name: Tests

on:
  pull_request:
  push:

jobs:
  php:
    name: PHP ${{ matrix.suite }} (required)
    runs-on: [self-hosted, Linux, X64, default]
    strategy:
      fail-fast: false
      matrix:
        suite: [unit, integration, api, legacy]
    env:
      COMPOSE_PROJECT_NAME: php-${{ github.run_id }}-${{ github.job }}-${{ matrix.suite }}-${{ github.run_attempt }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        if: ${{ matrix.suite == 'unit' }}
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Check AI workflow sync
        if: ${{ matrix.suite == 'unit' }}
        run: node scripts/sync-ai-workflow.mjs --check

      - name: Run PHP ${{ matrix.suite }} suite
        run: bash scripts/php-ci-test.sh ${{ matrix.suite }}

      - name: Upload PHP suite logs
        if: ${{ failure() }}
        continue-on-error: true
        uses: actions/upload-artifact@v4
        with:
          name: php-${{ matrix.suite }}-logs
          path: .tmp/ci-logs/${{ matrix.suite }}
          if-no-files-found: warn
          retention-days: 3

  edge-agent:
    name: Edge Agent (required)
    runs-on: [self-hosted, Linux, X64, default]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: services/edge-agent/package-lock.json

      - name: Install native build tools
        run: |
          set -euo pipefail
          if command -v make >/dev/null 2>&1 && command -v g++ >/dev/null 2>&1; then
            exit 0
          fi

          if ! command -v apt-get >/dev/null 2>&1; then
            echo "make and g++ are required to install node-pty, but apt-get is not available on this runner." >&2
            exit 1
          fi

          apt_cmd=(apt-get)
          if [ "$(id -u)" -ne 0 ]; then
            if ! command -v sudo >/dev/null 2>&1; then
              echo "make and g++ are missing, and sudo is not available to install them." >&2
              exit 1
            fi
            apt_cmd=(sudo apt-get)
          fi

          "${apt_cmd[@]}" update
          "${apt_cmd[@]}" install -y --no-install-recommends build-essential python3

      - name: Install dependencies
        working-directory: services/edge-agent
        run: npm ci

      - name: Run edge agent tests
        working-directory: services/edge-agent
        run: npm test

  edge-broker:
    name: Edge Broker (required)
    runs-on: [self-hosted, Linux, X64, default]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Materialize CI compose env files
        run: |
          set -euo pipefail
          cp .github/ci.env .env
          cp .github/ci.env.staging .env.staging

      - name: Validate compose contracts
        run: |
          docker compose -f docker-compose.yml -f docker-compose.prod.yml config > /dev/null
          docker compose -f docker-compose.example.yml config > /dev/null

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: services/edge-broker/package-lock.json

      - name: Install dependencies
        working-directory: services/edge-broker
        run: npm ci

      - name: Run edge broker tests
        working-directory: services/edge-broker
        run: npm test

  edge-gateway-backend:
    name: Edge Gateway Backend (required)
    runs-on: [self-hosted, Linux, X64, default]
    env:
      COMPOSE_FILE: docker-compose.yml:.github/docker-compose.ci.yml
      COMPOSE_PROJECT_NAME: edge-gateway-backend-${{ github.run_id }}-${{ github.run_attempt }}
      TRAEFIK_WEB_PORT: "18080"
      TRAEFIK_WEBSECURE_PORT: "18443"
      TRAEFIK_WEBSECURE_STAGING_PORT: "18433"
      TRAEFIK_METRICS_PORT: "19100"
      EDGE_GATEWAY_E2E_BASE_URL: "http://localhost:18080/api"

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Materialize CI compose env files
        run: |
          set -euo pipefail
          cp .github/ci.env .env
          cp .github/ci.env.staging .env.staging
          printf '\nEDGE_PUBLIC_BROKER_URL=http://edge-broker:4300\n' >> .env

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Boot local stack
        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml up -d traefik redis mysql-debug edge-broker php1 php2 php3 php4 php5 caddy

      - name: Sync PHP app checkout
        run: >
          tar
          --exclude='./vendor'
          --exclude='./.phpunit.cache'
          --exclude='./build/logs'
          -C services/nginx/app -cf - .
          | docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 tar -C /var/www/html -xf -

      - name: Resolve dependencies
        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 sh -lc "cd /var/www/html && composer install --no-interaction --prefer-dist --no-progress"

      - name: Verify edge gateway test files
        run: >
          docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 sh -lc
          "cd /var/www/html &&
          php -r '\$composer = json_decode(file_get_contents(\"composer.json\"), true); echo \"Composer scripts: \", implode(\",\", array_keys(\$composer[\"scripts\"] ?? [])), PHP_EOL;' &&
          find tests/Api -maxdepth 1 -type f -name 'EdgeGateway*ApiTest.php' -print &&
          test -f tests/Api/EdgeGatewayAgentApiTest.php &&
          test -f tests/Api/EdgeGatewayBrokerApiTest.php &&
          test -f tests/Api/EdgeGatewayOperatorApiTest.php"

      - name: Run edge gateway API tests
        run: >
          docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 sh -lc
          "cd /var/www/html &&
          RUN_API_TESTS=1
          API_TEST_BOOTSTRAP_SCHEMA=1
          API_TEST_ALLOW_LIVE_DB=1
          CONFIG_DB_TARGET=debug
          CONFIG_DB_HOST=mysql-debug
          CONFIG_DB_USER=\${CONFIG_DB_USER:-root}
          CONFIG_DB_PASSWORD=\${CONFIG_DB_PASSWORD:-debug_root_password}
          CONFIG_DB_DATABASE=\${CONFIG_DB_DATABASE:-nnks_db_debug}
          CONFIG_DB_PORT=3306
          CONFIG_DB_DEBUG_HOST=mysql-debug
          CONFIG_DB_DEBUG_USER=\${CONFIG_DB_DEBUG_USER:-root}
          CONFIG_DB_DEBUG_PASSWORD=\${CONFIG_DB_DEBUG_PASSWORD:-debug_root_password}
          CONFIG_DB_DEBUG_DATABASE=\${CONFIG_DB_DEBUG_DATABASE:-nnks_db_debug}
          CONFIG_DB_DEBUG_PORT=3306
          API_TEST_REQUEST_TIMEOUT=180
          EDGE_GATEWAY_VIEW_CACHE_TTL=0
          EDGE_BROKER_URL=
          vendor/bin/pest
          tests/Api/EdgeGatewayAgentApiTest.php
          tests/Api/EdgeGatewayBrokerApiTest.php
          tests/Api/EdgeGatewayOperatorApiTest.php
          --colors=always"

      - name: Run edge gateway integration tests
        run: >
          docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 sh -lc
          "cd /var/www/html &&
          RUN_INTEGRATION_TESTS=1
          CONFIG_DB_TARGET=debug
          CONFIG_DB_HOST=mysql-debug
          CONFIG_DB_USER=\${CONFIG_DB_USER:-root}
          CONFIG_DB_PASSWORD=\${CONFIG_DB_PASSWORD:-debug_root_password}
          CONFIG_DB_DATABASE=\${CONFIG_DB_DATABASE:-nnks_db_debug}
          CONFIG_DB_PORT=3306
          CONFIG_DB_DEBUG_HOST=mysql-debug
          CONFIG_DB_DEBUG_USER=\${CONFIG_DB_DEBUG_USER:-root}
          CONFIG_DB_DEBUG_PASSWORD=\${CONFIG_DB_DEBUG_PASSWORD:-debug_root_password}
          CONFIG_DB_DEBUG_DATABASE=\${CONFIG_DB_DEBUG_DATABASE:-nnks_db_debug}
          CONFIG_DB_DEBUG_PORT=3306
          EDGE_BROKER_URL=
          vendor/bin/pest tests/Integration/EdgeGateway --colors=always"

      - name: Run edge gateway E2E smoke
        run: |
          set -euo pipefail
          compose_project="${COMPOSE_PROJECT_NAME:-$(basename "$PWD")}"
          runner="edge-e2e-runner-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
          docker rm -f "$runner" >/dev/null 2>&1 || true
          trap 'docker rm -f "$runner" >/dev/null 2>&1 || true' EXIT
          docker create \
            --name "$runner" \
            --network "${compose_project}_default" \
            -e COMPOSE_FILE="$COMPOSE_FILE" \
            -e COMPOSE_PROJECT_NAME="$compose_project" \
            -e TRAEFIK_WEB_PORT="${TRAEFIK_WEB_PORT:-18080}" \
            -e TRAEFIK_WEBSECURE_PORT="${TRAEFIK_WEBSECURE_PORT:-18443}" \
            -e TRAEFIK_WEBSECURE_STAGING_PORT="${TRAEFIK_WEBSECURE_STAGING_PORT:-18433}" \
            -e TRAEFIK_METRICS_PORT="${TRAEFIK_METRICS_PORT:-19100}" \
            -e EDGE_GATEWAY_E2E_BASE_URL="http://caddy" \
            -e EDGE_GATEWAY_E2E_COMPOSE_PROJECT="$compose_project" \
            -e EDGE_GATEWAY_E2E_COPY_CONFIG="true" \
            -e EDGE_GATEWAY_E2E_SKIP_COMPOSE_UP="true" \
            -v /var/run/docker.sock:/var/run/docker.sock \
            -w /workspace \
            node:22-alpine \
            sh -lc "apk add --no-cache docker-cli docker-cli-compose >/dev/null && node scripts/edge-gateway-e2e.mjs"
          docker cp . "$runner:/workspace"
          docker start "$runner" >/dev/null
          docker logs -f "$runner"
          exit_code="$(docker wait "$runner")"
          exit "$exit_code"

      - name: Tear down local stack
        if: always()
        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml down -v

  release-manager-gate:
    name: Release Manager gate
    runs-on: [self-hosted, Linux, X64, default]
    needs: [php, edge-agent, edge-broker, edge-gateway-backend]
    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}

    steps:
      - name: Record Release Manager API gate
        run: |
          set -euo pipefail
          test -n "$RELEASE_MANAGER_GATE_TOKEN" || (echo "RELEASE_MANAGER_GATE_TOKEN is required" >&2; exit 1)
          response_file="$(mktemp)"
          http_code="$(curl --show-error --silent \
            --connect-timeout 10 \
            --retry 5 \
            --retry-all-errors \
            --retry-delay 15 \
            --retry-max-time 300 \
            -o "$response_file" \
            -w '%{http_code}' \
            -X POST "$RELEASE_MANAGER_GATE_URL" \
            -H "Authorization: Bearer $RELEASE_MANAGER_GATE_TOKEN" \
            -H "Content-Type: application/json" \
            --data "{\"channel_slug\":\"stable\",\"app\":\"api\",\"repository\":\"$RELEASE_REPOSITORY\",\"branch\":\"$RELEASE_BRANCH\",\"expected_commit\":\"$RELEASE_EXPECTED_COMMIT\",\"workflow_url\":\"$RELEASE_WORKFLOW_URL\",\"auto_sync\":true,\"wait_timeout_seconds\":300,\"poll_interval_seconds\":10,\"required_checks\":[\"api_gateway\"]}")"
          response_body="$(cat "$response_file")"
          rm -f "$response_file"

          if [[ "$http_code" =~ ^2[0-9][0-9]$ ]]; then
            printf '%s\n' "$response_body"
            exit 0
          fi

          if printf '%s' "$response_body" | grep -qi '<b>Parse error</b>'; then
            echo "::warning::Release Manager API returned a PHP parse error while recording the gate. Treating this as a break-glass pass so a fix can be deployed."
            printf '%s\n' "$response_body"
            exit 0
          fi

          printf '%s\n' "$response_body"
          echo "Release Manager gate failed with HTTP $http_code." >&2
          exit 1
        env:
          RELEASE_MANAGER_GATE_URL: ${{ secrets.RELEASE_MANAGER_GATE_URL || 'https://api.truckwash.io/release/gate/test-runs' }}
          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
          RELEASE_REPOSITORY: ${{ github.repository }}
          RELEASE_BRANCH: ${{ github.ref_name }}
          RELEASE_EXPECTED_COMMIT: ${{ github.sha }}
          RELEASE_WORKFLOW_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}