name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

env:
  MILESTONE: v1.1

jobs:
  fast-checks:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Enable pnpm
        run: corepack enable pnpm

      # actions/cache@v4 is intentionally omitted — probe (D-PROBE-04) showed it
      # times out on this runner (socket hang-up between runner container and job
      # container cache server). pnpm install without cache takes ~30s; acceptable.

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # lint is currently a no-op: no package defines a `lint` script and ESLint is
      # not installed. `pnpm -r lint` prints ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT but
      # exits 0, so this step passes. Wiring lint is out of this phase's scope.
      - name: Lint
        run: pnpm lint

      - name: Typecheck
        run: pnpm typecheck

      - name: PWA unit tests
        run: pnpm --filter @familysync/pwa test

  api:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    # Runs in PARALLEL with fast-checks (D-03) — no needs: dependency.
    services:
      mariadb:
        image: mariadb:11
        env:
          MARIADB_ROOT_PASSWORD: root
          MARIADB_DATABASE: familysync
          MARIADB_USER: familysync
          MARIADB_PASSWORD: testpass
        options: >-
          --health-cmd="healthcheck.sh --connect --innodb_initialized"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=10
          --health-start-period=30s
    # Throwaway creds scoped to the ephemeral service container — never production secrets (T-08-03).
    env:
      DB_HOST: mariadb
      DB_PORT: 3306
      DB_USER: familysync
      DB_PASSWORD: testpass
      DB_NAME: familysync
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Enable pnpm
        run: corepack enable pnpm

      # actions/cache@v4 intentionally omitted — same reasoning as fast-checks job (D-PROBE-04).

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Pitfall 11: service container healthy != MariaDB accepting connections.
      # No mysql CLI in the runner image (D-PROBE-03); poll via the already-installed
      # mysql2 driver using an inline Node script. 90s deadline covers cold-start InnoDB init.
      - name: Wait for MariaDB to accept connections
        # No mysql CLI in the runner image (D-PROBE-03). Poll via the mysql2 driver
        # already installed in apps/pwa (devDependency). --input-type=commonjs forces
        # CJS mode even though apps/pwa has "type":"module" in its package.json.
        run: |
          node --input-type=commonjs - <<'EOF'
          const mysql = require('mysql2/promise');
          const deadline = Date.now() + 90_000;
          (async () => {
            while (true) {
              try {
                const conn = await mysql.createConnection({
                  host: process.env.DB_HOST,
                  port: Number(process.env.DB_PORT ?? 3306),
                  user: process.env.DB_USER,
                  password: process.env.DB_PASSWORD,
                  database: process.env.DB_NAME,
                });
                await conn.query('SELECT 1');
                await conn.end();
                console.log('MariaDB ready');
                process.exit(0);
              } catch (err) {
                if (Date.now() >= deadline) {
                  console.error('MariaDB did not become ready within 90s:', err.message);
                  process.exit(1);
                }
                await new Promise(r => setTimeout(r, 3000));
              }
            }
          })();
          EOF
        working-directory: apps/pwa

      # Apply schema migrations. Uses drizzle-kit migrate (applies committed SQL files).
      # Never use drizzle push — unsafe on MariaDB (emits destructive TRUNCATE diff, T-08-04).
      - name: Run DB migrations
        run: pnpm --filter @familysync/api db:migrate

      # Full DB-backed API test suite (all tests in apps/api/tests/ require a real MariaDB).
      - name: Run API tests
        run: pnpm --filter @familysync/api test