name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  verify:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_PASSWORD: codex_test
          POSTGRES_DB: imageforge_test
        options: >-
          --health-cmd "pg_isready -U postgres -d imageforge_test"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 20
      redis:
        image: redis:7-alpine
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 20
    env:
      DATABASE_URL: postgres://postgres:codex_test@postgres:5432/imageforge_test
      REDIS_URL: redis://redis:6379/
      IMAGEFORGE_TEST_DATABASE_URL: postgres://postgres:codex_test@postgres:5432/imageforge_test
      IMAGEFORGE_TEST_REDIS_URL: redis://redis:6379/
      JWT_SECRET: imageforge-ci-jwt-secret
      API_KEY_PEPPER: imageforge-ci-api-key-pepper
      EXPECTED_EXTERNAL_TESTS: '9'
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Verify migration line endings
        run: |
          python3 - <<'PY'
          from pathlib import Path

          invalid = []
          for path in sorted(Path("migrations").glob("*.sql")):
              data = path.read_bytes()
              if b"\n" in data.replace(b"\r\n", b""):
                  invalid.append(str(path))

          if invalid:
              raise SystemExit("migrations must use CRLF: " + ", ".join(invalid))
          PY

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: '1.92'
          components: rustfmt, clippy

      - name: Cache Rust build
        uses: Swatinem/rust-cache@v2

      - name: Check Rust formatting
        run: cargo fmt --all -- --check

      - name: Run Clippy
        run: cargo clippy --all-targets --all-features --locked -- -D warnings

      - name: Run Rust tests
        run: cargo test --all-targets --locked

      - name: Run external-state tests
        run: bash scripts/run_external_state_tests.sh

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked --version 0.22.2

      - name: Audit Rust dependencies
        run: cargo audit

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Build frontend
        working-directory: frontend
        run: npm ci && npm run build