name: MobilityOps acceptance

on:
  pull_request:

concurrency:
  group: mobilityops-ci-${{ gitea.repository }}-${{ gitea.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  acceptance:
    # Never execute code from an untrusted public fork on the private runner.
    if: ${{ gitea.event.pull_request.head.repo.full_name == gitea.repository }}
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0
      - name: Determine validation scope
        id: scope
        shell: bash
        run: |
          base_sha="${{ gitea.event.pull_request.base.sha }}"
          if git diff --quiet "$base_sha...HEAD" -- . ':(exclude).gitea/workflows/**'; then
            echo "full=false" >> "$GITEA_OUTPUT"
            echo "Workflow-only change: the protected lightweight gate is sufficient."
          else
            echo "full=true" >> "$GITEA_OUTPUT"
            echo "Product or test change: running the complete acceptance gate."
          fi
      - name: Secret scan
        shell: bash
        run: |
          set -euo pipefail
          repository="$PWD"
          source="file:///repo"
          workspace=(-v "$repository:/repo" -w /repo)
          if docker inspect "${HOSTNAME:-}" >/dev/null 2>&1; then
            source="file://$repository"
            workspace=(--volumes-from "$HOSTNAME" -w "$repository")
          fi
          docker run --rm "${workspace[@]}" \
            ghcr.io/trufflesecurity/trufflehog@sha256:7104dbb84d1ad2f5f6fa1134e92c6aa6f701f0a4ac2efd5a4c5c96225d899fe3 \
            git "$source" --fail --no-update --github-actions --only-verified
      - name: Backend tests in isolated PostgreSQL stack
        if: steps.scope.outputs.full == 'true'
        run: sh scripts/run-isolated-tests.sh
      - name: Backend static and contract checks
        if: steps.scope.outputs.full == 'true'
        run: |
          docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --build --rm api ruff check app tests
          docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --rm api mypy app
          docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --rm \
            api python scripts/check-contracts.py
          python scripts/check-source-budgets.py
      - name: Build production API image for vulnerability scan
        if: steps.scope.outputs.full == 'true'
        run: |
          docker build --target runtime --build-arg VCS_REF="$GITHUB_SHA" \
            --tag mobilityops-api-ci --file backend/Dockerfile .
      - name: Production API image vulnerability scan (HIGH/CRITICAL)
        if: steps.scope.outputs.full == 'true'
        run: bash scripts/scan-ci-image.sh mobilityops-api-ci
      - name: Build production web image for vulnerability scan
        if: steps.scope.outputs.full == 'true'
        run: |
          docker build --build-arg VCS_REF="$GITHUB_SHA" \
            --tag mobilityops-web-ci frontend
      - name: Production web image vulnerability scan (HIGH/CRITICAL)
        if: steps.scope.outputs.full == 'true'
        run: bash scripts/scan-ci-image.sh mobilityops-web-ci
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        if: steps.scope.outputs.full == 'true'
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - name: Install frontend dependencies once
        if: steps.scope.outputs.full == 'true'
        working-directory: frontend
        run: npm ci --no-audit --no-fund
      - name: Frontend lint, build, budget and dependency audit
        if: steps.scope.outputs.full == 'true'
        working-directory: frontend
        run: |
          npm run lint
          npm run build
          npm run budget
          npm audit --audit-level=high
      - name: Start the demo stack
        if: steps.scope.outputs.full == 'true'
        run: |
          cp .env.example .env
          # Acceptance tests intentionally reset their isolated demo dataset per scenario.
          printf '\nDEMO_RESET_COOLDOWN_SECONDS=0\n' >> .env
          docker compose -p mobilityops-e2e up --build -d db api web
          docker network connect mobilityops-e2e_mobilityops "$HOSTNAME"
          for _attempt in $(seq 1 60); do
            if curl -fsS http://web/health/ready >/dev/null 2>&1; then break; fi
            sleep 2
          done
          curl -fsS http://web/health/ready
          docker compose -p mobilityops-e2e exec -T api python -m app.cli seed --reset
      - name: Install acceptance browsers
        if: steps.scope.outputs.full == 'true'
        working-directory: frontend
        run: npx playwright install --with-deps chromium
      - name: Run browser acceptance and live smoke suites
        if: steps.scope.outputs.full == 'true'
        working-directory: frontend
        env:
          MOBILITYOPS_PUBLIC_URL: http://web
        run: |
          # Pixel baselines are workstation/rendering specific; keep the PR gate functional.
          npx playwright test --grep-invert "visual hierarchy"
          npx playwright test --config=playwright.live.config.ts --project=chromium
      - name: Run concurrent persisted-read smoke
        if: steps.scope.outputs.full == 'true'
        run: python scripts/run-readonly-load-smoke.py --base-url http://web
      - name: Upload Playwright report
        if: failure() && steps.scope.outputs.full == 'true'
        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3; Gitea-compatible artifact protocol
        with:
          name: playwright-report
          path: |
            frontend/playwright-report
            frontend/playwright-live-report
          if-no-files-found: ignore
      - name: Stack logs on failure
        if: failure() && steps.scope.outputs.full == 'true'
        run: docker compose -p mobilityops-e2e logs --tail=200 api web
      - name: Remove CI stacks
        if: always() && steps.scope.outputs.full == 'true'
        run: |
          docker network disconnect mobilityops-e2e_mobilityops "$HOSTNAME" 2>/dev/null || true
          docker compose -p mobilityops-e2e down -v --remove-orphans
          docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml down -v --remove-orphans