name: PR Checks

on:
  pull_request:
    branches:
      - main

# Cancel superseded runs: pushing a new commit to a PR (or an empty
# re-trigger) aborts the previous still-running checks instead of running
# a second full matrix alongside them.
concurrency:
  group: pr-checks-${{ gitea.event.pull_request.number }}
  cancel-in-progress: true

env:
  REGISTRY: privaterepo.sitaru.org
  BACKEND_IMAGE_NAME: ${{ gitea.repository }}-backend
  FRONTEND_IMAGE_NAME: ${{ gitea.repository }}-frontend
  PIPELINE_IMAGE_NAME: ${{ gitea.repository }}-pipeline

jobs:
  frontend-checks:
    name: Frontend Typecheck + Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      # Cache the resolved node_modules (452 MB / 460 packages) keyed on the
      # lockfile. On a hit — the common case, since deps change rarely — the
      # whole `npm ci` step is skipped, not just its download phase. The key
      # pins OS + node major so we never restore incompatible native binaries.
      - name: Cache node_modules
        id: node-modules-cache
        uses: actions/cache@v4
        with:
          path: nextjs-app/node_modules
          key: nextjs-node-modules-${{ runner.os }}-node22-${{ hashFiles('nextjs-app/package-lock.json') }}

      - name: Install dependencies
        if: steps.node-modules-cache.outputs.cache-hit != 'true'
        working-directory: nextjs-app
        run: npm ci --prefer-offline --no-audit --no-fund

      - name: Typecheck
        working-directory: nextjs-app
        run: npm run typecheck

      - name: Unit tests
        working-directory: nextjs-app
        run: npm test

  backend-checks:
    name: Backend Smoke
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: pip install -r requirements.txt pytest "httpx<0.28"

      - name: Import smoke test
        run: python -c "from backend.app import app; print('backend imports OK')"

      - name: Backend unit tests
        run: python -m pytest backend/tests -q

  build-backend:
    name: Build Backend (no push)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["10.0.1.224:6000"]
            [registry."10.0.1.224:6000"]
              http = true
              insecure = true

      - name: Log in to Gitea Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ gitea.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build Backend Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          push: false
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}:buildcache

  build-frontend:
    name: Build Frontend (no push)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["10.0.1.224:6000"]
            [registry."10.0.1.224:6000"]
              http = true
              insecure = true

      - name: Log in to Gitea Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ gitea.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build Frontend Docker image
        uses: docker/build-push-action@v5
        with:
          context: ./nextjs-app
          file: ./nextjs-app/Dockerfile
          push: false
          build-args: |
            FASTAPI_URL=http://backend:80/api

  build-pipeline:
    name: Build Pipeline (no push)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["10.0.1.224:6000"]
            [registry."10.0.1.224:6000"]
              http = true
              insecure = true

      - name: Log in to Gitea Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ gitea.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build Pipeline Docker image
        uses: docker/build-push-action@v5
        with:
          context: ./pipeline
          file: ./pipeline/Dockerfile
          push: false
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.PIPELINE_IMAGE_NAME }}:buildcache

  ai-review:
    name: AI Code Review (Claude)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install Claude Code
        run: npm install -g @anthropic-ai/claude-code

      - name: Review PR diff with Claude Code
        env:
          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          # Auto-provided per-run token from Gitea Actions (repo-scoped).
          # GITHUB_TOKEN is the documented name; GITEA_TOKEN is its alias.
          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITEA_SERVER_URL: ${{ gitea.server_url }}
          GITEA_REPOSITORY: ${{ gitea.repository }}
          PR_NUMBER: ${{ gitea.event.pull_request.number }}
          BASE_REF: ${{ gitea.event.pull_request.base.ref }}
        run: python scripts/ci/ai_review.py