---
name: Main

'on':
  push:
    branches:
      - master
      - main
  workflow_dispatch:

permissions:
  contents: read

jobs:
  syntax-check:
    name: Ansible syntax check
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98  # v5.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: '3.11'

      - name: Setup uv environment
        uses: ./.github/actions/setup-uv

      - name: Check Ansible playbook syntax
        run: uv run ansible-playbook main.yml --syntax-check

  basic-tests:
    name: Basic sanity tests
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98  # v5.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: '3.11'

      - name: Setup uv environment
        uses: ./.github/actions/setup-uv

      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y shellcheck

      - name: Run basic sanity tests
        run: uv run pytest tests/unit/ -v

  docker-build:
    name: Docker build test
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98  # v5.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: '3.11'

      - name: Setup uv environment
        uses: ./.github/actions/setup-uv

      - name: Build Docker image
        run: docker build -t local/algo:test .

      - name: Test Docker image starts
        run: |
          # Just verify the image can start and show help
          docker run --rm local/algo:test /algo/algo --help

      - name: Run Docker deployment tests
        run: uv run pytest tests/unit/test_docker_localhost_deployment.py -v

  config-generation:
    name: Configuration generation test
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98  # v5.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: '3.11'

      - name: Setup uv environment
        uses: ./.github/actions/setup-uv

      - name: Test configuration generation (local mode)
        run: |
          # Run our simplified config test
          chmod +x tests/test-local-config.sh
          ./tests/test-local-config.sh

  ansible-dry-run:
    name: Ansible dry-run validation
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    permissions:
      contents: read
    strategy:
      matrix:
        provider: [local, ec2, digitalocean, gce]
    steps:
      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98  # v5.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: '3.11'

      - name: Setup uv environment
        uses: ./.github/actions/setup-uv

      - name: Create test configuration for ${{ matrix.provider }}
        run: |
          # Create provider-specific test config
          cat > test-${{ matrix.provider }}.cfg << 'EOF'
          users:
            - testuser
          cloud_providers:
            ${{ matrix.provider }}:
              server: test-server
              size: t3.micro
              image: ubuntu-22.04
              region: us-east-1
          wireguard_enabled: true
          ipsec_enabled: false
          dns_adblocking: false
          ssh_tunneling: false
          store_pki: true
          algo_provider: ${{ matrix.provider }}
          algo_server_name: test-algo-vpn
          server: test-server
          endpoint: 10.0.0.1
          ansible_ssh_user: ubuntu
          ansible_ssh_port: 22
          algo_ssh_port: 4160
          algo_ondemand_cellular: false
          algo_ondemand_wifi: false
          EOF

      - name: Run Ansible check mode for ${{ matrix.provider }}
        run: |
          # Run ansible in check mode to validate playbooks work
          uv run ansible-playbook main.yml \
            -i "localhost," \
            -c local \
            -e @test-${{ matrix.provider }}.cfg \
            -e "provider=${{ matrix.provider }}" \
            --check \
            --diff \
            -vv \
            --skip-tags "facts,tests,local,update-alternatives,cloud_api" || true

          # The || true is because check mode will fail on some tasks
          # but we're looking for syntax/undefined variable errors