# Manual-only workflow. Runs against ephemeral test services, never production data.
name: SiteForge V8.17 acceptance (isolated)
on:
  workflow_dispatch:
permissions:
  contents: read
jobs:
  lint-and-audit:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Install isolated audit dependencies
        run: python -m pip install -r requirements-dev.lock
      - name: Run V8.17 tests
        run: python -m pytest -q tests/test_siteforge_v817_audit.py tests/test_wordpress_baseline.py tests/test_regression_runner_v817.py
      - name: Static repository audit
        run: python scripts/siteforge_v817_audit.py --repo . --output reports/ci-repo
      - name: Upload non-secret audit report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: siteforge-v817-repo-audit
          path: reports/ci-repo.*
          if-no-files-found: warn
  isolated-services:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: siteforge_ci
          POSTGRES_PASSWORD: ephemeral-ci-only-password
          POSTGRES_DB: siteforge_ci
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U siteforge_ci -d siteforge_ci"
          --health-interval 5s --health-timeout 3s --health-retries 10
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s --health-timeout 3s --health-retries 10
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Install read-only probe clients
        run: python -m pip install 'psycopg[binary]>=3,<4' 'redis>=5,<7'
      - name: Probe disposable PG/Redis services
        env:
          SITEFORGE_DATABASE_URL: postgresql://siteforge_ci:ephemeral-ci-only-password@127.0.0.1:5432/siteforge_ci
          SITEFORGE_REDIS_URL: redis://127.0.0.1:6379/0
        run: python scripts/siteforge_v817_audit.py --postgres --redis --output reports/ci-datastores
      - name: Upload non-secret audit report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: siteforge-v817-datastore-audit
          path: reports/ci-datastores.*
          if-no-files-found: warn