name: Verify
on: [push, pull_request]
permissions:
  contents: read
jobs:
  verify:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:17
        env:
          POSTGRES_PASSWORD: ci-only-password
          POSTGRES_DB: traceiq
        options: >-
          --label traceiq-ci-postgres=${{ github.repository }}:${{ github.run_id }}:${{ github.run_attempt }}
          --health-cmd pg_isready --health-interval 5s
          --health-timeout 5s --health-retries 10
    env:
      E2E_PASSWORD: CI-Test-Only-SecurePassword882!
      PYTHONPATH: .
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v6
        with:
          version: '0.10.12'
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: npm
      - run: uv sync --frozen --python 3.12
      # runner 使用共享 Docker 网络；按本次运行的标签找服务 IP，避免共用 postgres 别名。
      # act_runner v0.6.1 尚未提供 job.services.postgres.id，现有 Docker socket 仅用于读取。
      - name: Resolve isolated PostgreSQL service
        env:
          POSTGRES_SERVICE_LABEL: traceiq-ci-postgres=${{ github.repository }}:${{ github.run_id }}:${{ github.run_attempt }}
        run: |
          postgres_containers=$(curl --fail --silent --show-error \
            --unix-socket /var/run/docker.sock \
            --get --data-urlencode "filters={\"label\":[\"$POSTGRES_SERVICE_LABEL\"]}" \
            http://localhost/containers/json)
          POSTGRES_CONTAINERS="$postgres_containers" uv run python - <<'PY'
          import ipaddress
          import json
          import os

          containers = json.loads(os.environ["POSTGRES_CONTAINERS"])
          if len(containers) != 1:
              raise SystemExit("Expected exactly one PostgreSQL service for this run")
          networks = list(containers[0]["NetworkSettings"]["Networks"].values())
          if len(networks) != 1:
              raise SystemExit("Expected PostgreSQL to use the runner's single Docker network")
          address = ipaddress.IPv4Address(networks[0]["IPAddress"])
          with open(os.environ["GITHUB_ENV"], "a") as env_file:
              env_file.write(f"DATABASE_URL=postgresql://postgres:ci-only-password@{address}:5432/traceiq\n")
          PY
      - run: npm ci --registry=https://registry.npmjs.org
      - run: uv run ruff check server finance tests scripts
      - run: uv run ruff format --check server finance tests scripts
      - run: uv run python manage.py makemigrations --check --dry-run
      - run: uv run pytest --cov=finance --cov-report=term-missing --cov-fail-under=85
      - run: npm run build
      # 审计端点在 runner 网络下偶发 TLS 断开（npm error audit endpoint returned
      # an error），重试区分网络抖动与真实漏洞：漏洞是确定性的，重试后照样红。
      - name: npm audit (production deps)
        run: |
          for attempt in 1 2 3; do
            npm audit --omit=dev --registry=https://registry.npmjs.org && exit 0
            echo "::warning::npm audit 第 ${attempt} 次失败，15 秒后重试"
            sleep 15
          done
          exit 1
      - name: pip-audit
        run: |
          for attempt in 1 2 3; do
            uv run pip-audit && exit 0
            echo "::warning::pip-audit 第 ${attempt} 次失败，15 秒后重试"
            sleep 15
          done
          exit 1
      - run: uv run python manage.py migrate --noinput
      - run: uv run python manage.py collectstatic --noinput
      - run: uv run python manage.py bootstrap --username admin --organization CI
        env:
          BOOTSTRAP_PASSWORD: ${{ env.E2E_PASSWORD }}
      - name: Install Playwright Chromium
        run: |
          for attempt in 1 2 3; do
            npx playwright install --with-deps chromium && exit 0
            if [ "$attempt" -lt 3 ]; then
              echo "::warning::Playwright 安装第 ${attempt} 次失败，15 秒后重试"
              sleep 15
            fi
          done
          exit 1
      - name: Browser regression
        shell: bash
        run: |
          uv run python manage.py runserver 127.0.0.1:8000 --noreload > /tmp/web.log 2>&1 &
          web=$!
          uv run python manage.py import_worker > /tmp/worker.log 2>&1 &
          worker=$!
          trap 'kill "$web" "$worker"' EXIT
          for i in {1..30}; do curl -fsS http://127.0.0.1:8000/api/health && break; sleep 1; done
          npm run test:e2e
      # Gitea 不支持 upload-artifact@v4 的 artifact 协议（GHESNotSupportedError），
      # 上传失败不该把已经全绿的测试标红；迁到 GitHub 托管时此步骤自动生效。
      - uses: actions/upload-artifact@v4
        if: always()
        continue-on-error: true
        with:
          name: browser-results
          path: |
            playwright-report
            test-results