name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_call:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint-and-check:
    name: Lint & Type Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile
      - run: pnpm check

  unit-tests:
    name: Unit Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile
      - run: pnpm test:unit:coverage

      - name: Coverage summary
        if: always()
        run: bash scripts/coverage-summary.sh "Unit Test Coverage" coverage/unit/coverage-summary.json

      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: unit-coverage
          path: coverage/unit/
          retention-days: 14

  e2e-tests:
    name: E2E Tests
    runs-on: ubuntu-latest
    container:
      image: mcr.microsoft.com/playwright:v1.62.1-noble
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - name: Build (with coverage instrumentation)
        run: pnpm build
        env:
          DATABASE_URL: ./data/test-crumbs.db
          NODE_ENV: test
          VITE_COVERAGE: 'true'

      - run: pnpm test:e2e
        env:
          CI: true
          VITE_COVERAGE: 'true'
          HOME: /root

      - name: Merge E2E coverage
        if: always()
        run: npx nyc report

      - name: Coverage summary
        if: always()
        run: bash scripts/coverage-summary.sh "E2E Test Coverage" coverage/e2e/coverage-summary.json

      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: playwright-report
          path: |
            playwright-report/
            test-results/
          retention-days: 7

      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: e2e-coverage
          path: coverage/e2e/
          retention-days: 14

  docker-build:
    name: Docker Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: false
          provenance: false
          tags: crumbs:ci
          load: true
          cache-from: type=gha,scope=ci-docker
          cache-to: type=gha,scope=ci-docker,mode=max

      # Regression for #93: a host folder bind-mounted at /data is owned by the
      # host user (the runner, uid 1001), not the container's node user (1000)
      - name: Start with a host-owned bind mount
        run: |
          mkdir -p "$RUNNER_TEMP/crumbs-data"
          docker run -d --name crumbs -p 3000:3000 -v "$RUNNER_TEMP/crumbs-data:/data" crumbs:ci
          for i in $(seq 1 30); do
            if curl -fsS -o /dev/null http://localhost:3000/login; then
              test -f "$RUNNER_TEMP/crumbs-data/crumbs.db" && exit 0
            fi
            sleep 1
          done
          docker logs crumbs
          exit 1