name: CI

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  shell:
    runs-on: macos-15
    steps:
      - uses: actions/checkout@v6
      - name: Check deployment scripts
        run: |
          /bin/bash -n deploy/apple-container.sh
          /bin/bash deploy/tests/apple-container-test.sh
          /bin/sh deploy/tests/docker-compose-security-test.sh
          /bin/sh deploy/tests/docker-compose-gateway-env-test.sh
          /bin/sh deploy/tests/docker-runtime-resources-test.sh
          /bin/sh deploy/test-caddyfile-cache.sh

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: backend/go.mod
          check-latest: false
          cache: true
          cache-dependency-path: backend/go.sum
      - name: Verify Go version
        run: |
          go version | grep -q 'go1.27.0'
      - name: Unit tests
        working-directory: backend
        run: make test-unit
      - name: Integration tests
        working-directory: backend
        run: make test-integration

  protection-database:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: protection_review
          POSTGRES_PASSWORD: local-ci-only
          POSTGRES_DB: relay_protection_test
        ports: ['5432:5432']
        options: >-
          --health-cmd 'pg_isready -U protection_review -d relay_protection_test'
          --health-interval 5s --health-timeout 5s --health-retries 20
    env:
      REQUIRE_DATABASE_TESTS: '1'
      PROTECTION_TEST_DSN: postgres://protection_review:local-ci-only@127.0.0.1:5432/relay_protection_test?sslmode=disable
      USER_CLEANUP_TEST_DSN: postgres://protection_review:local-ci-only@127.0.0.1:5432/relay_protection_test?sslmode=disable
      INTELLIGENT_TESTS_TEST_DSN: postgres://protection_review:local-ci-only@127.0.0.1:5432/relay_protection_test?sslmode=disable
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: backend/go.mod
          cache-dependency-path: backend/go.sum
      - name: Run protection, hierarchy, cleanup and queue database tests
        working-directory: backend
        run: go test -tags=protectionintegration ./internal/repository ./internal/service -run 'Test(AccountProtection|AccountTraffic|GroupDetailStats|ProtectionTransitionDatabase|ProtectedProxy|RateLimitObservation|UserHierarchy|UserResource|UserCleanup|Intelligent)' -count=1 -timeout=10m

  frontend:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 9
      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '20'
          cache: 'pnpm'
          cache-dependency-path: frontend/pnpm-lock.yaml
      - name: Install frontend dependencies
        working-directory: frontend
        run: pnpm install --frozen-lockfile
      - name: Frontend typecheck and critical vitest
        run: make test-frontend

  golangci-lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: backend/go.mod
          check-latest: false
          cache: true
          cache-dependency-path: backend/go.sum
      - name: Verify Go version
        run: |
          go version | grep -q 'go1.27.0'
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: v2.13
          args: --timeout=30m
          working-directory: backend