# Gitea Actions workflow — build/test on every push to main. Gitea Actions uses the same
# workflow syntax as GitHub Actions (a compatible runner), so this is portable if the canonical
# remote ever needs to move CI providers, without being GitHub Actions itself or requiring a
# paid CI provider. Runs against the canonical Gitea repo only — see docs/PHASE4_PRODUCTION_INFRASTRUCTURE.md
# §18 for why this never touches the GitHub kubekosh fork.
#
# Deploy this file to .gitea/workflows/build-and-test.yml at the repo root to activate it (kept
# under infra/ci/ in this PR so it's reviewed alongside the rest of the infra package first,
# per the same "build now, activate deliberately" posture as everything else server-dependent
# in this phase — enabling Gitea Actions on the instance is itself a one-time admin step that
# may not be done yet).

name: build-and-test

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  regression:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_PASSWORD: postgres
        ports: ["5432:5432"]
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 10s --health-timeout 5s --health-retries 10
    steps:
      - uses: actions/checkout@v4

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install dependencies (all first-party services)
        run: |
          for d in backend frontend platform/api platform/gateway platform/provisioner; do
            (cd "$d" && npm ci)
          done

      - name: Syntax-check every service
        run: |
          for d in backend frontend/src platform/api platform/gateway platform/provisioner; do
            find "$d" -name '*.js' -not -path '*/node_modules/*' -exec node --check {} \;
          done

      - name: Build frontend
        run: (cd frontend && npm run build)

      - name: Provisioner migrations against the service Postgres
        run: |
          cd platform/provisioner
          PLATFORM_DB_URL=postgres://postgres:postgres@localhost:5432/postgres \
            node -e "require('./src/db').runMigrations().then(m=>console.log('Applied:',m.join(', ')))"

      - name: Platform API migrations (depends on Provisioner's, same order as production)
        run: |
          cd platform/api
          PLATFORM_DB_URL=postgres://postgres:postgres@localhost:5432/postgres \
            node -e "require('./src/db').runMigrations().then(m=>console.log('Applied:',m.join(', ')))"

      - name: Validate infra configs (Phase 4 local tests — no hardware needed)
        run: |
          ./infra/scripts/validate-compose.sh
          ./infra/firewall/validate-firewall.sh

      # The real k3s-boot-dependent e2e suites (platform/test/e2e-phase*.js) need a full Docker
      # Compose stack with --privileged Lab containers, which a shared CI runner typically
      # can't grant safely — they stay a LOCAL/staging pre-promotion step
      # (infra/scripts/staging-smoke-test.sh), not this job. See docs/PHASE4_PRODUCTION_INFRASTRUCTURE.md §18.

  build-images:
    needs: regression
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build and tag images
        run: ./infra/scripts/ci/tag-and-push.sh
        env:
          REGISTRY: ${{ vars.REGISTRY }}
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}

  deploy-staging:
    needs: build-images
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to staging (automatic)
        run: |
          cd infra/ansible
          ansible-playbook site.yml -i inventory/staging.ini \
            -e "image_tag=staging-${GITHUB_SHA::12}" \
            --vault-password-file <(echo "$VAULT_PASSWORD")
        env:
          VAULT_PASSWORD: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}

      - name: Staging smoke test
        run: ./infra/scripts/staging-smoke-test.sh

  # Production is NEVER automatic — a human runs infra/scripts/deploy-production.sh after
  # reviewing the staging smoke test result, per the explicit "manual approval step" preference.
  # No job here does that; see docs/RUNBOOK_NORMAL_DEPLOY.md for the actual command.