name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

env:
  MILESTONE: v1.1

jobs:
  fast-checks:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Enable pnpm
        run: corepack enable pnpm

      # actions/cache@v4 is intentionally omitted — probe (D-PROBE-04) showed it
      # times out on this runner (socket hang-up between runner container and job
      # container cache server). pnpm install without cache takes ~30s; acceptable.

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # lint is currently a no-op: no package defines a `lint` script and ESLint is
      # not installed. `pnpm -r lint` prints ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT but
      # exits 0, so this step passes. Wiring lint is out of this phase's scope.
      - name: Lint
        run: pnpm lint

      - name: Typecheck
        run: pnpm typecheck

      - name: PWA unit tests
        run: pnpm --filter @familysync/pwa test

  api:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    # Runs in PARALLEL with fast-checks (D-03) — no needs: dependency.
    services:
      mariadb:
        image: mariadb:11
        env:
          MARIADB_ROOT_PASSWORD: root
          MARIADB_DATABASE: familysync
          MARIADB_USER: familysync
          MARIADB_PASSWORD: testpass
        options: >-
          --health-cmd="healthcheck.sh --connect --innodb_initialized"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=10
          --health-start-period=30s
    # Throwaway creds scoped to the ephemeral service container — never production secrets (T-08-03).
    env:
      DB_HOST: mariadb
      DB_PORT: 3306
      DB_USER: familysync
      DB_PASSWORD: testpass
      DB_NAME: familysync
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Enable pnpm
        run: corepack enable pnpm

      # actions/cache@v4 intentionally omitted — same reasoning as fast-checks job (D-PROBE-04).

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Pitfall 11: service container healthy != MariaDB accepting connections.
      # No mysql CLI in the runner image (D-PROBE-03); poll via the already-installed
      # mysql2 driver using an inline Node script. 90s deadline covers cold-start InnoDB init.
      - name: Wait for MariaDB to accept connections
        # No mysql CLI in the runner image (D-PROBE-03). Poll via the mysql2 driver
        # already installed in apps/pwa (devDependency). --input-type=commonjs forces
        # CJS mode even though apps/pwa has "type":"module" in its package.json.
        run: |
          node --input-type=commonjs - <<'EOF'
          const mysql = require('mysql2/promise');
          const deadline = Date.now() + 90_000;
          (async () => {
            while (true) {
              try {
                const conn = await mysql.createConnection({
                  host: process.env.DB_HOST,
                  port: Number(process.env.DB_PORT ?? 3306),
                  user: process.env.DB_USER,
                  password: process.env.DB_PASSWORD,
                  database: process.env.DB_NAME,
                });
                await conn.query('SELECT 1');
                await conn.end();
                console.log('MariaDB ready');
                process.exit(0);
              } catch (err) {
                if (Date.now() >= deadline) {
                  console.error('MariaDB did not become ready within 90s:', err.message);
                  process.exit(1);
                }
                await new Promise(r => setTimeout(r, 3000));
              }
            }
          })();
          EOF
        working-directory: apps/pwa

      # Apply schema migrations. Uses drizzle-kit migrate (applies committed SQL files).
      # Never use drizzle push — unsafe on MariaDB (emits destructive TRUNCATE diff, T-08-04).
      - name: Run DB migrations
        run: pnpm --filter @familysync/api db:migrate

      # Full DB-backed API test suite (all tests in apps/api/tests/ require a real MariaDB).
      - name: Run API tests
        run: pnpm --filter @familysync/api test

  harness:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    # Runs in PARALLEL with fast-checks + api (D-03) — no needs: dependency.
    services:
      mariadb:
        image: mariadb:11
        env:
          MARIADB_ROOT_PASSWORD: root
          MARIADB_DATABASE: familysync
          MARIADB_USER: familysync
          MARIADB_PASSWORD: testpass
        options: >-
          --health-cmd="healthcheck.sh --connect --innodb_initialized"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=10
          --health-start-period=30s
    # Throwaway creds scoped to the ephemeral service container — never production secrets (T-08-06).
    env:
      DB_HOST: mariadb
      DB_PORT: 3306
      DB_USER: familysync
      DB_PASSWORD: testpass
      DB_NAME: familysync
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Enable pnpm
        run: corepack enable pnpm

      # actions/cache@v4 intentionally omitted — same reasoning as fast-checks job (D-PROBE-04).

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Pitfall 11: service container healthy != MariaDB accepting connections.
      # No mysql CLI in the runner image (D-PROBE-03); poll via the mysql2 driver
      # already installed in apps/pwa (devDependency). --input-type=commonjs forces
      # CJS mode even though apps/pwa has "type":"module" in its package.json.
      - name: Wait for MariaDB to accept connections
        run: |
          node --input-type=commonjs - <<'EOF'
          const mysql = require('mysql2/promise');
          const deadline = Date.now() + 90_000;
          (async () => {
            while (true) {
              try {
                const conn = await mysql.createConnection({
                  host: process.env.DB_HOST,
                  port: Number(process.env.DB_PORT ?? 3306),
                  user: process.env.DB_USER,
                  password: process.env.DB_PASSWORD,
                  database: process.env.DB_NAME,
                });
                await conn.query('SELECT 1');
                await conn.end();
                console.log('MariaDB ready');
                process.exit(0);
              } catch (err) {
                if (Date.now() >= deadline) {
                  console.error('MariaDB did not become ready within 90s:', err.message);
                  process.exit(1);
                }
                await new Promise(r => setTimeout(r, 3000));
              }
            }
          })();
          EOF
        working-directory: apps/pwa

      # Apply schema migrations. Uses drizzle-kit migrate (applies committed SQL files).
      # Never use drizzle push — unsafe on MariaDB (emits destructive TRUNCATE diff, T-08-07).
      - name: Run DB migrations
        run: pnpm --filter @familysync/api db:migrate

      # Build the API before starting it — dist/ is gitignored and does not exist in CI (Pitfall 4).
      - name: Build API
        run: pnpm --filter @familysync/api build

      # Start the API as a background process.
      # DEV_AUTH_BYPASS=true is passed INLINE on the node line (Pitfall 8 — env inheritance
      # across & steps is not guaranteed in all runner modes). NODE_ENV=development is required:
      # global-setup.ts refuses NODE_ENV=production, and the API devBypass.ts checks development.
      - name: Start API background process
        run: |
          NODE_ENV=development DEV_AUTH_BYPASS=true DB_HOST=$DB_HOST DB_PORT=3306 DB_USER=familysync DB_PASSWORD=testpass DB_NAME=familysync node apps/api/dist/index.js &
          echo $! > /tmp/api.pid
          echo "API PID: $(cat /tmp/api.pid)"

      # Wait for the API :3000/health before Playwright starts (D-02 / T-08-08).
      # This step-level wait is SEPARATE from global-setup.ts's poll — global-setup runs AFTER
      # Playwright starts and polls through the Vite proxy. The step-level wait ensures the API
      # is up before Playwright even attempts to start Vite. ~60s deadline.
      - name: Wait for API (:3000/health)
        run: |
          deadline=$((SECONDS + 60))
          until curl -sf http://localhost:3000/health > /dev/null 2>&1; do
            if [ $SECONDS -ge $deadline ]; then
              echo "API did not start within 60s"
              kill $(cat /tmp/api.pid) 2>/dev/null || true
              exit 1
            fi
            sleep 2
          done
          echo "API ready at :3000"

      # Install Playwright browsers with system deps.
      # Must run from apps/pwa/ where @playwright/test is installed (D-PROBE-05 confirmed exit 0).
      # Do NOT cache browser binaries — Playwright explicitly recommends against it in CI.
      - name: Install Playwright browsers
        run: npx playwright install --with-deps webkit chromium
        working-directory: apps/pwa

      # Run the Phase 7 Playwright harness across both device profiles (iphone + pixel).
      # CI=true makes Playwright: start Vite :5173 itself (reuseExistingServer=false),
      # use retries:2/workers:1, and apply reporter:'github' from config — which we
      # override with --reporter=list,html because Gitea does not render github annotations
      # (Pitfall 5 / D-06). Both projects run by default (no --project filter).
      - name: Run Playwright harness (iphone + pixel)
        run: pnpm test:e2e -- --reporter=list,html
        env:
          CI: 'true'
          PLAYWRIGHT_BASE_URL: http://localhost:5173
          DEV_AUTH_BYPASS: 'true'
          NODE_ENV: development
          DB_HOST: mariadb
          DB_PORT: 3306
          DB_USER: familysync
          DB_PASSWORD: testpass
          DB_NAME: familysync

      # Upload traces/screenshots/videos on failure for debugging (D-06).
      # MUST use ChristopherHX/gitea-upload-artifact@v4 — the standard upload-artifact action
      # detects Gitea as GHES and aborts (Pitfall 6 / D-PROBE-06).
      - name: Upload Playwright test artifacts
        if: failure()
        uses: https://github.com/ChristopherHX/gitea-upload-artifact@v4
        with:
          name: playwright-traces-${{ github.run_id }}
          path: apps/pwa/test-results/
          retention-days: 14

      # Always kill the API background process to clean up, even on success.
      - name: Kill API background process
        if: always()
        run: kill $(cat /tmp/api.pid) 2>/dev/null || true