name: Verify
on: [push, pull_request]
permissions:
  contents: read
jobs:
  verify:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:17
        env:
          POSTGRES_PASSWORD: ci-only-password
          POSTGRES_DB: traceiq
        ports: ['5432:5432']
        options: >-
          --health-cmd pg_isready --health-interval 5s
          --health-timeout 5s --health-retries 10
    env:
      # Gitea act_runner 的 job 跑在容器里，与服务容器同网络：主机名必须用服务名
      # postgres（GitHub 托管 runner 的 localhost 语义在这里连不通，勿改回）。
      DATABASE_URL: postgresql://postgres:ci-only-password@postgres:5432/traceiq
      E2E_PASSWORD: CI-Test-Only-SecurePassword882!
      PYTHONPATH: .
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v6
        with:
          version: '0.10.12'
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: npm
      - run: uv sync --frozen --python 3.12
      - run: npm ci --registry=https://registry.npmjs.org
      - run: uv run ruff check server finance tests scripts
      - run: uv run ruff format --check server finance tests scripts
      - run: uv run python manage.py makemigrations --check --dry-run
      - run: uv run pytest --cov=finance --cov-report=term-missing --cov-fail-under=85
      - run: npm run build
      - run: npm audit --omit=dev --registry=https://registry.npmjs.org
      - run: uv run pip-audit
      - run: uv run python manage.py migrate --noinput
      - run: uv run python manage.py collectstatic --noinput
      - run: uv run python manage.py bootstrap --username admin --organization CI
        env:
          BOOTSTRAP_PASSWORD: ${{ env.E2E_PASSWORD }}
      - run: npx playwright install --with-deps chromium
      - name: Browser regression
        shell: bash
        run: |
          uv run python manage.py runserver 127.0.0.1:8000 --noreload > /tmp/web.log 2>&1 &
          web=$!
          uv run python manage.py import_worker > /tmp/worker.log 2>&1 &
          worker=$!
          trap 'kill "$web" "$worker"' EXIT
          for i in {1..30}; do curl -fsS http://127.0.0.1:8000/api/health && break; sleep 1; done
          npm run test:e2e
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: browser-results
          path: |
            playwright-report
            test-results