name: CI

# CI policy (amends the older FabledRulebook/forgejo.md "lint + unit only"
# stance — operator opted in to running integration in CI):
#   - backend-lint-and-test: fast feedback — ruff + `pytest -m "not
#     integration"`, no service containers.
#   - frontend-build: vitest unit + vite build.
#   - integration: spins up pgvector Postgres + Redis service containers,
#     migrates a throwaway test DB, runs `pytest -m integration`. This is
#     the first time the integration suite runs anywhere, so expect a
#     debugging tail until it goes green.

on:
  push:
    branches: [dev, main]
  pull_request:
    branches: [main]

jobs:
  backend-lint-and-test:
    # Runner must have Python 3.14 + ruff + Node 22 pre-installed. The
    # python-ci runner image lives at CI-Runner/CI-python/ in the operator's
    # workspace; see that Dockerfile + Makefile to roll/push the image.
    runs-on: python-ci
    env:
      # DB_PASSWORD and SECRET_KEY are required by config.py at import time
      # even though unit tests don't actually touch the DB or use the secret.
      DB_PASSWORD: ci_unit_test_placeholder
      SECRET_KEY: ci_unit_test_placeholder
    steps:
      - uses: actions/checkout@v4

      - name: Install Python deps
        # ruff is pre-installed in the python-ci runner image (see
        # CI-Runner/CI-python/Dockerfile's RUFF_VERSION). Per FabledRulebook
        # forgejo.md, toolchain versions live on the runner image, not here.
        run: pip install -r requirements.txt pytest pytest-asyncio

      - name: Ruff lint
        run: ruff check backend/ tests/ alembic/

      - name: Pytest (unit only — integration runs in the integration job)
        run: pytest tests/ -v -m "not integration"

  frontend-build:
    runs-on: python-ci
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4
      # No package-lock.json is tracked yet (we don't run npm locally per
      # feedback-no-local-runs). Using `npm install` instead of `npm ci`.
      # If we want strict lockfile-based reproducibility later, commit a
      # package-lock.json and flip this back to `npm ci`.
      - run: npm install --no-audit --no-fund
      # `npm run check` (vue-tsc --noEmit) skipped: the frontend is pure JS
      # with no .ts files and no JSDoc annotations, so vue-tsc has nothing
      # to type-check. Re-enable once we add a tsconfig.json and either
      # convert to TS or add JSDoc.
      - run: npm run test:unit
      - run: npm run build

  integration:
    # This act_runner (swarm-runner v0.6.1) puts service containers on the
    # default bridge with NO service-name DNS, and publishing fixed host
    # ports collides with the operator's running docker-compose dev stack on
    # the same shared daemon. Workaround: publish NO host ports, and reach
    # each service by its bridge IP — discovered at runtime via the mounted
    # docker socket (the python-ci image ships /usr/bin/docker; build.yml
    # relies on it). Default-bridge containers can talk by IP (only embedded
    # DNS is missing), so IP addressing is reliable here. Everything runs in
    # ONE step so resolved values don't depend on cross-step env passing.
    runs-on: python-ci
    env:
      DB_USER: fabledcurator
      DB_PASSWORD: ci_integration
      DB_PORT: "5432"
      DB_NAME: fabledcurator_test
      SECRET_KEY: ci_integration_placeholder
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: fabledcurator
          POSTGRES_PASSWORD: ci_integration
          POSTGRES_DB: fabledcurator_test
        options: >-
          --health-cmd "pg_isready -U fabledcurator"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 10
      redis:
        image: redis:7-alpine
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 10
    steps:
      - uses: actions/checkout@v4

      - name: Integration suite (resolve service IPs, migrate, test)
        run: |
          set -eux
          # Scope to THIS job's service containers (act_runner names them
          # ...JOB-integration...); the operator's compose stack uses the
          # same images but different names, so it won't match.
          PG=$(docker ps --filter "name=JOB-integration" --filter "ancestor=pgvector/pgvector:pg16" -q | head -n1)
          RD=$(docker ps --filter "name=JOB-integration" --filter "ancestor=redis:7-alpine" -q | head -n1)
          test -n "$PG" && test -n "$RD"
          PG_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$PG")
          RD_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$RD")
          test -n "$PG_IP" && test -n "$RD_IP"
          export DB_HOST="$PG_IP"
          export CELERY_BROKER_URL="redis://$RD_IP:6379/0"
          export CELERY_RESULT_BACKEND="redis://$RD_IP:6379/0"
          # Wait for Postgres to accept TCP (bash /dev/tcp; no extra tools).
          for i in $(seq 1 60); do
            (echo > "/dev/tcp/$PG_IP/5432") >/dev/null 2>&1 && break
            sleep 2
          done
          pip install -r requirements.txt pytest pytest-asyncio
          alembic upgrade head
          pytest tests/ -v -m integration