name: release-ci

on:
  push:
    tags: ['v*']

jobs:
  verify-tag:
    runs-on: easyai-gateway-ci-unprivileged-v2
    services:
      postgres:
        image: docker.io/library/postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
        env:
          POSTGRES_USER: easyai_test
          POSTGRES_HOST_AUTH_METHOD: trust
          POSTGRES_DB: easyai_gateway_test
        options: >-
          --health-cmd "pg_isready -U easyai_test -d easyai_gateway_test"
          --health-interval 2s
          --health-timeout 5s
          --health-retries 30
    env:
      TRIVY_DB_REPOSITORY: ghcr.m.daocloud.io/aquasecurity/trivy-db:2
      AI_GATEWAY_DATABASE_URL: postgresql://easyai_test@postgres:5432/easyai_gateway_test?sslmode=disable
      AI_GATEWAY_TEST_DATABASE_URL: postgresql://easyai_test@postgres:5432/easyai_gateway_test?sslmode=disable
    steps:
      - name: Checkout without external Actions
        env:
          CI_REPOSITORY: ${{ github.repository }}
          CI_SERVER_URL: ${{ github.server_url }}
          CI_SHA: ${{ github.sha }}
          CI_JOB_TOKEN: ${{ github.token }}
        run: |
          set -eu
          test -n "$CI_JOB_TOKEN"
          authorization=$(printf 'x-access-token:%s' "$CI_JOB_TOKEN" | base64 | tr -d '\n')
          git init .
          git -c "http.extraHeader=AUTHORIZATION: basic $authorization" \
            fetch --no-tags "$CI_SERVER_URL/$CI_REPOSITORY.git" "$CI_SHA"
          unset authorization CI_JOB_TOKEN
          test ! -f .git/shallow
          git checkout --detach FETCH_HEAD
      - name: Verify pinned host toolchains
        run: |
          go version
          node --version
          pnpm --version
          docker-compose version
          shellcheck --version
          trivy --version
          govulncheck -version
      - name: Verify release tag ancestry
        env:
          CI_REPOSITORY: ${{ github.repository }}
          CI_SERVER_URL: ${{ github.server_url }}
          CI_SHA: ${{ github.sha }}
          CI_JOB_TOKEN: ${{ github.token }}
        run: |
          set -eu
          tag_name=${GITHUB_REF#refs/tags/}
          ./scripts/ci-validate-semver.sh "$tag_name"
          authorization=$(printf 'x-access-token:%s' "$CI_JOB_TOKEN" | base64 | tr -d '\n')
          git -c "http.extraHeader=AUTHORIZATION: basic $authorization" \
            fetch --no-tags "$CI_SERVER_URL/$CI_REPOSITORY.git" \
            +refs/heads/main:refs/remotes/origin/main
          unset authorization CI_JOB_TOKEN
          test ! -f .git/shallow
          test "$(git rev-parse HEAD)" = "$CI_SHA"
          git merge-base --is-ancestor "$CI_SHA" refs/remotes/origin/main
      - name: Verify production migration safety
        run: |
          production_base=$(cat deploy/ci/production-migration-base)
          node ./scripts/ci-validate-migrations.mjs "$production_base"
      - name: Verify Go formatting
        run: |
          unformatted=$(gofmt -l apps/api)
          test -z "$unformatted" || {
            printf 'Go files require gofmt:\n%s\n' "$unformatted" >&2
            exit 1
          }
      - name: Migrate PostgreSQL 16 integration database
        working-directory: apps/api
        run: go run ./cmd/migrate
      - name: Verify Go code
        working-directory: apps/api
        env:
          GOFLAGS: "-p=1"
          GOMAXPROCS: "1"
        run: |
          go vet ./...
          go test ./...
          govulncheck ./...
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint
      - run: pnpm test
      - run: pnpm build
      - name: Audit JavaScript dependencies
        run: pnpm audit --audit-level high
      - name: Validate deployment configuration
        run: |
          docker-compose -f docker-compose.yml config --quiet
          shellcheck scripts/ci-build-images.sh scripts/ci-validate-semver.sh \
            scripts/provision-ci-runner.sh tests/ci/ci-build-images-test.sh \
            tests/ci/migrations-test.sh tests/ci/pipeline-test.sh \
            tests/ci/semver-test.sh
          ./tests/ci/ci-build-images-test.sh
          ./tests/ci/migrations-test.sh
          ./tests/ci/pipeline-test.sh
          ./tests/ci/semver-test.sh
      - name: Scan repository
        run: |
          trivy fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL \
            --ignore-unfixed --exit-code 1 --timeout 15m --skip-dirs .git \
            --skip-dirs node_modules .