# The checks the README asks for, run on every push to main and every pull
# request into main. It holds no secrets: the only credential is the job's own
# token, used to fetch the commit under test.
#
# The agent runs on whatever Python a member's machine has, down to 3.8, so the
# tests run on the floor and on a current release. Images are pinned by digest.
name: ci

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  PY_FLOOR: python@sha256:1d52838af602b4b5a831beb13a0e4d073280665ea7be7f69ce2382f29c5a613f    # 3.8-slim
  PY_CURRENT: python@sha256:7c61056e61ac89e852de05f3dc6fa51a6dd2181797bceed46aa725dd7cb2cd3b  # 3.13-slim
  # The PyYAML release bastion_agent/build.py vendors; the manifest loader imports it.
  PYYAML: pyyaml==6.0.3
  # The linter: every name a module imports is used, and none is undefined.
  PYFLAKES: pyflakes==4.0.3
  # The pull request's own head, or the pushed commit.
  WANT: ${{ gitea.event.pull_request.head.sha || gitea.sha }}

jobs:
  test:
    runs-on: platform
    steps:
      - name: fetch the commit
        run: |
          set -euo pipefail
          git init -q .
          git -c http.extraHeader="Authorization: token ${{ gitea.token }}" \
            fetch -q --depth=1 "${{ gitea.server_url }}/${{ gitea.repository }}.git" "$WANT"
          git checkout -q --detach FETCH_HEAD
          test "$(git rev-parse HEAD)" = "$WANT"
      - name: the 3.8 syntax floor
        run: |
          docker run --rm -v "$PWD":/src:ro -w /src "$PY_CURRENT" \
            python -m unittest -v test_syntax_floor
      - name: pyflakes
        run: |
          docker run --rm -v "$PWD":/src:ro -w /src -e PYFLAKES "$PY_CURRENT" sh -euc '
            pip install -q --disable-pip-version-check --root-user-action=ignore "$PYFLAKES"
            python -m pyflakes bastion_agent pii scripts test_syntax_floor.py'
      - name: every test, on Python 3.8 and on a current Python
        # age is installed so the seal round trips run, and git so the release
        # verifier's end-to-end tests do. Every test runs here: a skipped one
        # fails the job (the only skips the suite has are for Windows, or for a
        # tool missing, and this job installs the tools).
        run: |
          set -euo pipefail
          for img in "$PY_FLOOR" "$PY_CURRENT"; do
            docker run --rm -v "$PWD":/src:ro -w /src -e PYYAML "$img" sh -euc '
              python --version
              apt-get -qq update >/dev/null
              apt-get -qq install -y --no-install-recommends age git >/dev/null
              pip install -q --disable-pip-version-check --root-user-action=ignore "$PYYAML"
              python -m unittest discover -v . > /tmp/tests.log 2>&1 || { cat /tmp/tests.log; exit 1; }
              grep -E "^(Ran|OK|FAILED)" /tmp/tests.log
              if grep -E "\.\.\. skipped|^(OK|FAILED) \(.*skipped=" /tmp/tests.log; then echo "a test was skipped; CI runs every test"; exit 1; fi'
          done

  personal-data:
    runs-on: platform
    steps:
      - name: fetch the commit
        run: |
          set -euo pipefail
          git init -q .
          git -c http.extraHeader="Authorization: token ${{ gitea.token }}" \
            fetch -q --depth=1 "${{ gitea.server_url }}/${{ gitea.repository }}.git" "$WANT"
          git checkout -q --detach FETCH_HEAD
          test "$(git rev-parse HEAD)" = "$WANT"
      - name: no person's data in the tree
        # Reads files, runs nothing from the tree. The term check needs the
        # maintainers' key and the entity-id check the reserved ids, which a CI
        # job never holds, so the job names files that do not exist: both
        # classes are skipped and the run prints a NOTE for each; the
        # provenance, email and phone checks run. Left at their defaults, a
        # path that exists but cannot be read fails the run instead.
        run: |
          none="$PWD/.ci-holds-none/none"
          NO_PERSONAL_DATA_KEY_FILE="$none" RESERVED_ENTITY_IDS_FILE="$none" python3 scripts/test_no_personal_data.py

  reproducible:
    needs: test
    runs-on: platform
    steps:
      - name: fetch the commit
        run: |
          set -euo pipefail
          git init -q .
          git -c http.extraHeader="Authorization: token ${{ gitea.token }}" \
            fetch -q --depth=1 "${{ gitea.server_url }}/${{ gitea.repository }}.git" "$WANT"
          git checkout -q --detach FETCH_HEAD
          test "$(git rev-parse HEAD)" = "$WANT"
      - name: two builds on each Python produce one sha256
        # Anyone must be able to rebuild a release and get the published bytes,
        # so the .pyz may not depend on the build or the Python that made it.
        run: |
          set -euo pipefail
          for img in "$PY_FLOOR" "$PY_CURRENT"; do
            docker run --rm -v "$PWD":/src:ro -w /src -e PYYAML "$img" sh -euc '
              pip install -q --disable-pip-version-check --root-user-action=ignore "$PYYAML"
              python -m bastion_agent.build --out /tmp/a | awk "{print \$NF}"
              python -m bastion_agent.build --out /tmp/b | awk "{print \$NF}"'
          done | tee digests
          test "$(wc -l < digests)" -eq 4
          test "$(sort -u digests | wc -l)" -eq 1
          echo "every build is $(head -1 digests)"