name: MobilityOps live canary

on:
  schedule:
    - cron: "7 * * * *"
  workflow_dispatch:

jobs:
  public-demo:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - name: Verify HTTPS readiness and certificate horizon
        run: |
          curl --fail --silent --show-error --retry 3 https://fleetops.itworx.tech/health/ready
          openssl s_client -servername fleetops.itworx.tech -connect fleetops.itworx.tech:443 </dev/null 2>/dev/null \
            | openssl x509 -checkend 1209600 -noout
      - name: Install locked Playwright runtime
        working-directory: frontend
        run: |
          npm ci --no-audit --no-fund
          npx playwright install --with-deps chromium firefox
      - name: Run non-destructive cross-browser production canary
        working-directory: frontend
        env:
          MOBILITYOPS_PUBLIC_URL: https://fleetops.itworx.tech
        run: npx playwright test --config=playwright.live.config.ts
      - name: Report successful external heartbeat
        env:
          HEARTBEAT_URL: ${{ secrets.LIVE_CANARY_HEARTBEAT_URL }}
        run: |
          if [ -n "$HEARTBEAT_URL" ]; then
            curl --fail --silent --show-error --retry 3 "$HEARTBEAT_URL"
          fi
      - name: Upload failure evidence
        if: failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: live-canary-failure
          path: |
            frontend/playwright-live-report
            frontend/test-results