name: Magent CI/CD

on:
  push:
    branches:
      - beta
      - main
      - prod
  pull_request:
    branches:
      - beta
      - main
  workflow_dispatch:

concurrency:
  group: magent-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.14"

      - name: Set up Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: "24"
          # Gitea cache restore/save stalls here; npm ci takes about 15 seconds.

      - name: Install frontend dependencies
        working-directory: frontend
        run: npm ci

      - name: Run backend quality gate
        run: bash scripts/ci_backend_quality_gate.sh

      - name: Verify generated build metadata
        run: python scripts/verify_build_metadata.py

      - name: Audit frontend production dependencies
        working-directory: frontend
        run: npm audit --omit=dev --package-lock-only --audit-level=high

      - name: Lint frontend
        working-directory: frontend
        run: npm run lint

      - name: Check frontend formatting
        working-directory: frontend
        run: npm run format:check

      - name: Type-check frontend
        working-directory: frontend
        run: npm run typecheck

      - name: Test frontend
        working-directory: frontend
        run: npm test

      - name: Build frontend
        working-directory: frontend
        run: npm run build

      - name: Validate Compose configuration
        run: |
          cp .env.example .env
          docker compose -f docker-compose.yml config --quiet

      - name: Build and smoke-test container
        run: bash scripts/ci_container_smoke.sh

  deploy-beta:
    if: github.ref_name == 'beta'
    needs: verify
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Configure SSH key
        env:
          PROD_SSH_PRIVATE_KEY: ${{ secrets.PROD_SSH_PRIVATE_KEY }}
          PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
        run: |
          set -euo pipefail
          : "${PROD_SSH_KNOWN_HOSTS:?PROD_SSH_KNOWN_HOSTS is required}"
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          printf '%s' "$PROD_SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
          chmod 644 ~/.ssh/known_hosts

      - name: Deploy beta to AMS-DEV01
        env:
          DEPLOY_HOST: ${{ secrets.PROD_SSH_HOST }}
          DEPLOY_USER: ${{ secrets.PROD_SSH_USER }}
          DEPLOY_SSH_OPTS: -o StrictHostKeyChecking=yes
        run: bash scripts/deploy_beta_ams_dev01.sh