# Release gate automation (updated code review, work-order item 6): every
# push/PR runs the same validation `make check` enforces locally, plus the
# real-stack browser smoke tests (`make e2e`) against the composed stack.
name: release gate

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: check-${{ github.ref }}
  cancel-in-progress: true

env:
  COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - uses: actions/setup-node@v4
        with:
          node-version: 24
      - run: corepack enable

      # Compose fails fast without .env (POSTGRES_PASSWORD/AUTH_SECRET use :?
      # interpolation). CI generates a throwaway one; it is never committed.
      - name: Write CI .env
        run: |
          {
            echo "POSTGRES_PASSWORD=ci-only-$(openssl rand -hex 8)"
            echo "AUTH_SECRET=$(openssl rand -hex 32)"
            echo "POSTGRES_VOLUME=computer_pgdata"
          } > .env

      - name: Install web dependencies
        working-directory: web
        run: corepack yarn install --frozen-lockfile

      - name: Install browser-test dependencies and chromium
        working-directory: scripts
        run: |
          npm ci
          npx playwright install --with-deps chromium
          echo "CHROMIUM_PATH=$(node -p "require('playwright').chromium.executablePath()")" >> "$GITHUB_ENV"

      # build + vet + DB integration + schema convergence/migration atomicity
      # + web lint/SSR-lint/build + browser regressions.
      - name: make check
        run: make check YARN="corepack yarn"

      - name: Start the composed stack
        run: make run

      - name: Wait until app and web are healthy
        run: |
          for _ in $(seq 1 100); do
            app=$(docker inspect -f '{{.State.Health.Status}}' "$(docker compose ps -q app)")
            web=$(docker inspect -f '{{.State.Health.Status}}' "$(docker compose ps -q web)")
            if [ "$app" = healthy ] && [ "$web" = healthy ]; then exit 0; fi
            sleep 3
          done
          echo "stack did not become healthy" >&2
          docker compose ps >&2
          exit 1

      - name: Browser smoke tests against the real stack
        run: make e2e

      - name: Collect logs on failure
        if: failure()
        run: |
          docker compose ps || true
          docker compose logs --tail=200 app web migrate || true