name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  verify:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_PASSWORD: codex_test
          POSTGRES_DB: imageforge_test
        options: >-
          --health-cmd "pg_isready -U postgres -d imageforge_test"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 20
      redis:
        image: redis:7-alpine
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 20
    env:
      DATABASE_URL: postgres://postgres:codex_test@postgres:5432/imageforge_test
      REDIS_URL: redis://redis:6379/
      IMAGEFORGE_TEST_DATABASE_URL: postgres://postgres:codex_test@postgres:5432/imageforge_test
      IMAGEFORGE_TEST_REDIS_URL: redis://redis:6379/
      JWT_SECRET: imageforge-ci-jwt-secret
      API_KEY_PEPPER: imageforge-ci-api-key-pepper
      EXPECTED_EXTERNAL_TESTS: '10'
    steps:
      - name: Checkout
        env:
          GITEA_JOB_TOKEN: ${{ gitea.token }}
        run: |
          set -Eeuo pipefail
          auth="$(printf 'x-access-token:%s' "$GITEA_JOB_TOKEN" | base64 | tr -d '\n')"
          git init .
          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git -c http.extraHeader="Authorization: Basic ${auth}" \
            fetch --no-tags --depth=1 origin "$GITHUB_REF"
          git checkout --detach "$GITHUB_SHA"
          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"

      - name: Verify migration line endings
        run: |
          python3 - <<'PY'
          from pathlib import Path

          invalid = []
          for path in sorted(Path("migrations").glob("*.sql")):
              data = path.read_bytes()
              if b"\n" in data.replace(b"\r\n", b""):
                  invalid.append(str(path))

          if invalid:
            raise SystemExit("migrations must use CRLF: " + ", ".join(invalid))
          PY

      - name: Install native build dependencies
        run: |
          apt-get update
          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
            cmake libdav1d-dev nasm pkg-config
          pkg-config --atleast-version=1.3.0 dav1d
          rm -rf /var/lib/apt/lists/*

      - name: Install Rust toolchain
        run: |
          set -Eeuo pipefail
          curl --proto '=https' --tlsv1.2 --fail --silent --show-error \
            --location --retry 10 --retry-connrefused https://sh.rustup.rs \
            | sh -s -- -y --default-toolchain none --profile minimal
          /root/.cargo/bin/rustup toolchain install 1.92 \
            --profile minimal --component rustfmt --component clippy --no-self-update
          /root/.cargo/bin/rustup default 1.92
          echo /root/.cargo/bin >> "$GITHUB_PATH"
          /root/.cargo/bin/rustc --version --verbose

      - name: Check Rust formatting
        run: cargo fmt --all -- --check

      - name: Run Clippy
        run: cargo clippy --all-targets --all-features --locked -- -D warnings

      - name: Run Rust tests
        run: cargo test --all-targets --locked

      - name: Run external-state tests
        run: bash scripts/run_external_state_tests.sh

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked --version 0.22.2

      - name: Audit Rust dependencies
        run: |
          set -Eeuo pipefail
          audit_db="$RUNNER_TEMP/rustsec-advisory-db"
          mkdir -p "$audit_db"
          curl --proto '=https' --tlsv1.2 --fail --silent --show-error \
            --location --retry 10 --retry-all-errors \
            https://codeload.github.com/RustSec/advisory-db/tar.gz/refs/heads/main \
            | tar -xz --strip-components=1 -C "$audit_db"
          test -f "$audit_db/support.toml"
          test -d "$audit_db/crates"
          cargo audit --db "$audit_db" --no-fetch

      - name: Install Node.js
        run: |
          node --version | grep --extended-regexp '^v22\.'
          npm --version

      - name: Build frontend
        working-directory: frontend
        run: npm ci && npm run build