name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CI: 'true'
  DATABASE_URL: postgresql://devrunbook:ci-only-password@localhost:5432/devrunbook
  PUBLIC_BASE_URL: http://127.0.0.1:3000
  SESSION_SECRET: ci-only-session-secret-01234567890123456789
  INTEGRATION_ENCRYPTION_KEY: Y2ktb25seS1lbmNyeXB0aW9uLWtleS0wMDAwMDAwMDA=
  INTEGRATION_ENCRYPTION_KEY_VERSION: ci-v1
  CONTENT_ROOT: ${{ github.workspace }}/content
  ARTIFACT_ROOT: ${{ runner.temp }}/devrunbook-artifacts
  BOOTSTRAP_TOKEN: ci-only-bootstrap-token

jobs:
  verify:
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.18.0
      - name: Enable pinned pnpm
        run: corepack enable && corepack prepare pnpm@10.33.0 --activate
      - name: Verify runtime contract
        run: pnpm check:runtime
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Install pinned validation dependencies
        run: python3 -m pip install --disable-pip-version-check --requirement scripts/requirements-validate.txt
      - name: Run canonical verification
        run: pnpm verify

  service-backed-gates:
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    services:
      postgres:
        image: postgres:17.9-bookworm@sha256:47f917f7409eacd22fc5dfb1dee634e1b55cf0c01d1a7eb701be2227a03e0641
        env:
          POSTGRES_DB: devrunbook
          POSTGRES_USER: devrunbook
          POSTGRES_PASSWORD: ci-only-password
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U devrunbook -d devrunbook"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.18.0
      - name: Enable pinned pnpm
        run: corepack enable && corepack prepare pnpm@10.33.0 --activate
      - name: Verify runtime contract
        run: pnpm check:runtime
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Create artifact directory
        run: mkdir -p "$ARTIFACT_ROOT"
      - name: Apply migrations
        run: pnpm db:migrate
      - name: Run integration tests
        run: pnpm test:integration
      - name: Run security tests
        run: pnpm test:security

  browser-gate:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    services:
      postgres:
        image: postgres:17.9-bookworm@sha256:47f917f7409eacd22fc5dfb1dee634e1b55cf0c01d1a7eb701be2227a03e0641
        env:
          POSTGRES_DB: devrunbook
          POSTGRES_USER: devrunbook
          POSTGRES_PASSWORD: ci-only-password
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U devrunbook -d devrunbook"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.18.0
      - name: Enable pinned pnpm
        run: corepack enable && corepack prepare pnpm@10.33.0 --activate
      - name: Verify runtime contract
        run: pnpm check:runtime
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Install Chromium runtime
        run: pnpm exec playwright install --with-deps chromium
      - name: Prepare application state
        run: mkdir -p "$ARTIFACT_ROOT" && pnpm db:migrate
      - name: Run browser tests
        run: pnpm test:e2e
      - name: Upload browser diagnostics
        if: failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: playwright-report
          path: |
            playwright-report/
            test-results/
          if-no-files-found: ignore
          retention-days: 7