name: CI

on:
  push:
    branches:
      - main
      - master
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: frameflow-ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    name: Migrations, tests, build, and audit
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    env:
      NODE_ENV: test
      WEB_ORIGIN: http://127.0.0.1:4173
      DATABASE_URL: postgresql://frameflow:frameflow@127.0.0.1:54329/frameflow
      REDIS_URL: redis://127.0.0.1:63799
      JWT_ACCESS_SECRET: ci-access-secret-with-at-least-32-characters
      JWT_REFRESH_SECRET: ci-refresh-secret-with-at-least-32-characters
      EMAIL_VERIFICATION_REQUIRED: "false"
      S3_ENDPOINT: http://127.0.0.1:9000
      S3_PUBLIC_ENDPOINT: http://127.0.0.1:9000
      S3_REGION: us-east-1
      S3_BUCKET: frameflow
      S3_ACCESS_KEY: frameflow
      S3_SECRET_KEY: frameflow-local-secret
      S3_FORCE_PATH_STYLE: "true"
      FFMPEG_PATH: ffmpeg
      FFPROBE_PATH: ffprobe

    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm

      - name: Install system media dependencies
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends ffmpeg fonts-noto-cjk

      - name: Install dependencies
        run: npm ci

      - name: Validate production smoke-test CLI
        run: npm run smoke:production -- --help

      - name: Validate Alertmanager smoke-test CLI
        run: npm run smoke:alertmanager -- --help

      - name: Validate Stripe smoke-test CLI
        run: npm run smoke:stripe -- --help

      - name: Validate isolated restore-rehearsal CLI
        run: npm run restore:rehearse -- --help

      - name: Validate scheduled maintenance CLI and systemd units
        run: |
          ./scripts/scheduled-maintenance.sh --help
          systemd-analyze verify deploy/systemd/*.service deploy/systemd/*.timer

      - name: Start test infrastructure
        run: |
          docker compose up -d --wait postgres redis minio
          docker compose run --rm --no-deps minio-init

      - name: Apply database migrations
        run: npm run db:migrate

      - name: Run test suite
        run: npm test

      - name: Create and rehearse a real isolated restore
        shell: bash
        env:
          COMPOSE_PROJECT_NAME: frameflow
          FRAMEFLOW_ENV_FILE: ${{ github.workspace }}/.env.production.example
          FRAMEFLOW_BACKUP_METRICS_DIR: ${{ runner.temp }}/frameflow-metrics
          FRAMEFLOW_RESTORE_METRICS_DIR: ${{ runner.temp }}/frameflow-metrics
        run: |
          backup_parent="${RUNNER_TEMP}/frameflow-backups"
          ./scripts/backup.sh "${backup_parent}"
          backup_dir="$(find "${backup_parent}" -mindepth 1 -maxdepth 1 -type d -name 'frameflow-*' -print -quit)"
          test -n "${backup_dir}"
          npm run restore:rehearse -- "${backup_dir}"

      - name: Build web and server
        run: npm run build:all

      - name: Audit production dependencies
        run: npm audit --omit=dev

      - name: Show infrastructure diagnostics
        if: failure()
        run: |
          docker compose ps
          docker compose logs --no-color --tail=200 postgres redis minio

      - name: Stop test infrastructure
        if: always()
        run: docker compose down --volumes --remove-orphans

  production-images:
    name: Production gate and container images
    runs-on: ubuntu-24.04
    timeout-minutes: 30

    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Create synthetic production configuration
        shell: bash
        run: |
          production_env="${RUNNER_TEMP}/frameflow-production.env"
          {
            echo "APP_HOST=studio.frameflow-ci.test"
            echo "MEDIA_HOST=media.frameflow-ci.test"
            echo "WEB_ORIGIN=https://studio.frameflow-ci.test"
            echo "API_PUBLIC_ORIGIN=https://studio.frameflow-ci.test"
            echo "S3_PUBLIC_ENDPOINT=https://media.frameflow-ci.test"
            echo "COMPOSE_PROJECT_NAME=frameflow-ci-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
            echo "FRAMEFLOW_VERSION=ci"
            echo "ALERTMANAGER_WEBHOOK_URL=https://alerts.frameflow-ci.test/webhook"
            echo "POSTGRES_DB=frameflow"
            echo "POSTGRES_USER=frameflow"
            echo "POSTGRES_PASSWORD=ci-postgres-password-with-32-characters"
            echo "DATABASE_URL=postgresql://frameflow:ci-postgres-password-with-32-characters@postgres:5432/frameflow"
            echo "REDIS_PASSWORD=ci-redis-password-with-32-characters"
            echo "REDIS_URL=redis://default:ci-redis-password-with-32-characters@redis:6379"
            echo "JWT_ACCESS_SECRET=ci-access-signing-secret-with-32-characters"
            echo "JWT_REFRESH_SECRET=ci-refresh-signing-secret-with-32-characters"
            echo "CREDENTIAL_ENCRYPTION_KEY=ci-credential-encryption-secret-with-32-characters"
            echo "S3_BUCKET=frameflow"
            echo "S3_ACCESS_KEY=frameflow-ci-access-key"
            echo "S3_SECRET_KEY=frameflow-ci-storage-secret-with-32-characters"
            echo "EMAIL_VERIFICATION_REQUIRED=true"
            echo "RESEND_API_KEY=re_ci_configuration_validation_only"
            echo "EMAIL_FROM=FrameFlow CI <noreply@frameflow-ci.test>"
            echo "BILLING_SUCCESS_URL=https://studio.frameflow-ci.test"
            echo "BILLING_CANCEL_URL=https://studio.frameflow-ci.test"
          } > "${production_env}"
          echo "PRODUCTION_ENV=${production_env}" >> "${GITHUB_ENV}"

      - name: Validate production Compose configuration
        run: docker compose --env-file "${PRODUCTION_ENV}" -f docker-compose.prod.yml config --quiet

      - name: Build production images
        run: docker compose --env-file "${PRODUCTION_ENV}" -f docker-compose.prod.yml build config-check web

      - name: Accept a safe production configuration
        run: docker compose --env-file "${PRODUCTION_ENV}" -f docker-compose.prod.yml run --rm --no-deps config-check

      - name: Reject the placeholder production example
        shell: bash
        run: |
          if COMPOSE_PROJECT_NAME="frameflow-ci-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" FRAMEFLOW_VERSION=ci docker compose --env-file .env.production.example -f docker-compose.prod.yml run --rm --no-deps config-check; then
            echo "The production gate accepted placeholder configuration." >&2
            exit 1
          fi

      - name: Remove build containers
        if: always()
        run: docker compose --env-file "${PRODUCTION_ENV}" -f docker-compose.prod.yml down --remove-orphans