name: Polaris CI

on:
  push:
    tags:
      - 'polaris-v*'

jobs:
  verify:
    runs-on: polaris-ci
    container: node:22.23.2-bookworm
    timeout-minutes: 30
    defaults:
      run:
        working-directory: ts/web/nextjs/polaris
    steps:
      - name: 检出仓库
        uses: https://gitea.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262

      - name: 安装依赖
        run: corepack pnpm install --frozen-lockfile

      - name: 代码检查
        run: corepack pnpm lint

      - name: 类型检查
        run: corepack pnpm typecheck

      - name: 运行测试
        run: corepack pnpm test

      - name: 构建独立服务器
        run: corepack pnpm build

      - name: 准备独立部署文件
        run: |
          test -f .next/standalone/server.js
          cp -r public .next/standalone/
          cp -r .next/static .next/standalone/.next/

      - name: 独立服务器冒烟测试
        shell: bash
        run: |
          set -euo pipefail
          base_url="http://127.0.0.1:3100"
          PORT=3100 HOSTNAME=127.0.0.1 node .next/standalone/server.js &
          server_pid=$!
          trap 'kill "$server_pid" 2>/dev/null || true' EXIT

          ready=0
          for _ in $(seq 1 30); do
            if curl -fsS -o /dev/null "$base_url/"; then
              ready=1
              break
            fi
            kill -0 "$server_pid" 2>/dev/null || { echo "服务器进程提前退出" >&2; exit 1; }
            sleep 1
          done
          test "$ready" -eq 1 || { echo "服务器在 30 秒内未就绪" >&2; exit 1; }

          curl -fsS -o /dev/null "$base_url/categories/dev/"
          curl -fsS -o /dev/null "$base_url/brand/logo.svg"

          static_asset=$(curl -fsS "$base_url/" | grep -o '/_next/static/[^"]*' | sed -n '1p')
          test -n "$static_asset" || { echo "首页未引用 /_next/static 静态资源" >&2; exit 1; }
          curl -fsS -o /dev/null "$base_url$static_asset"

  publish:
    needs: verify
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/polaris-v')
    runs-on: polaris-ci
    container: node:22.23.2-bookworm
    timeout-minutes: 30
    steps:
      - name: 检出仓库
        uses: https://gitea.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262

      # Daemon comes from the runner (gitea/runner:3-dind-rootless) via the
      # job container's /var/run/docker.sock. Only the CLI is installed here;
      # DOCKER_HOST stays unset and no host socket is mounted.
      - name: 安装 Docker 命令行工具
        run: |
          set -euo pipefail
          export DEBIAN_FRONTEND=noninteractive
          apt-get update
          apt-get install -y --no-install-recommends docker.io
          docker version

      - name: 确定镜像引用
        shell: bash
        run: |
          set -euo pipefail
          repository="${GITHUB_REPOSITORY:?未设置 GITHUB_REPOSITORY}"
          owner="${repository%%/*}"
          owner="${owner,,}"
          if ! [[ "$owner" =~ ^[a-z0-9]([a-z0-9._-]*[a-z0-9])?$ ]]; then
            echo "::error::所有者名称 '$owner' 不是有效的镜像仓库路径组成部分" >&2
            exit 1
          fi
          image="git.labmem.icu/${owner}/polaris:${GITHUB_SHA}"
          echo "镜像引用：$image"
          echo "IMAGE=$image" >> "$GITHUB_ENV"

      - name: 构建镜像
        run: docker build -t "$IMAGE" ts/web/nextjs/polaris

      - name: 镜像冒烟测试
        shell: bash
        run: |
          set -euo pipefail
          # Use the unique container ID instead of a fixed name so
          # concurrent runs on a shared runner daemon cannot collide.
          container="$(docker run -d "$IMAGE")"
          cleanup() { docker rm -f "$container" >/dev/null 2>&1 || true; }
          trap cleanup EXIT

          probe() {
            docker exec "$container" node -e "fetch('http://127.0.0.1:3000$1').then((r) => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))" >/dev/null 2>&1
          }

          ready=0
          for _ in $(seq 1 30); do
            if probe /; then
              ready=1
              break
            fi
            if [[ "$(docker inspect -f '{{.State.Running}}' "$container")" != "true" ]]; then
              echo "容器提前退出，日志：" >&2
              docker logs "$container" >&2 || true
              exit 1
            fi
            sleep 1
          done
          test "$ready" -eq 1 || { echo "服务器在 30 秒内未就绪" >&2; docker logs "$container" >&2 || true; exit 1; }

          probe /categories/dev/ || { echo "冒烟测试失败：/categories/dev/" >&2; exit 1; }
          probe /brand/logo.svg || { echo "冒烟测试失败：/brand/logo.svg" >&2; exit 1; }
          echo "镜像 $IMAGE 冒烟测试通过"

      - name: 登录并推送镜像
        shell: bash
        env:
          POLARIS_REGISTRY_USER: ${{ secrets.POLARIS_REGISTRY_USER }}
          POLARIS_REGISTRY_TOKEN: ${{ secrets.POLARIS_REGISTRY_TOKEN }}
        run: |
          set -euo pipefail
          if [[ -z "${POLARIS_REGISTRY_USER}" || -z "${POLARIS_REGISTRY_TOKEN}" ]]; then
            echo "::error::缺少 secrets.POLARIS_REGISTRY_USER 或 secrets.POLARIS_REGISTRY_TOKEN，无法登录 git.labmem.icu；请在仓库 Settings -> Actions -> Secrets 配置后重试" >&2
            exit 1
          fi

          # Ephemeral docker config: credentials live only inside this step
          # and are deleted when the step (and with it the job) exits.
          docker_config_dir="$(mktemp -d)"
          push_log_file="$(mktemp)"
          trap 'rm -rf "$docker_config_dir" "$push_log_file"' EXIT

          printf '%s' "$POLARIS_REGISTRY_TOKEN" | docker --config "$docker_config_dir" login git.labmem.icu --username "$POLARIS_REGISTRY_USER" --password-stdin >/dev/null

          echo "正在推送 $IMAGE"
          # tee keeps push output visible in the log; pipefail (already set
          # via `set -euo pipefail`) fails the step when push itself fails.
          docker --config "$docker_config_dir" push "$IMAGE" 2>&1 | tee "$push_log_file"

          digest="$(sed -n 's/.*digest: \(sha256:[0-9a-f]\{64\}\).*/\1/p' "$push_log_file" | tail -n 1)"
          if [[ ! "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]; then
            echo "::error::push 日志中未解析到合法 digest（期望 sha256:<64 位十六进制>），不输出部署引用；请在 registry 界面确认该镜像的实际 digest 后再手动部署" >&2
            exit 1
          fi

          echo "已发布镜像：$IMAGE"
          echo "镜像摘要：$digest"
          echo "手动部署引用：docker pull ${IMAGE%%:*}@$digest"