name: Frontend Release

on:
  push:
    branches:
      - master
  workflow_dispatch:

permissions:
  contents: read
  actions: read

concurrency:
  group: frontend-release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build-upload-and-verify:
    runs-on: [self-hosted, Linux, X64, default]
    env:
      RELEASE_BASE_URL: https://dev.truckwash.io
      PLAYWRIGHT_BASE_URL: https://dev.truckwash.io
      PLAYWRIGHT_RELEASE_API_BASE_URL: https://api-v2.truckwash.io
      PLAYWRIGHT_RELEASE_API_PING_PATHS: /ping,/master/api/ping,/canary/api/ping,/stable/api/ping
      RELEASE_BUILD_ID: ${{ github.run_id }}-${{ github.run_attempt }}
      RELEASE_EXPECTED_BUILD_ID: ${{ github.run_id }}-${{ github.run_attempt }}
      RELEASE_EXPECTED_COMMIT: ${{ github.sha }}
      RELEASE_WAIT_INITIAL_SECONDS: 30
      RELEASE_WAIT_TIMEOUT_SECONDS: 300
      RELEASE_POLL_INTERVAL_SECONDS: 10
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci --legacy-peer-deps

      - name: Check AI workflow sync
        run: node scripts/sync-ai-workflow.mjs --check

      - name: Source and i18n checks
        run: |
          npm run text:check-encoding
          npm run i18n:v2:source-check

      - name: Unit tests
        run: npm run test:unit
        env:
          VITEST_BATCH_SIZE: 5

      - name: Build release artifact
        run: npm run build

      - name: Install Playwright Chromium
        run: npx playwright install --with-deps chromium

      - name: Production Playwright gate
        run: npm run test:e2e:prod

      - name: Upload dist artifact
        uses: actions/upload-artifact@v4
        with:
          name: frontend-dist-${{ env.RELEASE_BUILD_ID }}
          path: dist
          retention-days: 14

      - name: Install lftp
        run: |
          if ! command -v lftp >/dev/null 2>&1; then
            sudo apt-get update
            sudo apt-get install -y lftp
          fi

      - name: Upload hashed assets before release metadata
        run: |
          test -n "$RELEASE_DEPLOY_HOST" || (echo "RELEASE_DEPLOY_HOST is required" >&2; exit 1)
          test -n "$RELEASE_DEPLOY_USER" || (echo "RELEASE_DEPLOY_USER is required" >&2; exit 1)
          test -n "$RELEASE_DEPLOY_PASSWORD" || (echo "RELEASE_DEPLOY_PASSWORD is required" >&2; exit 1)
          npm run release:upload:lftp
        env:
          RELEASE_DEPLOY_HOST: ${{ secrets.RELEASE_DEPLOY_HOST }}
          RELEASE_DEPLOY_USER: ${{ secrets.RELEASE_DEPLOY_USER }}
          RELEASE_DEPLOY_PASSWORD: ${{ secrets.RELEASE_DEPLOY_PASSWORD }}
          RELEASE_DEPLOY_REMOTE_ROOT: ${{ secrets.RELEASE_DEPLOY_REMOTE_ROOT }}

      - name: Wait for exact uploaded build
        run: npm run release:verify-upload

      - name: Public live Playwright gate
        run: npm run test:e2e:live:public
        env:
          NODE_OPTIONS: --use-system-ca

      - name: Credentialed live Playwright gate
        run: npm run test:e2e:live:roles
        env:
          NODE_OPTIONS: --use-system-ca
          PLAYWRIGHT_REQUIRE_LIVE_CREDENTIALS: "true"
          PLAYWRIGHT_USER_CUSTOMER_NUMBER: ${{ secrets.PLAYWRIGHT_USER_CUSTOMER_NUMBER }}
          PLAYWRIGHT_USER_PASSWORD: ${{ secrets.PLAYWRIGHT_USER_PASSWORD }}
          PLAYWRIGHT_USER_OTP_SECRET: ${{ secrets.PLAYWRIGHT_USER_OTP_SECRET }}
          PLAYWRIGHT_OPERATOR_USER_ID: ${{ secrets.PLAYWRIGHT_OPERATOR_USER_ID }}
          PLAYWRIGHT_OPERATOR_PASSWORD: ${{ secrets.PLAYWRIGHT_OPERATOR_PASSWORD }}
          PLAYWRIGHT_DEPARTMENT_ID: ${{ secrets.PLAYWRIGHT_DEPARTMENT_ID }}

      - name: Record Release Manager gate
        run: |
          test -n "$RELEASE_MANAGER_GATE_TOKEN" || (echo "RELEASE_MANAGER_GATE_TOKEN is required" >&2; exit 1)
          curl --fail --show-error --silent \
            -X POST "$RELEASE_MANAGER_GATE_URL" \
            -H "Authorization: Bearer $RELEASE_MANAGER_GATE_TOKEN" \
            -H "Content-Type: application/json" \
            --data "{\"environment_url\":\"$RELEASE_BASE_URL\",\"channel_slug\":\"stable\",\"expected_commit\":\"$RELEASE_EXPECTED_COMMIT\",\"build_id\":\"$RELEASE_EXPECTED_BUILD_ID\",\"wait_timeout_seconds\":300,\"poll_interval_seconds\":10,\"required_checks\":[\"static_artifact\",\"api_gateway\"]}"
        env:
          RELEASE_MANAGER_GATE_URL: ${{ secrets.RELEASE_MANAGER_GATE_URL || 'https://api.truckwash.io/release/gate/test-runs' }}
          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}

      - name: Update server version after verification
        run: npm run release:update-server-version
        env:
          SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
          RELEASE_VERSION: ${{ github.sha }}

      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: frontend-release-playwright-${{ env.RELEASE_BUILD_ID }}
          path: output/playwright
          if-no-files-found: ignore
          retention-days: 14