ci.yml

name: CI

on:
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - '.github/workflows/**'
      - '.test/**'
      - 'client/**'
      - 'server/**'
      - 'dist/**'
      - 'Makefile.PL'

permissions:
  contents: read
  packages: read

jobs:
  test:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6

      - uses: docker/setup-buildx-action@v4

      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Compute GHCR cache ref
        id: meta
        run: echo "ref=ghcr.io/${GITHUB_REPOSITORY,,}/build:latest" >> "$GITHUB_OUTPUT"

      - name: Build CI base image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: dist/docker/Dockerfile
          target: base
          tags: nictool-ci:latest
          load: true
          cache-from: |
            type=registry,ref=${{ steps.meta.outputs.ref }}
            type=gha,scope=ci
          cache-to: type=gha,mode=max,scope=ci

      - name: Generate test credentials
        run: |
          echo "DB_PW=$(openssl rand -base64 24)" >> "$GITHUB_ENV"
          echo "ROOT_PW=$(openssl rand -base64 24)" >> "$GITHUB_ENV"

      - name: Create test network and start MySQL
        run: |
          docker network create ci
          docker run -d --name mysql --network ci \
            -e MYSQL_ROOT_PASSWORD=root \
            -e MYSQL_DATABASE=nictool \
            --health-cmd="mysqladmin ping -h 127.0.0.1" \
            --health-interval=5s \
            --health-timeout=3s \
            --health-retries=10 \
            mysql:8

      - name: Start CI container
        run: |
          docker run -d --name ci --network ci \
            -v "$GITHUB_WORKSPACE:/workspace" \
            -w /workspace \
            -e NICTOOL_DB_USER_PASSWORD="$DB_PW" \
            -e DB_ROOT_PASSWORD=root \
            -e NICTOOL_DB_USER=nictool \
            -e NICTOOL_DB_NAME=nictool \
            -e DB_ENGINE=mysql \
            -e DB_HOSTNAME=mysql \
            -e ROOT_USER_EMAIL=ci@nictool.test \
            -e ROOT_USER_PASSWORD="$ROOT_PW" \
            -e NICTOOL_CLIENT_DIR=/workspace/client \
            nictool-ci:latest sleep infinity

      - name: Wait for MySQL
        run: |
          for i in $(seq 1 60); do
            if docker inspect --format='{{.State.Health.Status}}' mysql 2>/dev/null | grep -q healthy; then
              echo "MySQL is healthy"
              exit 0
            fi
            sleep 2
          done
          echo "MySQL failed to become healthy" && exit 1

      - name: Install NicTool client and server
        run: |
          docker exec ci bash -c '
            cd /workspace/client && perl Makefile.PL && cpanm -n .
            cd /workspace/server && perl Makefile.PL && cpanm -n .
          '

      - name: Allow Apache to traverse workspace path
        run: |
          docker exec ci bash -c '
            dir="/workspace"
            while [ "$dir" != "/" ]; do
              chmod o+x "$dir"
              dir="$(dirname "$dir")"
            done
          '

      - name: Set up NicTool configs, Apache, and TLS
        run: docker exec ci dist/setup/install-nictool.sh --nt-dir=/workspace

      - name: Start Apache
        run: docker exec ci apachectl start

      - name: Create NicTool test database
        run: docker exec ci bash -c 'cd /workspace/server/sql && echo "" | perl create_tables.pl --environment'

      - name: Create test user and test.cfg
        run: docker exec ci perl dist/setup/setup-test-env.pl

      - name: Run client tests
        run: docker exec ci make -C /workspace/client test

      - name: Run server tests
        run: docker exec ci make -C /workspace/server test

      - name: Run extended permission & delegation tests
        run: docker exec -w /workspace/server ci bash -c 'prove -v xt/*.t'

      - name: Failure diagnostics
        if: failure()
        run: |
          docker exec ci cat /var/log/apache2/error.log 2>/dev/null || true
          docker logs mysql 2>&1 | tail -50 || true