name: CI/CD Pipeline

on:
  push:
    branches:
      - main
      - dev
      - "feature/**"
  pull_request:
    branches:
      - main
      - dev
  workflow_dispatch:
    inputs:
      manual_action:
        description: "Manual action: noop, cleanup_dev_database, or dokploy_start"
        required: true
        default: "noop"
      dokploy_target:
        description: "Dokploy dev target: all, web, or celery"
        required: true
        default: "all"
      cleanup_confirm:
        description: "Type CLEAN_DEV_DB to drop and recreate the dev public schema"
        required: false
        default: ""

env:
  PYTHON_VERSION: "3.11"
  UV_VERSION: "0.7.2"
  PIP_DISABLE_PIP_VERSION_CHECK: "1"

jobs:
  lint:
    name: Code Quality Checks
    runs-on: ubuntu-latest
    if: ${{ github.event_name != 'workflow_dispatch' && !contains(github.event.head_commit.message, '#no_lint') }}
    env:
      TG_BOT_KEY: ${{ secrets.TG_BOT_KEY }}
      TG_CHANNEL: ${{ secrets.TG_CHANNEL }}

    steps:
      - name: Checkout code
        run: |
          REPO_URL=$(echo "${GITHUB_SERVER_URL}" | sed "s|://|://oauth2:${{ gitea.token }}@|")
          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
          git clone --depth=1 --branch="${BRANCH}" "${REPO_URL}/${GITHUB_REPOSITORY}.git" .
          git checkout "${GITHUB_SHA}"

      - name: Install Python and uv
        run: |
          set -euo pipefail
          apt-get update
          apt-get install -y software-properties-common
          add-apt-repository -y ppa:deadsnakes/ppa
          apt-get update
          apt-get install -y python3.11 python3.11-venv

      - name: Create virtual environment and install dependencies
        run: |
          set -euo pipefail
          python3.11 -m venv .venv
          . .venv/bin/activate
          python -m pip install "uv==${UV_VERSION}"
          uv sync \
            --dev \
            --frozen \
            --active \
            --python "$(command -v python3.11)" \
            --no-managed-python \
            --no-python-downloads

      - name: Run Ruff linting
        run: |
          set -euo pipefail
          . .venv/bin/activate
          ruff check src

      - name: Run Ruff formatting check
        run: |
          set -euo pipefail
          . .venv/bin/activate
          ruff format src --check

      - name: Telegram notify (lint failed)
        if: failure()
        continue-on-error: true
        run: |
          set -euo pipefail
          if [ -z "${TG_BOT_KEY:-}" ] || [ -z "${TG_CHANNEL:-}" ]; then
            echo "TG_BOT_KEY or TG_CHANNEL is not set; skip telegram notification"
            exit 0
          fi

          MSG="❌ [mostovik-backend] lint failed
          branch=${GITHUB_REF_NAME}
          sha=${GITHUB_SHA}
          actor=${GITHUB_ACTOR}"

          curl -fsS \
            --connect-timeout 5 \
            --max-time 15 \
            --retry 1 \
            -X POST "https://api.telegram.org/bot${TG_BOT_KEY}/sendMessage" \
            -d "chat_id=${TG_CHANNEL}" \
            --data-urlencode "text=${MSG}"

  test:
    name: Run Tests
    runs-on: ubuntu-latest
    if: ${{ github.event_name != 'workflow_dispatch' && !contains(github.event.head_commit.message, '#no_test') }}
    env:
      TG_BOT_KEY: ${{ secrets.TG_BOT_KEY }}
      TG_CHANNEL: ${{ secrets.TG_CHANNEL }}

    steps:
      - name: Checkout code
        run: |
          REPO_URL=$(echo "${GITHUB_SERVER_URL}" | sed "s|://|://oauth2:${{ gitea.token }}@|")
          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
          git clone --depth=1 --branch="${BRANCH}" "${REPO_URL}/${GITHUB_REPOSITORY}.git" .
          git checkout "${GITHUB_SHA}"

      - name: Install Python and uv
        run: |
          set -euo pipefail
          apt-get update
          apt-get install -y software-properties-common
          add-apt-repository -y ppa:deadsnakes/ppa
          apt-get update
          apt-get install -y python3.11 python3.11-venv

      - name: Create virtual environment and install dependencies
        run: |
          set -euo pipefail
          python3.11 -m venv .venv
          . .venv/bin/activate
          python -m pip install "uv==${UV_VERSION}"
          uv sync \
            --dev \
            --frozen \
            --active \
            --python "$(command -v python3.11)" \
            --no-managed-python \
            --no-python-downloads

      - name: Run pytest suite
        env:
          DJANGO_SETTINGS_MODULE: settings.test
          SECRET_KEY: test-secret-key-for-ci
        run: |
          set -euo pipefail
          . .venv/bin/activate
          export PYTHONPATH="${PWD}/src:${PYTHONPATH:-}"
          python -m pytest tests --ignore=tests/test_api_inventory_e2e.py -q

      - name: Telegram notify (test failed)
        if: failure()
        continue-on-error: true
        run: |
          set -euo pipefail
          if [ -z "${TG_BOT_KEY:-}" ] || [ -z "${TG_CHANNEL:-}" ]; then
            echo "TG_BOT_KEY or TG_CHANNEL is not set; skip telegram notification"
            exit 0
          fi

          MSG="❌ [mostovik-backend] test failed
          branch=${GITHUB_REF_NAME}
          sha=${GITHUB_SHA}
          actor=${GITHUB_ACTOR}"

          curl -fsS \
            --connect-timeout 5 \
            --max-time 15 \
            --retry 1 \
            -X POST "https://api.telegram.org/bot${TG_BOT_KEY}/sendMessage" \
            -d "chat_id=${TG_CHANNEL}" \
            --data-urlencode "text=${MSG}"

  notify_success:
    name: Telegram Notify Success
    runs-on: ubuntu-latest
    needs: [lint, test]
    if: |
      always() &&
      github.event_name != 'workflow_dispatch' &&
      needs.lint.result == 'success' &&
      needs.test.result == 'success'
    env:
      TG_BOT_KEY: ${{ secrets.TG_BOT_KEY }}
      TG_CHANNEL: ${{ secrets.TG_CHANNEL }}
    steps:
      - name: Telegram notify (lint+test success)
        continue-on-error: true
        env:
          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
        run: |
          set -euo pipefail
          if [ -z "${TG_BOT_KEY:-}" ] || [ -z "${TG_CHANNEL:-}" ]; then
            echo "TG_BOT_KEY or TG_CHANNEL is not set; skip telegram notification"
            exit 0
          fi

          MSG="✅ [mostovik-backend] lint + tests passed
          branch=${GITHUB_REF_NAME}
          sha=${GITHUB_SHA}
          actor=${GITHUB_ACTOR}
          commit=${COMMIT_MESSAGE:-n/a}"

          curl -fsS \
            --connect-timeout 5 \
            --max-time 15 \
            --retry 1 \
            -X POST "https://api.telegram.org/bot${TG_BOT_KEY}/sendMessage" \
            -d "chat_id=${TG_CHANNEL}" \
            --data-urlencode "text=${MSG}"

  manual_actions_require_dev:
    name: Manual Actions Require Dev Branch
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' && github.ref != 'refs/heads/dev' }}

    steps:
      - name: Explain manual action branch
        run: |
          set -euo pipefail
          echo "Manual actions are implemented in the dev workflow."
          echo "Run this workflow with branch/ref dev."
          exit 1