          WEAVIATE_GRPC_HOST: ${{ secrets.WEAVIATE_GRPC_HOST }}
          WEAVIATE_API_KEY: ${{ secrets.WEAVIATE_API_KEY }}
          WEAVIATE_LOCAL_API_KEY: ${{ secrets.WEAVIATE_LOCAL_API_KEY }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          COHERE_API_KEY: ${{ secrets.COHERE_API_KEY }}
          HUGGINGFACE_API_KEY: ${{ secrets.HUGGINGFACE_API_KEY }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          echo "🧪 Running C# tests..."
          uv run pytest -m "csharp" -v --tb=short --durations=10 -s --junitxml=pytest-results.xml
          echo "✅ Tests completed"

      - name: Handle test results
        if: always()
        uses: ./.github/actions/handle-test-results
        with:
          test-outcome: ${{ steps.run-tests.outcome }}
          test-type: 'CSharp'
          languages-tested: 'C#'
          slack-bot-token: ${{ secrets.TESTING_CI_SLACK_BOT }}

      - name: Stop services
        if: always()
        run: |
          echo "🛑 Stopping services..."
          ./tests/stop-weaviate.sh 2>/dev/null || echo "⚠️ Some services may have already stopped"

      - name: Cleanup Docker resources
        if: always()
        run: |
          for compose_file in tests/docker-compose*.yml; do
            if [[ -f "$compose_file" ]]; then
              docker compose -f "$compose_file" down -v --remove-orphans 2>/dev/null || true
            fi
          done
          docker system prune -f --volumes 2>/dev/null || true