name: SiteForge quality gates
on:
  push:
  pull_request:
permissions:
  contents: read
jobs:
  tests:
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        python: ['3.12', '3.13']
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python }}
          cache: pip
      - name: Install locked dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements-dev.lock
          python -m pip check
      - name: Validate Python and tests
        env:
          SITEFORGE_ADMIN_PASSWORD: administrator-strong-password-for-ci
          SITEFORGE_SESSION_SECRET: ci-only-session-key-not-for-production-with-entropy
          SITEFORGE_PG_PASSWORD: ci-only-test-postgresql-password
        run: |
          SITEFORGE_REGRESSION_REPEAT=2 bash scripts/check.sh
          python scripts/http_end_to_end.py
      - name: Upload V8.21 regression evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: v821-regression-${{ matrix.python }}
          path: reports/v821-regression*
          if-no-files-found: ignore
          retention-days: 14
  browser-smoke:
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Install test and Chromium dependencies
        run: |
          python -m pip install -r requirements-dev.lock
          python -m pip install -r requirements-browser.txt
          python -m playwright install --with-deps chromium
      - name: Run real desktop and mobile browser smoke
        env:
          SITEFORGE_ADMIN_PASSWORD: browser-ci-only-password
          SITEFORGE_SESSION_SECRET: browser-ci-only-session-secret-not-for-production
        run: |
          mkdir -p reports/browser
          python scripts/browser_smoke.py reports/browser
      - name: Upload browser screenshots
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: v821-browser-smoke
          path: reports/browser/
          if-no-files-found: ignore
          retention-days: 14
  container:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - name: Validate Compose
        env:
          SITEFORGE_ADMIN_PASSWORD: ci-test-only-not-production
          SITEFORGE_SESSION_SECRET: ci-test-only-session-key-not-for-production-123456
          SITEFORGE_PG_PASSWORD: ci-postgresql-password
          SITEFORGE_DEPLOY_SECRET: ci-release-secret-should-not-be-used-in-production
        run: |
          docker compose config --quiet
          docker compose -f compose.enterprise.yaml config --quiet
          docker compose -f compose.release-agent.yaml config --quiet
      - name: One-command Compose build and start smoke
        env:
          SITEFORGE_ADMIN_PASSWORD: ci-test-only-not-production
          SITEFORGE_SESSION_SECRET: ci-test-only-session-key-not-for-production-123456
        run: |
          docker compose up -d --build
          for n in $(seq 1 45); do
            web=$(docker inspect --format='{{.State.Health.Status}}' "$(docker compose ps -q siteforge)" 2>/dev/null || true)
            worker=$(docker inspect --format='{{.State.Health.Status}}' "$(docker compose ps -q worker)" 2>/dev/null || true)
            if [ "$web" = healthy ] && [ "$worker" = healthy ]; then break; fi
            sleep 2
          done
          test "$web" = healthy && test "$worker" = healthy
          docker compose exec -T siteforge python -c "import json,urllib.request; data=json.load(urllib.request.urlopen('http://127.0.0.1:8787/api/health')); assert data['version']=='8.21.0-dev.1' and data.get('commit')"
      - name: Stop Compose smoke
        if: always()
        env:
          SITEFORGE_ADMIN_PASSWORD: ci-test-only-not-production
          SITEFORGE_SESSION_SECRET: ci-test-only-session-key-not-for-production-123456
        run: docker compose down -v --remove-orphans

  postgres-smoke:
    runs-on: ubuntu-24.04
    services:
      postgres:
        image: postgres:16.9-alpine
        env:
          POSTGRES_USER: siteforge
          POSTGRES_PASSWORD: postgres-ci-only
          POSTGRES_DB: siteforge_ci
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U siteforge -d siteforge_ci"
          --health-interval 10s --health-timeout 5s --health-retries 5
      redis:
        image: redis:7.4.2-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s --health-timeout 5s --health-retries 5
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Install pinned dependencies and PG driver
        run: pip install -r requirements.lock -r requirements-enterprise.txt
      - name: Install PostgreSQL 16 maintenance clients
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y postgresql-client-16
          pg_dump --version
      - name: Bootstrap all PG schemas and verify worker queue
        env:
          SITEFORGE_DATABASE_URL: postgresql://siteforge:postgres-ci-only@127.0.0.1:5432/siteforge_ci
          SITEFORGE_REDIS_URL: redis://127.0.0.1:6379/0
        run: |
          python scripts/verify_pg_bootstrap.py
          SITEFORGE_ALLOW_PG_DATA_SMOKE=1 python scripts/verify_sqlite_pg_transfer.py
          python scripts/verify_redis_signal.py
          SITEFORGE_ALLOW_PG_DR_SMOKE=1 python scripts/verify_pg_backup_restore.py