name: CI

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  workflow_dispatch:

jobs:
  ci:
    name: build + unit + e2e
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # Full-dind runner: job containers already reach the runner's own docker daemon
      # (pre-set DOCKER_HOST and/or a mounted /var/run/docker.sock) — no dind service.
      # Resolve which endpoint works, export it as DOCKER_HOST, and derive E2E_BASE_URL
      # from it: for tcp/https endpoints published ports live on that host; for a unix
      # socket the daemon sits on the job's docker bridge, so its published ports are
      # reached via the default gateway.
      - name: Resolve dind endpoint
        run: |
          set -u

          derive_url() {
            ep="$1"
            case "$ep" in
              unix://*)
                gw=$(ip route show default 2>/dev/null | awk '{print $3; exit}')
                if [ -z "${gw:-}" ]; then
                  echo "::error::unix-socket daemon but no default gateway found (needed to reach published ports)" >&2
                  return 1
                fi
                echo "http://$gw:3000" ;;
              tcp://*|https://*)
                hostpart=$(printf '%s' "$ep" | sed -e 's|^[a-z]*://||')
                hostpart=${hostpart%%:*}
                if [ -z "$hostpart" ]; then return 1; fi
                echo "http://$hostpart:3000" ;;
              *)
                echo "::error::cannot derive app URL from endpoint '$ep'" >&2
                return 1 ;;
            esac
          }

          # 1) A pre-set DOCKER_HOST that answers is used as-is, no probing.
          if [ -n "${DOCKER_HOST:-}" ]; then
            i=0
            while [ "$i" -lt 5 ]; do
              if docker version --format '{{.Server.Version}}' >/dev/null 2>&1; then
                url=$(derive_url "$DOCKER_HOST") || exit 1
                echo "using pre-set DOCKER_HOST=$DOCKER_HOST (E2E_BASE_URL=$url)"
                echo "DOCKER_HOST=$DOCKER_HOST" >> "$GITHUB_ENV"
                echo "E2E_BASE_URL=$url" >> "$GITHUB_ENV"
                exit 0
              fi
              i=$((i+1)); sleep 2
            done
          fi

          # 2) Otherwise probe candidates in order (short retry each).
          tried=""
          for ep in "${DOCKER_HOST:-}" unix:///var/run/docker.sock tcp://localhost:2375 tcp://localhost:2376 tcp://docker:2375 tcp://docker:2376; do
            [ -n "$ep" ] || continue
            case " $tried " in *" $ep "*) continue ;; esac
            tried="$tried $ep"
            i=0
            while [ "$i" -lt 10 ]; do
              if DOCKER_HOST="$ep" docker version --format '{{.Server.Version}}' >/dev/null 2>&1; then
                url=$(derive_url "$ep") || exit 1
                echo "using probed endpoint $ep (E2E_BASE_URL=$url)"
                echo "DOCKER_HOST=$ep" >> "$GITHUB_ENV"
                echo "E2E_BASE_URL=$url" >> "$GITHUB_ENV"
                exit 0
              fi
              i=$((i+1)); sleep 2
            done
          done

          echo "::error::no reachable docker daemon (tried: ${DOCKER_HOST:-<unset>}, unix:///var/run/docker.sock, tcp://localhost:2375, tcp://localhost:2376, tcp://docker:2375, tcp://docker:2376)" >&2
          exit 1

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22

      # bun drives installs (repo ships bun.lock, no package-lock.json); pinned to the
      # same major as oven/bun in the Dockerfile.
      - name: Install bun
        run: npm i -g bun@1.4.2

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build
        run: npm run build

      - name: Unit tests
        run: npx vitest run

      # Browsers run locally in CI (PW_REMOTE_BROWSER=0 below): the shared remote browser
      # server at 192.168.1.4 cannot reach a stack inside dind, and local chromium keeps
      # the job self-contained.
      - name: Install browsers (local)
        run: npx playwright install --with-deps chromium

      # E2E against an isolated stack inside dind — never the production instance.
      # docker-compose.ci.yml mirrors docker-compose.yml minus Traefik; fresh named-volume
      # DB per run. E2E_DEPLOY_CMD makes the config's webServer block deploy + wait for
      # readiness; E2E_COMPOSE_ARGS points state.spec.ts' mid-run `docker compose restart
      # flight` at the same file. DOCKER_HOST/E2E_BASE_URL come from GITHUB_ENV above.
      - name: E2E (isolated stack in dind)
        env:
          PW_REMOTE_BROWSER: "0"
          E2E_DEPLOY_CMD: docker compose -f docker-compose.ci.yml up -d --build
          E2E_COMPOSE_ARGS: "-f docker-compose.ci.yml"
        run: npx playwright test