# The test gate. Deploy waits for this workflow by name (`.gitea/workflows/deploy.yml`
# triggers on `workflow_run: [Test]`), so renaming it here without renaming it there
# would leave `main` publishing without a suite. `tests/integration/test_deploy_workflows.py`
# asserts both halves of that link, and that the commands below are still the ones
# configured in `work_item/.work-item.yml`.

name: Test

on:
  pull_request:
  push:
    branches:
      - main

concurrency:
  # One run per branch; a newer push makes the older run's answer irrelevant.
  group: test-${{ gitea.ref }}
  cancel-in-progress: true

jobs:
  suites:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install exiftool
        # The EXIF checkpoints are the safety invariant of every metadata stage; a run
        # without exiftool would skip them for a reason the release gate accepts.
        run: |
          SUDO=
          if [ "$(id -u)" -ne 0 ]; then SUDO=sudo; fi
          $SUDO apt-get update
          $SUDO apt-get install -y --no-install-recommends libimage-exiftool-perl

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install the application and its test dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e '.[test]'
          python -m playwright install --with-deps chromium

      - name: Helper suite
        run: work_item/scripts/python -m unittest discover -s work_item/tests -v

      - name: Application suite
        run: work_item/scripts/python -m pytest tests -q

  # The deployed container, verified the way the host application is (US08-05). It
  # runs on `main` only — a pull request has nothing published to upgrade *from*, and
  # building two images per push would pay for that on every commit. Deploy waits for
  # this whole workflow, so a red container gate is a deploy that does not happen.
  container:
    if: gitea.event_name == 'push'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        # The upgrade journey builds the previous commit's tree when no published
        # image is named, so the history has to be there.
        uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install the application and its test dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e '.[test]'
          python -m playwright install --with-deps chromium

      - name: Container acceptance gate
        # One command: it builds the image, provisions the composition against a
        # temporary fixture library and an isolated volume, runs the phase_h journeys,
        # destroys the stack, and writes the evidence. Any skipped check fails it.
        env:
          # The fixture libraries are bind-mounted into the containers, so this path
          # has to be one the Docker daemon can see. On a runner that talks to a
          # sibling daemon, point it at a shared host path instead of the workspace —
          # an unshared path arrives as an empty mount and the journeys fail on the
          # scan, which is the symptom to recognise.
          PHOTO_PIPELINE_DATA_DIR: ${{ gitea.workspace }}/gate-data
          PHOTO_PIPELINE_LIBRARY_ROOTS: ${{ gitea.workspace }}/gate-library
          PHOTO_PIPELINE_TEST_MOUNT_BASE: ${{ gitea.workspace }}/gate-mounts
        run: |
          mkdir -p "$PHOTO_PIPELINE_LIBRARY_ROOTS" "$PHOTO_PIPELINE_TEST_MOUNT_BASE"
          python -m photo_pipeline container-gate --output gate-evidence

      - name: Keep the evidence
        # Retained per run, and retained on failure especially: the logs are the only
        # account of what the containers did.
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: container-gate-${{ gitea.sha }}
          path: gate-evidence