name: DH V2 CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: dhv2-ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  api:
    name: API · typecheck, tests, build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: api-v3
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '24'
          cache: npm
          cache-dependency-path: api-v3/package-lock.json
      - run: npm ci
      - run: npm run typecheck
      - run: npm test
      - run: npm run build

  web:
    name: WEB · typecheck, build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: web-v2
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '24'
          cache: npm
          cache-dependency-path: web-v2/package-lock.json
      - run: npm ci
      - run: npm run typecheck
      - name: F3.1 WEB contract
        run: bash ../scripts/check-f3-1-web-contract.sh
      - run: npm run build

  contract:
    name: Docker / scripts contract
    runs-on: ubuntu-latest
    needs: [api, web]
    steps:
      - uses: actions/checkout@v4
      - name: Validate shell scripts
        run: |
          while IFS= read -r -d '' script; do
            bash -n "$script"
          done < <(find scripts -type f -name '*.sh' -print0)
      - name: Validate deploy preflight parity
        run: |
          grep -Fq -- '$STAGE/docker-compose.yml:/docker-compose.yml:ro' scripts/deploy-github.sh
          grep -Fq -- '$STAGE/web-v2:/web-v2:ro' scripts/deploy-github.sh
          grep -Fq -- '$STAGE/android-app:/android-app:ro' scripts/deploy-github.sh
      - name: Validate Compose
        run: docker compose --env-file .env.example config >/dev/null
      - name: VPS-equivalent isolated API preflight
        run: |
          set -Eeuo pipefail
          image="dhv2-api:ci-vps-preflight-${GITHUB_SHA::12}"
          docker build --target builder -t "$image" api-v3
          docker run --rm \
            -v "$PWD/api-v3/test:/app/test:ro" \
            -v "$PWD/api-v3/tsconfig.test.json:/app/tsconfig.test.json:ro" \
            -v "$PWD/docker-compose.yml:/docker-compose.yml:ro" \
            -v "$PWD/web-v2:/web-v2:ro" \
            -v "$PWD/android-app:/android-app:ro" \
            "$image" npm test
          docker image rm "$image" >/dev/null 2>&1 || true
      - name: Build production images
        run: docker compose --env-file .env.example build api migrate web