name: Quality checks

on:
  pull_request:
  workflow_call:

permissions:
  contents: read

jobs:
  backend:
    name: Backend checks
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: backend
    # 后端有 5 个用例默认会静默跳过：3 个需要 CANVAS_TEST_POSTGRES_DSN（PostgreSQL 迁移、
    # 素材字节修复、画布版本历史），2 个用 exec.LookPath("redis-server") 自起临时实例
    # （Redis 租约、缓存白名单）。只跑 go test ./... 而不备齐这两样，这些路径永远不会被执行。
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_PASSWORD: canvas_test
          POSTGRES_DB: canvas_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 12
    env:
      CANVAS_TEST_POSTGRES_DSN: postgres://postgres:canvas_test@127.0.0.1:5432/canvas_test?sslmode=disable
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: backend/go.mod
          cache-dependency-path: backend/go.sum
          cache: true
      - name: Install redis-server for integration tests
        # 用例自己拉起临时 redis-server（unix socket），所以需要的是可执行文件而不是 redis 服务。
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq redis-server
          sudo systemctl stop redis-server || true
      - name: Check formatting
        run: test -z "$(gofmt -l .)"
      - name: Run Go tests
        shell: bash
        run: |
          set -o pipefail
          go test -json ./... | tee "$RUNNER_TEMP/go-tests.jsonl"
      - name: Ensure dependency-backed tests were not skipped
        shell: bash
        run: |
          python3 ../.github/scripts/test_check_dependency_tests.py
          python3 ../.github/scripts/check-dependency-tests.py "$RUNNER_TEMP/go-tests.jsonl"
      - name: Upload Go test timings
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: go-test-timings
          path: ${{ runner.temp }}/go-tests.jsonl
          if-no-files-found: ignore

  payment-plugins:
    name: Payment plugin artifacts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Verify canonical payment packages
        env:
          PAYMENT_PLUGIN_SMOKE_TEST: "1"
        run: sh plugin-packages/verify-payment-packages.sh --all linux amd64
      # 发布时 backend/Dockerfile 会在两种架构的原生 Runner 上执行 smoke。
      # PR 仍独立验证双架构，不能因没有发布任务而遗漏 ARM64 验收。
      - uses: docker/setup-qemu-action@v3
        if: github.event_name == 'pull_request'
      - uses: docker/setup-buildx-action@v3
        if: github.event_name == 'pull_request'
      - name: Build and execute payment packages for every image platform
        if: github.event_name == 'pull_request'
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          target: payment-package-smoke
          file: backend/Dockerfile
          cache-from: type=gha,scope=payment-smoke
          cache-to: type=gha,mode=max,scope=payment-smoke

  web:
    name: Web checks
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: web
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.9
      - name: Reject leftover package manager lockfiles
        working-directory: ${{ github.workspace }}
        run: |
          leftover=0
          for file in web/pnpm-lock.yaml web/package-lock.json web/yarn.lock; do
            if [ -f "$file" ]; then
              echo "forbidden lockfile: $file"
              leftover=1
            fi
          done
          if [ "$leftover" -ne 0 ]; then
            echo "web installs from bun.lock only"
            exit 1
          fi
      - name: Install dependencies
        run: bun install --frozen-lockfile
      - name: Check formatting
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
        run: bun scripts/check-changed-formatting.mjs
      - name: Typecheck
        run: bun run typecheck
      - name: Lint retired Ant Design APIs
        run: bun run lint
      - name: Run tests
        run: bun run test
      # ubuntu-latest 预装 google-chrome；脚本的解析顺序已覆盖该路径，
      # 因此不引入第三方 setup action，也不需要任何 secret。
      - name: Director P0 Chrome E2E
        run: |
          google-chrome --version || chromium --version
          bun run test:director:e2e