name: backend-integration-tests

on:
  push:
    branches:
      - main
      - high-performance

concurrency:
  group: backend-tests-${{ github.ref }}
  cancel-in-progress: true

jobs:
  ai-credits:
    runs-on: docker-ready
    env:
      TEST_DATABASE_URL: ${{ secrets.TEST_DATABASE_URL }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Check for relevant changes
        id: check
        run: |
          set -euo pipefail
          if git rev-parse --verify HEAD^ >/dev/null 2>&1; then
            BASE="${{ github.event.before }}"
            if [ -z "$BASE" ] || [ "$BASE" = "0000000000000000000000000000000000000000" ] \
               || ! git rev-parse --verify "${BASE}^{commit}" >/dev/null 2>&1; then
              BASE="HEAD^"
            fi
            CHANGED_FILES="$(git diff --name-only "$BASE" HEAD)"
          else
            CHANGED_FILES="$(git ls-files)"
          fi

          run=false
          if echo "$CHANGED_FILES" | grep -Eq '^(crates/db/|Cargo\.toml|Cargo\.lock|Dockerfile\.test|\.forgejo/workflows/test\.yaml)'; then
            run=true
          fi
          echo "run=$run" >> "$GITHUB_OUTPUT"
          if [ "$run" = "false" ]; then
            echo "No changes relevant to crates/db - skipping integration tests."
          fi

      - name: Verify TEST_DATABASE_URL is configured
        if: steps.check.outputs.run == 'true'
        run: |
          test -n "${TEST_DATABASE_URL:-}" || { echo "TEST_DATABASE_URL secret is not set - see docs/LIVE_SERVER_RUNBOOK.md step 6"; exit 1; }

      - name: Point DOCKER_HOST at this container's own gateway
        if: steps.check.outputs.run == 'true'
        run: |
          set -euo pipefail
          # Same trick build.yaml uses: this job container is nested one level
          # inside the runner pod's dind sidecar, so its own loopback isn't the
          # sidecar's - read the container's actual default-route gateway
          # directly from /proc/net/route instead of relying on `ip`/`route`.
          GATEWAY="$(awk '$2 == "00000000" {print $3}' /proc/net/route | head -1 | \
            sed -E 's/(..)(..)(..)(..)/0x\4 0x\3 0x\2 0x\1/' | \
            { read -r a b c d; printf '%d.%d.%d.%d' "$a" "$b" "$c" "$d"; })"
          echo "Detected docker host gateway: $GATEWAY"
          echo "DOCKER_HOST=tcp://$GATEWAY:2375" >> "$GITHUB_ENV"

      - name: Set up Docker Buildx
        if: steps.check.outputs.run == 'true'
        run: |
          set -euo pipefail
          docker version
          docker buildx create --use --name nxtgauge-builder || docker buildx use nxtgauge-builder
          docker buildx inspect --bootstrap

      - name: Run ai_credits integration tests
        if: steps.check.outputs.run == 'true'
        run: |
          set -euo pipefail
          # Build context transfer (not a bind mount) is what makes this work
          # despite the nested dind setup - same reason build.yaml uses
          # buildx rather than plain `docker run -v`. The Dockerfile's RUN
          # step is the actual test; a non-zero exit fails this build (and
          # this workflow step) the same way a failed `cargo test` would.
          docker buildx build \
            --secret id=test_db_url,env=TEST_DATABASE_URL \
            -f Dockerfile.test \
            .