name: ci

on:
  push:
    branches: [main]
  pull_request:

jobs:
  gates:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: File size budget (1250 lines)
        run: ./ci/check-loc.sh
      - name: No placeholder markers
        run: ./ci/check-no-placeholders.sh
      - name: Compose config validates
        run: POSTGRES_PASSWORD=ci docker compose -f deploy/compose/docker-compose.yml config -q
      - name: Helm chart lints and renders the safety topology
        run: ./ci/check-helm.sh

  rust:
    runs-on: ubuntu-latest
    needs: gates
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: 1.96.0
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - name: Format
        run: cargo fmt --all --check
      - name: Clippy
        run: cargo clippy --workspace --all-targets -- -D warnings
      - name: Test
        run: cargo test --workspace
      - name: Air-gapped installer verify path
        run: ./ci/test-install.sh

  sandbox-k8s:
    runs-on: ubuntu-latest
    needs: gates
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Create kind cluster
        uses: helm/kind-action@v1
        with:
          cluster_name: clawmates-test
      - name: K8s sandbox kernel assertions
        run: cargo test -p cm-sandbox --features k8s-tests --test k8s_security
      - name: Calico cluster (NetworkPolicy enforcement)
        run: ./scripts/netpol-cluster.sh up
      - name: Egress default-deny enforced in the kernel
        run: cargo test -p cm-sandbox --features k8s-tests --test k8s_security calico

  frontend:
    runs-on: ubuntu-latest
    needs: gates
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Install
        run: npm ci
        if: ${{ hashFiles('frontend/package-lock.json') != '' }}
      - name: Lint
        run: npm run lint
        if: ${{ hashFiles('frontend/package-lock.json') != '' }}
      - name: Typecheck
        run: npm run typecheck
        if: ${{ hashFiles('frontend/package-lock.json') != '' }}
      - name: Unit and component tests
        run: npm test
        if: ${{ hashFiles('frontend/package-lock.json') != '' }}

  e2e:
    runs-on: ubuntu-latest
    needs: [rust, frontend]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: 1.96.0
      - uses: Swatinem/rust-cache@v2
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Install frontend dependencies
        working-directory: frontend
        run: npm ci
      - name: Install Playwright browsers
        working-directory: frontend
        run: npx playwright install --with-deps chromium
      - name: Run end-to-end journeys against the real backend
        working-directory: frontend
        run: npx playwright test --grep-invert "@visual"
      - uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: playwright-traces
          path: frontend/test-results/