name: SiteForge quality gates
on:
  push:
  pull_request:
permissions:
  contents: read
jobs:
  tests:
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        python: ['3.12', '3.13']
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python }}
          cache: pip
      - name: Install locked dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements-dev.lock
          python -m pip check
      - name: Validate Python and tests
        env:
          SITEFORGE_ADMIN_PASSWORD: administrator-strong-password-for-ci
          SITEFORGE_SESSION_SECRET: ci-only-session-key-not-for-production-with-entropy
        run: |
          bash scripts/check.sh
  container:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - name: Validate Compose
        env:
          SITEFORGE_ADMIN_PASSWORD: ci-test-only-not-production
          SITEFORGE_SESSION_SECRET: ci-test-only-session-key-not-for-production-123456
          SITEFORGE_PG_PASSWORD: ci-postgresql-password
          SITEFORGE_DEPLOY_SECRET: ci-release-secret-should-not-be-used-in-production
        run: |
          docker compose config --quiet
          docker compose -f compose.enterprise.yaml config --quiet
          docker compose -f compose.release-agent.yaml config --quiet
      - name: One-command Compose build and start smoke
        env:
          SITEFORGE_ADMIN_PASSWORD: ci-test-only-not-production
          SITEFORGE_SESSION_SECRET: ci-test-only-session-key-not-for-production-123456
        run: |
          docker compose up -d --build
          for n in $(seq 1 45); do
            web=$(docker inspect --format='{{.State.Health.Status}}' "$(docker compose ps -q siteforge)" 2>/dev/null || true)
            worker=$(docker inspect --format='{{.State.Health.Status}}' "$(docker compose ps -q worker)" 2>/dev/null || true)
            if [ "$web" = healthy ] && [ "$worker" = healthy ]; then break; fi
            sleep 2
          done
          test "$web" = healthy && test "$worker" = healthy
          docker compose exec -T siteforge python -c "import json,urllib.request; data=json.load(urllib.request.urlopen('http://127.0.0.1:8787/api/health')); assert data['version']=='8.12.0-dev.1' and data.get('commit')"
      - name: Stop Compose smoke
        if: always()
        env:
          SITEFORGE_ADMIN_PASSWORD: ci-test-only-not-production
          SITEFORGE_SESSION_SECRET: ci-test-only-session-key-not-for-production-123456
        run: docker compose down -v --remove-orphans

  postgres-smoke:
    runs-on: ubuntu-24.04
    services:
      postgres:
        image: postgres:16.9-alpine
        env:
          POSTGRES_USER: siteforge
          POSTGRES_PASSWORD: postgres-ci-only
          POSTGRES_DB: siteforge_ci
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U siteforge -d siteforge_ci"
          --health-interval 10s --health-timeout 5s --health-retries 5
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Install pinned dependencies and PG driver
        run: pip install -r requirements.lock -r requirements-enterprise.txt
      - name: Bootstrap PG and verify transactional queue
        env:
          SITEFORGE_DATABASE_URL: postgresql://siteforge:postgres-ci-only@127.0.0.1:5432/siteforge_ci
        run: python scripts/verify_pg_bootstrap.py