# Copyright 2025, 2026 Element Creations Ltd.
# Copyright 2025 New Vector Ltd.
#
# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
# Please see LICENSE files in the repository root for full details.

name: CI

on:
  push:
    branches:
      - main
      - "release/**"
    tags:
      - "v*"
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
  SCCACHE_GHA_ENABLED: "true"
  RUSTC_WRAPPER: "sccache"

jobs:
  opa-lint:
    name: Lint and test OPA policies
    runs-on: ubuntu-24.04

    permissions:
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          persist-credentials: false

      - uses: ./.github/actions/build-policies

      - name: Setup Regal
        uses: open-policy-agent/setup-regal@761188c3b435761fa254beca508a44875619648f # v2.0.0
        with:
          # Keep in sync with policies/Makefile
          version: 0.38.1

      - name: Lint policies
        working-directory: ./policies
        run: make lint

      - name: Run OPA tests
        working-directory: ./policies
        run: make test

  frontend-lint:
    name: Check frontend style
    runs-on: ubuntu-24.04

    permissions:
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          persist-credentials: false

      - name: Install pnpm
        uses: pnpm/action-setup@v6.0.9

      - name: Install Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .node-version
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint
        run: pnpm --filter mas-frontend run lint

  frontend-test:
    name: Run the frontend test suite
    runs-on: ubuntu-24.04

    permissions:
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          persist-credentials: false

      - name: Install pnpm
        uses: pnpm/action-setup@v6.0.9

      - name: Install Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .node-version
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Test
        run: pnpm --filter mas-frontend test

  frontend-knip:
    name: Check the frontend for unused dependencies
    runs-on: ubuntu-24.04

    permissions:
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          persist-credentials: false

      - name: Install pnpm
        uses: pnpm/action-setup@v6.0.9

      - name: Install Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .node-version
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Check for unused dependencies
        run: pnpm --filter mas-frontend run knip

  rustfmt:
    name: Check Rust style
    runs-on: ubuntu-24.04

    permissions:
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        # Install the minimal toolchain, which includes rustc, rustdoc, and cargo.
        # Then install rustfmt for `cargo fmt`.
        #
        # --override sets this as the default rust toolchain version in this directory.
        run: |
          rustup toolchain install nightly --profile minimal --component rustfmt --override

      - name: Check style
        run: cargo fmt --all -- --check

  cargo-deny:
    name: Run `cargo deny` checks
    runs-on: ubuntu-24.04

    env:
      # We need to remove the sccache wrapper because we don't install it in this job
      RUSTC_WRAPPER: ""

    permissions:
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          persist-credentials: false

      - name: Run `cargo-deny`
        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
        with:
          rust-version: stable

  check-schema:
    name: Check schema
    runs-on: ubuntu-24.04

    permissions:
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        run: |
          rustup toolchain install stable

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10

      - uses: ./.github/actions/build-frontend

      - name: Update the schemas
        run: sh ./misc/update.sh

      - name: Check that the workspace is clean
        run: |
          if ! [[ -z $(git status -s) ]]; then
            echo "::error title=Workspace is not clean::Please run 'sh ./misc/update.sh' and commit the changes"

            (
              echo '## Diff after running `sh ./misc/update.sh`:'
              echo
              echo '```diff'
              git diff
              echo '```'
            ) >> $GITHUB_STEP_SUMMARY

            exit 1
          fi

  clippy:
    name: Run Clippy
    needs: [rustfmt, opa-lint]
    runs-on: ubuntu-24.04

    permissions:
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        # Install the minimal toolchain with clippy, pinned to a version kept in
        # sync with Dockerfile.
        #
        # --override sets this as the default rust toolchain version in this directory.
        run: rustup toolchain install 1.96.0 --profile minimal --component clippy --override

      - uses: ./.github/actions/build-policies

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10

      - name: Run clippy
        run: |
          cargo clippy --workspace --tests --bins --lib -- -D warnings

  compile-test-artifacts:
    name: Compile test artifacts
    runs-on: ubuntu-24.04

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        # Install the minimal toolchain, which includes rustc, rustdoc, and cargo.
        run: rustup toolchain install stable --profile minimal

      - name: Install nextest
        uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2
        with:
          tool: cargo-nextest

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10

      - name: Build and archive tests
        run: cargo nextest archive --workspace --archive-file nextest-archive.tar.zst
        env:
          SQLX_OFFLINE: "1"

      - name: Upload archive to workflow
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: nextest-archive
          path: nextest-archive.tar.zst

  test:
    name: Run test suite with Rust stable
    needs: [rustfmt, opa-lint, compile-test-artifacts]
    runs-on: ubuntu-24.04

    permissions:
      contents: read

    strategy:
      matrix:
        partition: [1, 2, 3]

    services:
      postgres:
        image: docker.io/library/postgres:15.3
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: postgres
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - "5432:5432"

    steps:
      - name: Checkout the code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        # Install the minimal toolchain, which includes rustc, rustdoc, and cargo.
        run: rustup toolchain install stable --profile minimal

      - name: Install nextest
        uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2
        with:
          tool: cargo-nextest

      - uses: ./.github/actions/build-frontend
      - uses: ./.github/actions/build-policies

      - name: Download archive
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: nextest-archive

      - name: Test
        env:
          DATABASE_URL: postgresql://postgres:postgres@localhost/postgres
        run: |
          ~/.cargo/bin/cargo-nextest nextest run \
            --archive-file nextest-archive.tar.zst \
            --partition count:${{ matrix.partition }}/3

  ess:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Get current branch name
        id: current-branch
        run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT

      - name: Check if branch exists in element-hq/ess-helm
        id: check-branch
        env:
          BRANCH_NAME: ${{ steps.current-branch.outputs.branch }}
        run: |
          API_URL="https://api.github.com/repos/element-hq/ess-helm/branches/$BRANCH_NAME"
          RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" $API_URL)
          if [ "$RESPONSE" = "200" ]; then
            echo "ref=$BRANCH_NAME" | tee -a $GITHUB_OUTPUT
          else
            echo "ref=main" | tee -a $GITHUB_OUTPUT
          fi

      - name: Install ESS test dependencies
        uses: element-hq/setup-ess-cluster-action@23c5b953699591752a7385e143af59607a68c85e # release/v2
        with:
          ess-helm-ref: ${{ steps.check-branch.outputs.ref }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
        with:
          # The builder runs in a container, so it needs the host network to
          # push to the registry listening on the host's localhost:5000
          driver-opts: network=host
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["mirror.gcr.io"]

      - name: Build MAS docker image to local registry
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          cache-from: type=registry,ref=ghcr.io/element-hq/matrix-authentication-service/buildcache:buildcache-amd64
          push: true
          tags: localhost:5000/matrix-authentication-service:ci

      - name: Build Additional values file
        run: >
          yq eval -n '.matrixAuthenticationService.image.registry = "localhost:5000" |
          .matrixAuthenticationService.image.repository = "matrix-authentication-service" |
          .matrixAuthenticationService.image.tag = "ci"' > ci-values.yml

      - name: Run ESS tests
        run: pytest-ess --test-suite "matrix-authentication-service" --additional-test-values-file ci-values.yml -- -vv

      - name: Collect ESS logs
        if: ${{ failure() }}
        run: collect-ess-logs

      - name: Upload logs
        if: ${{ failure() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: ess-helm-logs
          path: ess-helm-logs
          retention-days: 1

  tests-done:
    name: Tests done
    if: ${{ always() }}
    needs:
      - opa-lint
      - frontend-lint
      - frontend-test
      - frontend-knip
      - rustfmt
      - cargo-deny
      - clippy
      - check-schema
      - ess
      - test
    runs-on: ubuntu-24.04

    steps:
      - uses: matrix-org/done-action@3409aa904e8a2aaf2220f09bc954d3d0b0a2ee67 # v3
        with:
          needs: ${{ toJSON(needs) }}