name: Test Actions (self-test)

on:
  workflow_dispatch: {}
  push:
    branches:
      - main
    paths:
      - build-and-push/**
      - deploy-restart/**
      - kubectl-apply/**
      - ssh-deploy/**
      - .gitea/workflows/test-build.yaml
      - tests/**

env:
  IMAGE: git.ivanch.me/ivanch/pipeline-actions-selftest

jobs:
  test-build-push:
    name: Build tiny multi-arch image
    runs-on: ubuntu-amd64
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Generate a minimal Dockerfile
        shell: bash
        run: |
          mkdir -p _selftest
          cat > _selftest/Dockerfile <<'EOF'
          FROM alpine:3.20
          RUN echo "pipeline-actions self-test build OK"
          CMD ["true"]
          EOF

      - name: Build and push via composite action
        uses: https://git.ivanch.me/ivanch/pipeline-actions/build-and-push@main
        with:
          image: ${{ env.IMAGE }}
          image_tag: citest
          build_context: _selftest
          build_dockerfile: Dockerfile
          registry_password: ${{ secrets.REGISTRY_PASSWORD }}
          ssh_key: ${{ secrets.SSH_KEY_DOCKERBUILD }}

      - name: Verify pushed image is pullable and multi-arch
        shell: bash
        env:
          IMAGE: ${{ env.IMAGE }}
        run: |
          echo "== inspecting ${IMAGE}:citest manifest =="
          docker buildx imagetools inspect "${IMAGE}:citest"
          # Assert both target arches are present in the manifest list.
          MANIFEST="$(docker buildx imagetools inspect "${IMAGE}:citest")"
          echo "${MANIFEST}" | grep -q "linux/amd64" || { echo "missing linux/amd64"; exit 1; }
          echo "${MANIFEST}" | grep -q "linux/arm64" || { echo "missing linux/arm64"; exit 1; }
          echo "self-test PASSED: multi-arch image built and pushed"

  test-k8s:
    name: Test Kubernetes actions
    runs-on: ubuntu-amd64
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Apply test manifests
        uses: https://git.ivanch.me/ivanch/pipeline-actions/kubectl-apply@main
        with:
          kube_config: ${{ secrets.KUBE_CONFIG }}
          manifests: tests/manifests/test-namespace.yaml,tests/manifests/test-deployment.yaml

      - name: Restart test deployment
        uses: https://git.ivanch.me/ivanch/pipeline-actions/deploy-restart@main
        with:
          kube_config: ${{ secrets.KUBE_CONFIG }}
          deployment_name: pipeline-actions-test
          namespace: pipeline-actions-test

      - name: Verify deployment rollout status
        shell: bash
        run: |
          printf '%s' "${{ secrets.KUBE_CONFIG }}" | tr -d '\r' > kubeconfig.yaml
          kubectl --kubeconfig=kubeconfig.yaml rollout status deployment/pipeline-actions-test -n pipeline-actions-test --timeout=60s

      - name: Clean up Kubernetes resources
        if: always()
        shell: bash
        run: |
          if [ -f kubeconfig.yaml ]; then
            kubectl --kubeconfig=kubeconfig.yaml delete namespace pipeline-actions-test --ignore-not-found=true --timeout=30s
          else
            printf '%s' "${{ secrets.KUBE_CONFIG }}" | tr -d '\r' > kubeconfig.yaml
            kubectl --kubeconfig=kubeconfig.yaml delete namespace pipeline-actions-test --ignore-not-found=true --timeout=30s
          fi

  test-ssh:
    name: Test SSH deploy action
    runs-on: ubuntu-amd64
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install and configure SSH server
        shell: bash
        run: |
          sudo apt-get update
          sudo apt-get install -y openssh-server

          # Ensure privilege separation directory exists
          sudo mkdir -p /run/sshd

          # Generate host keys if missing
          sudo ssh-keygen -A

          # Start sshd on a custom port 2222 to avoid port conflicts on the runner host
          sudo /usr/sbin/sshd -p 2222 -o "ListenAddress 127.0.0.1" -o "UsePAM yes"

          # Configure passwordless SSH login for current user
          mkdir -p ~/.ssh
          ssh-keygen -t ed25519 -N "" -f ~/.ssh/id_test
          cat ~/.ssh/id_test.pub >> ~/.ssh/authorized_keys
          chmod 700 ~/.ssh
          chmod 600 ~/.ssh/authorized_keys

          # Establish environment variables for subsequent steps
          echo "SSH_USER=$(whoami)" >> "$GITHUB_ENV"
          echo "TEST_REMOTE_DIR=$HOME/ssh_deploy_test" >> "$GITHUB_ENV"

          # Write the private key to GitHub/Gitea env securely using multiline syntax
          echo "SSH_PRIVATE_KEY<<EOF" >> "$GITHUB_ENV"
          cat ~/.ssh/id_test >> "$GITHUB_ENV"
          echo "EOF" >> "$GITHUB_ENV"

      - name: Verify SSH localhost access
        shell: bash
        run: |
          ssh -p 2222 -i ~/.ssh/id_test -o StrictHostKeyChecking=accept-new "${SSH_USER}@127.0.0.1" "echo 'Localhost SSH OK'"

      - name: Set up remote compose directory and files
        shell: bash
        run: |
          mkdir -p "${TEST_REMOTE_DIR}"
          # We write a compose file containing nginx:latest
          cat > "${TEST_REMOTE_DIR}/docker-compose.yml" <<'EOF'
          services:
            test-nginx:
              image: nginx:latest
              container_name: pipeline-actions-ssh-test
              restart: always
          EOF

      - name: Deploy via composite action with image override
        uses: https://git.ivanch.me/ivanch/pipeline-actions/ssh-deploy@main
        with:
          ssh_host: "127.0.0.1"
          ssh_port: "2222"
          ssh_username: ${{ env.SSH_USER }}
          ssh_key: ${{ env.SSH_PRIVATE_KEY }}
          remote_dir: ${{ env.TEST_REMOTE_DIR }}
          image: "nginx"
          image_tag: "alpine"

      - name: Verify container started and image pin succeeded
        shell: bash
        run: |
          echo "Checking container status..."
          docker ps -a
          STATUS=$(docker ps --filter "name=pipeline-actions-ssh-test" --format "{{.Status}}")
          echo "Container status: ${STATUS}"
          echo "${STATUS}" | grep -q "Up" || { echo "Container is not running"; exit 1; }

          echo "Checking image pin..."
          IMAGE_USED=$(docker inspect pipeline-actions-ssh-test --format '{{.Config.Image}}')
          echo "Container is using image: ${IMAGE_USED}"
          echo "${IMAGE_USED}" | grep -q "nginx:alpine" || { echo "Image pin failed"; exit 1; }
          echo "self-test PASSED: container is running and using nginx:alpine"

      - name: Clean up SSH deployment resources
        if: always()
        shell: bash
        run: |
          if [ -d "${TEST_REMOTE_DIR}" ]; then
            cd "${TEST_REMOTE_DIR}"
            docker compose down || true
            rm -rf "${TEST_REMOTE_DIR}"
          fi