name: CI

on:
  push:
  pull_request:

jobs:
  backend-and-migrations:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:17-alpine
        env:
          POSTGRES_DB: rf4_ci
          POSTGRES_USER: rf4
          POSTGRES_PASSWORD: rf4_ci
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U rf4 -d rf4_ci"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 10
    env:
      DATABASE_URL: postgresql+psycopg://rf4:rf4_ci@localhost:5432/rf4_ci
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip
      - name: Install Python dependencies (locked)
        run: |
          python -m pip install --upgrade pip
          pip install -r apps/api/requirements-dev-lock.txt
          pip install -e .
      - name: Apply migrations to clean PostgreSQL
        working-directory: apps/api
        run: |
          alembic upgrade head
          alembic current
      - name: Run Python tests
        run: pytest -q

  astro-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: apps/web/package-lock.json
      - name: Install web dependencies
        working-directory: apps/web
        run: npm ci
      - name: Astro check, build and unit tests
        working-directory: apps/web
        run: |
          npm run check
          npm run build
          npm run test:unit

  dependency-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Check Python dependencies for security issues
        run: |
          pip install --upgrade pip
          pip install -r apps/api/requirements.txt
          pip audit --requirement apps/api/requirements.txt || true

  compose-e2e:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: apps/web/package-lock.json
      - name: Install web and browser dependencies
        working-directory: apps/web
        run: |
          npm ci
          npx playwright install --with-deps chromium
      - name: Build and start clean Compose stack
        run: docker compose up --build --wait
      - name: Verify readiness and run browser tests
        env:
          WEB_URL: http://127.0.0.1:4321
        run: |
          curl --fail --silent --show-error http://127.0.0.1:8000/ready
          npm --prefix apps/web run test:e2e
      - name: Collect diagnostics
        if: failure()
        run: |
          mkdir -p artifacts
          docker compose logs --no-color > artifacts/compose.log
          cp -R apps/web/test-results artifacts/test-results 2>/dev/null || true
          cp -R apps/web/playwright-report artifacts/playwright-report 2>/dev/null || true
      - name: Upload failure diagnostics
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: compose-e2e-diagnostics
          path: artifacts
          if-no-files-found: ignore
      - name: Stop Compose stack
        if: always()
        run: docker compose down --volumes