# CI for gitea-axi. Runs on Gitea Actions on the operator's instance; the syntax
# is kept GitHub-Actions-compatible so the GitHub mirror can adopt this file
# nearly verbatim (copy it to .github/workflows/).
#
# The `test` job runs inside a node container so the disposable Gitea service is
# reachable by its service name (`gitea:3000`) on both Gitea Actions and GitHub
# Actions — avoiding the host-vs-service-name networking difference between the
# two platforms.
name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    container: node:${{ matrix.node }}-bookworm

    strategy:
      # Every leg's result is wanted: a failure on one Node major says nothing
      # about the other, and cancelling the sibling would hide half the answer.
      fail-fast: false
      matrix:
        # The supported Node majors, matching the manifest's declared engine
        # range. Node 20 is end-of-life and deliberately absent.
        node: ["22", "24"]
        # Augments the highest leg with a flag, so the steps that run once
        # share one named condition rather than each restating a version
        # number. Keep this entry's `node` matching the last element above.
        include:
          - node: "24"
            highest: true

    services:
      gitea:
        # Pinned to a specific stable tag, bumped deliberately (not floating).
        # Kept on the 1.23 line to match the gitea-js client (^1.23.0), so the
        # e2e tier exercises response shapes the client was generated against.
        image: gitea/gitea:1.23.5
        env:
          GITEA__security__INSTALL_LOCK: "true"
          GITEA__database__DB_TYPE: sqlite3
          GITEA__database__PATH: /data/gitea/gitea.db
          GITEA__server__ROOT_URL: http://gitea:3000/
          GITEA__server__HTTP_PORT: "3000"
          GITEA__service__DISABLE_REGISTRATION: "false"
          GITEA__service__REQUIRE_SIGNIN_VIEW: "false"
          GITEA__log__LEVEL: warn

    env:
      # The end-to-end tier provisions and drives the CLI against this instance.
      GITEA_AXI_E2E_URL: http://gitea:3000

    steps:
      - uses: actions/checkout@v4

      - name: Install dependencies
        run: npm ci

      - name: Typecheck
        run: npm run typecheck

      - name: Unit and integration tiers (with coverage thresholds)
        run: npm run test:coverage

      # Deterministic, and needs neither network nor the agent SDK, so it runs
      # everywhere. Its non-default runner configuration makes it an easy tier
      # to believe is running when it is not.
      - name: Benchmark harness tier
        run: npm run test:bench

      # Exercises the Gitea API contract rather than Node-version behaviour, so
      # one leg is enough.
      - name: End-to-end tier
        if: matrix.highest
        run: npm run test:e2e

      # Slow, and near enough version-independent — but the only automated guard
      # on the distribution artifact, since publishing is a manual command.
      - name: Packaging tier
        if: matrix.highest
        run: npm run test:pack

  # Builds the flake, catching flake rot — most concretely a build-relevant file
  # left out of package.nix's source allowlist — at the commit that causes it,
  # rather than weeks later at the maintainer's next system rebuild.
  #
  # `continue-on-error` is deliberate, not an oversight: this job is non-gating.
  # Nix is not part of the runner image, so an infrastructure problem installing
  # or reaching it must not block an otherwise legitimate change. Read its result
  # as a signal, not as a verdict — a red mark here still merges.
  #
  # Its cost is likewise accepted rather than accidental. The flake's `checks`
  # output aliases the package, so this builds the whole dependency closure from
  # cold — nothing warms the store between runs — and re-runs the fast tier and
  # the installed-binary tier inside the derivation, both of which the `test` job
  # has already run. That duplication buys the allowlist guard, which nothing
  # else provides.
  flake:
    runs-on: ubuntu-latest
    # No `needs`: it neither waits on the test job nor is waited on, so the two
    # run concurrently and neither can hold the other back.
    #
    # `continue-on-error` is set per step rather than on the job, which reads as
    # the odd spelling but is the only one that works here: Gitea's `act` fork
    # has the field on its Step struct and not on its Job struct, so a job-level
    # flag is parsed and silently ignored, and a red build would fail the run
    # after all. Step-level is honoured by both act and GitHub Actions, and a job
    # whose every step is continue-on-error concludes green on either — so this
    # spelling keeps the file portable as well as correct.

    steps:
      - uses: actions/checkout@v4

      - uses: cachix/install-nix-action@v31
        continue-on-error: true
        with:
          extra_nix_config: |
            experimental-features = nix-command flakes

      # `checks` is the package, so this builds exactly what `nix build` does,
      # entered through the output a consumer would verify with — which also
      # catches a `checks` output that has stopped evaluating.
      - name: Check the flake (builds the package)
        continue-on-error: true
        run: nix flake check --print-build-logs