name: ci

on:
  push:
    branches: [main]
  pull_request:

jobs:
  gates:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: File size budget (1500 lines)
        run: ./ci/check-loc.sh
      - name: No placeholder markers
        run: ./ci/check-no-placeholders.sh
      - name: Compose config validates
        run: POSTGRES_PASSWORD=ci docker compose -f deploy/compose/docker-compose.yml config -q

  rust:
    runs-on: ubuntu-latest
    needs: gates
    # Compile sqlx query! macros against the committed .sqlx cache (no DB needed).
    # Tests need a live Postgres — locally cm-testkit reads CM_TEST_DATABASE_URL
    # from .cargo/config.toml pointing at scripts/test-server.sh's host container.
    # The fleet act_runner uses the `host` executor (jobs run on morpheus/tank/
    # architect natively, not inside a container), so we start a per-run postgres
    # container and reach it via its bridge IP. GITHUB_RUN_ID scopes the name so
    # concurrent jobs on the same runner don't collide.
    #
    # GIT_CONFIG_GLOBAL points at a per-job empty file so cargo's git fetches
    # bypass the runner's includeIf mapping of git.redclaw.dev → /slab/projects
    # (local mirror lags and misses recently-pinned commits like the clawverse
    # rev cm-brain depends on). clawverse is public; no auth needed.
    env:
      SQLX_OFFLINE: "true"
      GIT_CONFIG_GLOBAL: /tmp/ci-empty-gitconfig-${{ github.run_id }}
    steps:
      - name: Prepare empty gitconfig for cargo fetches
        run: touch "$GIT_CONFIG_GLOBAL"
      - uses: actions/checkout@v4
      - name: Start postgres sidecar
        run: |
          set -euo pipefail
          NAME="ci-pg-${GITHUB_RUN_ID}"
          docker rm -f "$NAME" >/dev/null 2>&1 || true
          docker run -d --name "$NAME" \
            -e POSTGRES_PASSWORD=postgres \
            -e POSTGRES_DB=postgres \
            postgres:16-alpine >/dev/null
          # `.NetworkSettings.IPAddress` is empty (and template-parse errors) on
          # modern Docker where the IP lives under `.Networks.<name>.IPAddress`.
          # The range form picks the first non-empty IP across whatever network
          # docker put the container on.
          PG_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$NAME")
          if [ -z "$PG_IP" ]; then
            echo "postgres has no reachable IP" >&2
            docker inspect "$NAME" >&2
            exit 1
          fi
          echo "PG_CONTAINER=$NAME" >> "$GITHUB_ENV"
          echo "CM_TEST_DATABASE_URL=postgres://postgres:postgres@${PG_IP}:5432/postgres" >> "$GITHUB_ENV"
          for i in $(seq 1 30); do
            if docker exec "$NAME" pg_isready -U postgres -q >/dev/null 2>&1; then
              echo "postgres ready at ${PG_IP} after ${i}s"
              exit 0
            fi
            sleep 1
          done
          echo "postgres never became ready" >&2
          docker logs "$NAME" >&2 || true
          exit 1
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: 1.96.0
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - name: Format
        run: cargo fmt --all --check
      - name: Clippy
        run: cargo clippy --workspace --all-targets -- -D warnings
      - name: Test
        run: |
          set -euo pipefail
          # Re-derive the postgres URL inline instead of trusting that
          # CM_TEST_DATABASE_URL propagated through $GITHUB_ENV — act_runner
          # v1.0.8 has been observed to swallow env-file writes here.
          IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$PG_CONTAINER")
          [ -n "$IP" ] || { echo "no PG IP" >&2; exit 1; }
          export CM_TEST_DATABASE_URL="postgres://postgres:postgres@${IP}:5432/postgres"
          echo "using $CM_TEST_DATABASE_URL"
          cargo test --workspace
      - name: Air-gapped installer verify path
        run: ./ci/test-install.sh
      - name: Cleanup postgres sidecar
        if: always()
        run: docker rm -f "${PG_CONTAINER:-}" >/dev/null 2>&1 || true

  frontend:
    runs-on: ubuntu-latest
    needs: gates
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Install
        run: npm ci
        if: ${{ hashFiles('frontend/package-lock.json') != '' }}
      - name: Lint
        run: npm run lint
        if: ${{ hashFiles('frontend/package-lock.json') != '' }}
      - name: Typecheck
        run: npm run typecheck
        if: ${{ hashFiles('frontend/package-lock.json') != '' }}
      - name: Unit and component tests
        run: npm test
        if: ${{ hashFiles('frontend/package-lock.json') != '' }}

  # e2e is intentionally disabled for now. The suite has real product/test
  # drift (locators pointing at older versions of pages) that would need a
  # dedicated pass to reconcile — see the earlier follow-up notes. Publish
  # doesn't depend on this job anyway, but keeping it enabled produced a
  # steady red on every push that wasn't actionable. Flip `if:` back to
  # `true` (or delete the guard) when the tests get realigned.
  e2e:
    if: false
    runs-on: ubuntu-latest
    needs: [rust, frontend]
    env:
      SQLX_OFFLINE: "true"
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: 1.96.0
      - uses: Swatinem/rust-cache@v2
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Install frontend dependencies
        working-directory: frontend
        run: npm ci
      - name: Install Playwright browsers
        working-directory: frontend
        run: npx playwright install --with-deps chromium
      - name: Run end-to-end journeys against the real backend
        working-directory: frontend
        run: npx playwright test --grep-invert "@visual"
      - uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: playwright-traces
          path: frontend/test-results/

  # Rolling deploy: on green main only, build the three prod images, tag with
  # :main-<sha> + :latest, push to the fleet registry (redclaw-web-01:5000 via
  # its Tailscale IP — the fleet's daemons trust it in insecure-registries by
  # IP, not by hostname). GW-04's clawmates-deploy.timer rolls forward within
  # ~1 minute of the push. Skipped on PRs.
  #
  # `e2e` is intentionally NOT in `needs`: it launches its own postgres + dex
  # via `docker run` on the host and then reaches them via 127.0.0.1, which
  # fails from inside the act_runner container. Migrating e2e to a physical
  # build node is a separate task; until then e2e is signal-only, not gating.
  # `rust` was restored to `needs` once the flakes were rooted out (approvals
  # SSE race + warm_pool agent-seeding + a couple health-check ambiguities).
  publish:
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    needs: [gates, rust, frontend]
    env:
      REGISTRY: 100.94.185.103:5000
      NAMESPACE: clawmates
    steps:
      - uses: actions/checkout@v4
      - name: Resolve short SHA
        run: echo "SHA=${GITHUB_SHA::7}" >> "$GITHUB_ENV"
      - name: Build images
        run: |
          set -euo pipefail
          for svc in broker server frontend; do
            docker build \
              -t "${REGISTRY}/${NAMESPACE}/${svc}:main-${SHA}" \
              -t "${REGISTRY}/${NAMESPACE}/${svc}:latest" \
              -f "images/${svc}.Dockerfile" .
          done
      - name: Push images
        run: |
          set -euo pipefail
          for svc in broker server frontend; do
            docker push "${REGISTRY}/${NAMESPACE}/${svc}:main-${SHA}"
            docker push "${REGISTRY}/${NAMESPACE}/${svc}:latest"
          done
      - name: Summary
        run: |
          {
            echo "## Published images"
            echo ""
            for svc in broker server frontend; do
              echo "- \`${REGISTRY}/${NAMESPACE}/${svc}:main-${SHA}\`"
              echo "- \`${REGISTRY}/${NAMESPACE}/${svc}:latest\`"
            done
            echo ""
            echo "GW-04 timer picks these up within ~1 minute."
          } >> "$GITHUB_STEP_SUMMARY"