name: CI/CD

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  GITEA_REGISTRY: 10.0.0.194:3012
  GITEA_PUBLIC_URL: https://mysources.co.uk
  GITEA_OWNER: michal

# ============================================================
# Required Gitea secrets:
#   PACKAGES_TOKEN     — Gitea API token (packages + registry)
# ============================================================

jobs:
  # ── CI checks (run in parallel on every push/PR) ──────────

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          # no pnpm cache — concurrent cache restore hangs on single-worker runner

      - run: pnpm install --frozen-lockfile

      - name: Lint
        run: pnpm lint || echo "::warning::Lint has errors — not blocking CI yet"

  typecheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          # no pnpm cache — concurrent cache restore hangs on single-worker runner

      - run: pnpm install --frozen-lockfile

      - name: Generate Prisma client
        run: pnpm --filter @mcpctl/db exec prisma generate

      - name: Typecheck
        run: pnpm typecheck

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          # no pnpm cache — concurrent cache restore hangs on single-worker runner

      - run: pnpm install --frozen-lockfile

      - name: Generate Prisma client
        run: pnpm --filter @mcpctl/db exec prisma generate

      - name: Build (needed by completions test)
        run: pnpm build

      - name: Run tests
        run: pnpm test:run

  # ── Smoke tests (full stack: postgres + mcpd + mcplocal) ──

  smoke:
    runs-on: ubuntu-latest
    needs: [lint, typecheck, test]
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: mcpctl
          POSTGRES_PASSWORD: mcpctl
          POSTGRES_DB: mcpctl
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DATABASE_URL: postgresql://mcpctl:mcpctl@postgres:5432/mcpctl
      MCPD_PORT: "3100"
      MCPD_HOST: "0.0.0.0"
      MCPLOCAL_HTTP_PORT: "3200"
      MCPLOCAL_MCPD_URL: http://localhost:3100
      DOCKER_API_VERSION: "1.43"
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          # no pnpm cache — concurrent cache restore hangs on single-worker runner

      - run: pnpm install --frozen-lockfile

      - name: Generate Prisma client
        run: pnpm --filter @mcpctl/db exec prisma generate

      - name: Build all packages
        run: pnpm build

      - name: Push database schema
        run: pnpm --filter @mcpctl/db exec prisma db push --accept-data-loss

      - name: Seed templates
        run: node src/mcpd/dist/seed-runner.js

      - name: Start mcpd
        run: node src/mcpd/dist/main.js &

      - name: Wait for mcpd
        run: |
          for i in $(seq 1 30); do
            if curl -sf http://localhost:3100/health > /dev/null 2>&1; then
              echo "mcpd is ready"
              exit 0
            fi
            echo "Waiting for mcpd... ($i/30)"
            sleep 1
          done
          echo "::error::mcpd failed to start within 30s"
          exit 1

      - name: Create CI user and session
        run: |
          pnpm --filter @mcpctl/db exec node -e "
            const { PrismaClient } = require('@prisma/client');
            const crypto = require('crypto');
            (async () => {
              const prisma = new PrismaClient();
              const user = await prisma.user.upsert({
                where: { email: 'ci@test.local' },
                create: { email: 'ci@test.local', name: 'CI', passwordHash: '!ci-no-login', role: 'USER' },
                update: {},
              });
              const token = crypto.randomBytes(32).toString('hex');
              await prisma.session.create({
                data: { token, userId: user.id, expiresAt: new Date(Date.now() + 86400000) },
              });
              await prisma.rbacDefinition.create({
                data: {
                  name: 'ci-admin',
                  subjects: [{ kind: 'User', name: 'ci@test.local' }],
                  roleBindings: [
                    { role: 'edit', resource: '*' },
                    { role: 'run', resource: '*' },
                    { role: 'run', action: 'logs' },
                    { role: 'run', action: 'backup' },
                    { role: 'run', action: 'restore' },
                  ],
                },
              });
              const os = require('os'), fs = require('fs'), path = require('path');
              const dir = path.join(os.homedir(), '.mcpctl');
              fs.mkdirSync(dir, { recursive: true });
              fs.writeFileSync(path.join(dir, 'credentials'),
                JSON.stringify({ token, mcpdUrl: 'http://localhost:3100', user: 'ci@test.local' }));
              console.log('CI user + session + RBAC created, credentials written');
              await prisma.\$disconnect();
            })();
          "

      - name: Create mcpctl CLI wrapper
        run: |
          printf '#!/bin/sh\nexec node "%s/src/cli/dist/index.js" "$@"\n' "$GITHUB_WORKSPACE" > /usr/local/bin/mcpctl
          chmod +x /usr/local/bin/mcpctl

      - name: Configure mcplocal LLM provider
        run: |
          mkdir -p ~/.mcpctl
          cat > ~/.mcpctl/config.json << 'CONF'
          {"llm":{"providers":[{"name":"anthropic","type":"anthropic","model":"claude-haiku-3-5-20241022","tier":"fast"}]}}
          CONF
          printf '{"anthropic-api-key":"%s"}\n' "$ANTHROPIC_API_KEY" > ~/.mcpctl/secrets
          chmod 600 ~/.mcpctl/secrets

      - name: Start mcplocal
        run: nohup node src/mcplocal/dist/main.js > /tmp/mcplocal.log 2>&1 &

      - name: Wait for mcplocal
        run: |
          for i in $(seq 1 30); do
            if curl -sf http://localhost:3200/health > /dev/null 2>&1; then
              echo "mcplocal is ready"
              exit 0
            fi
            echo "Waiting for mcplocal... ($i/30)"
            sleep 1
          done
          echo "::error::mcplocal failed to start within 30s"
          exit 1

      - name: Apply smoke test fixtures
        run: mcpctl apply -f src/mcplocal/tests/smoke/fixtures/smoke-data.yaml

      - name: Verify fixture applied
        run: |
          echo "==> Checking applied fixtures..."
          mcpctl get servers -o json | node -e "
            const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf-8'));
            console.log('Servers:', Array.isArray(d) ? d.map(s=>s.name).join(', ') : 'none');
          "
          mcpctl get projects -o json | node -e "
            const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf-8'));
            console.log('Projects:', Array.isArray(d) ? d.map(p=>p.name).join(', ') : 'none');
          "
          # Server instances require Docker/Podman (container orchestrator).
          # CI has no container runtime, so instances will stay in PENDING.
          # Tests that need running instances are excluded below.
          echo "==> Instance status (informational — no container runtime in CI):"
          mcpctl get instances -o json 2>/dev/null | node -e "
            const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf-8'));
            if (Array.isArray(d)) d.forEach(i => console.log('  ' + (i.serverName||i.name) + ': ' + i.status));
            else console.log('  (none)');
          " || echo "  (no instances)"

      - name: Run smoke tests
        # Server instances need Docker/Podman to start (container-based MCP
        # servers). CI has no container runtime, so exclude tests that
        # require a running server instance or LLM providers.
        # --no-file-parallelism avoids concurrent requests crashing mcplocal.
        run: >-
          pnpm --filter mcplocal exec vitest run
          --config vitest.smoke.config.ts
          --no-file-parallelism
          --exclude '**/security.test.ts'
          --exclude '**/audit.test.ts'
          --exclude '**/proxy-pipeline.test.ts'

      - name: Dump mcplocal log on failure
        if: failure()
        run: cat /tmp/mcplocal.log || true

  # ── Build & package (both amd64 and arm64 sequentially) ──
  # Single job builds both arches — the act runner on NAS can't handle
  # matrix jobs reliably (single-worker, concurrent jobs fail).

  build:
    runs-on: ubuntu-latest
    needs: [lint, typecheck, test]
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          # no pnpm cache — concurrent cache restore hangs on single-worker runner

      - name: Install dependencies (hoisted for bun compile compatibility)
        run: |
          echo "node-linker=hoisted" >> .npmrc
          pnpm install --frozen-lockfile

      - name: Generate Prisma client
        run: pnpm --filter @mcpctl/db exec prisma generate

      - name: Build all packages
        run: pnpm build

      - name: Generate shell completions
        run: pnpm completions:generate

      - uses: oven-sh/setup-bun@v2

      - name: Install nfpm
        run: |
          curl -sL -o /tmp/nfpm.tar.gz "https://github.com/goreleaser/nfpm/releases/download/v2.45.0/nfpm_2.45.0_Linux_x86_64.tar.gz"
          tar xzf /tmp/nfpm.tar.gz -C /usr/local/bin nfpm

      - name: Prepare bun stubs
        run: |
          # Stub for optional dep that Ink tries to import (only used when DEV=true)
          # Copy instead of symlink — bun can't read directory symlinks
          if [ ! -e node_modules/react-devtools-core/package.json ]; then
            rm -rf node_modules/react-devtools-core
            cp -r src/cli/stubs/react-devtools-core node_modules/react-devtools-core
          fi

      - name: Bundle and package (amd64)
        run: |
          source scripts/arch-helper.sh
          resolve_arch "amd64"
          mkdir -p dist
          bun build src/cli/src/index.ts --compile --outfile dist/mcpctl
          bun build src/mcplocal/src/main.ts --compile --outfile dist/mcpctl-local
          echo "==> Packaging amd64..."
          NFPM_ARCH=amd64 nfpm pkg --packager rpm --target dist/
          NFPM_ARCH=amd64 nfpm pkg --packager deb --target dist/
          ls -la dist/mcpctl-*.rpm dist/mcpctl*.deb

      - name: Bundle and package (arm64)
        run: |
          source scripts/arch-helper.sh
          resolve_arch "arm64"
          rm -f dist/mcpctl dist/mcpctl-local
          bun build src/cli/src/index.ts --compile --target bun-linux-arm64 --outfile dist/mcpctl
          bun build src/mcplocal/src/main.ts --compile --target bun-linux-arm64 --outfile dist/mcpctl-local
          echo "==> Packaging arm64..."
          NFPM_ARCH=arm64 nfpm pkg --packager rpm --target dist/
          NFPM_ARCH=arm64 nfpm pkg --packager deb --target dist/
          ls -la dist/mcpctl-*.rpm dist/mcpctl*.deb

      - name: Upload artifacts
        uses: actions/upload-artifact@v3
        with:
          name: packages
          path: |
            dist/mcpctl-*.rpm
            dist/mcpctl*.deb
          retention-days: 7

  # ── Release pipeline (main branch push only) ──────────────
  # NOTE: Docker image builds + deploy happen via `bash fulldeploy.sh`
  # (not CI) because the runner containers lack the privileged access
  # needed for container-in-container builds (no /proc/self/uid_map,
  # no Docker socket access, buildah/podman/kaniko all fail).

  publish:
    runs-on: ubuntu-latest
    needs: [build, smoke]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    steps:
      - uses: actions/checkout@v4

      - name: Download package artifacts
        uses: actions/download-artifact@v3
        with:
          name: packages
          path: dist/

      - name: List packages
        run: ls -la dist/

      - name: Publish RPMs to Gitea
        env:
          GITEA_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
          GITEA_URL: http://${{ env.GITEA_REGISTRY }}
          GITEA_OWNER: ${{ env.GITEA_OWNER }}
        run: |
          for RPM_FILE in dist/mcpctl-*.rpm; do
            echo "Publishing $RPM_FILE..."
            HTTP_CODE=$(curl -s -o /tmp/rpm-upload.out -w "%{http_code}" \
              -X PUT \
              -H "Authorization: token ${GITEA_TOKEN}" \
              --upload-file "$RPM_FILE" \
              "${GITEA_URL}/api/packages/${GITEA_OWNER}/rpm/upload")

            if [ "$HTTP_CODE" = "201" ] || [ "$HTTP_CODE" = "200" ]; then
              echo "  Published!"
            elif [ "$HTTP_CODE" = "409" ]; then
              echo "  Already exists, skipping"
            else
              echo "  Upload returned HTTP $HTTP_CODE"
              cat /tmp/rpm-upload.out 2>/dev/null || true
              exit 1
            fi
            rm -f /tmp/rpm-upload.out
          done

          source scripts/link-package.sh
          link_package "rpm" "mcpctl"

      - name: Publish DEBs to Gitea
        env:
          GITEA_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
          GITEA_URL: http://${{ env.GITEA_REGISTRY }}
          GITEA_OWNER: ${{ env.GITEA_OWNER }}
        run: |
          DISTRIBUTIONS="trixie forky noble plucky"

          for DEB_FILE in dist/mcpctl*.deb; do
            echo "Publishing $DEB_FILE..."
            for DIST in $DISTRIBUTIONS; do
              HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
                -X PUT \
                -H "Authorization: token ${GITEA_TOKEN}" \
                --upload-file "$DEB_FILE" \
                "${GITEA_URL}/api/packages/${GITEA_OWNER}/debian/pool/${DIST}/main/upload")

              if [ "$HTTP_CODE" = "201" ] || [ "$HTTP_CODE" = "200" ]; then
                echo "  -> $DIST: published"
              elif [ "$HTTP_CODE" = "409" ]; then
                echo "  -> $DIST: already exists"
              else
                echo "  -> $DIST: HTTP $HTTP_CODE (warning)"
              fi
            done
          done

          source scripts/link-package.sh
          link_package "debian" "mcpctl"