# 在 Windows 上测试 start.ps1（DRY_RUN 模式，不启动 Docker）
name: Test start.ps1 (Windows)

on:
  push:
    paths:
      - 'start.ps1'
      - 'update.ps1'
      - 'scripts/Initialize-PublicApiBaseUrl.ps1'
      - 'scripts/Test-PublicApiBaseUrl.ps1'
      - 'scripts/Initialize-ServerHttpBindIp.ps1'
      - 'scripts/Test-ServerHttpBindIp.ps1'
      - '.env.sample'
      - '.github/workflows/test-start-ps1.yml'
  pull_request:
    paths:
      - 'start.ps1'
      - 'update.ps1'
      - 'scripts/Initialize-PublicApiBaseUrl.ps1'
      - 'scripts/Test-PublicApiBaseUrl.ps1'
      - 'scripts/Initialize-ServerHttpBindIp.ps1'
      - 'scripts/Test-ServerHttpBindIp.ps1'
      - '.env.sample'
      - '.github/workflows/test-start-ps1.yml'
  workflow_dispatch:

jobs:
  test-windows:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run start.ps1 (DRY_RUN)
        env:
          DEPLOY_DRY_RUN: "1"
          DEPLOY_IP: "192.168.1.100"
        run: |
          (Get-Content .env.sample) -replace '^SERVER_HTTP_PORT=.*$', 'SERVER_HTTP_PORT=4100' | Set-Content .env.sample -Encoding UTF8
          $output = powershell -ExecutionPolicy Bypass -File .\start.ps1 2>&1 | Out-String
          if ($LASTEXITCODE -ne 0) { Write-Host $output; exit $LASTEXITCODE }
          $adminPassword = (Select-String -Path .env -Pattern '^CONFIG_INITIAL_ADMIN_PASSWORD=' | ForEach-Object { $_.Line.Substring('CONFIG_INITIAL_ADMIN_PASSWORD='.Length) })
          if ([string]::IsNullOrWhiteSpace($adminPassword)) { throw 'Initial admin password was not generated' }
          if (-not $output.Contains('登录账号: admin')) { throw 'Deployment output does not show the admin username' }
          if (-not $output.Contains("登录密码: $adminPassword")) { throw 'Deployment output does not show the generated admin password' }
          if (-not $output.Contains('初始密码没有独立过期时间')) { throw 'Deployment output does not explain the initial password lifetime' }
          $existingOutput = powershell -ExecutionPolicy Bypass -File .\start.ps1 2>&1 | Out-String
          if ($LASTEXITCODE -ne 0) { Write-Host $existingOutput; exit $LASTEXITCODE }
          if (-not $existingOutput.Contains('本次部署不会生成或重置已有密码')) { throw 'Existing-env output does not explain password preservation' }
          if ($existingOutput.Contains("登录密码: $adminPassword")) { throw 'Existing-env output must not report the env value as the current password' }

      - name: Verify .env
        run: |
          $api = Select-String -Path .env -Pattern '^NUXT_PUBLIC_BASE_APIURL=' | ForEach-Object { $_.Line }
          $socket = Select-String -Path .env -Pattern '^NUXT_PUBLIC_BASE_SOCKETURL=' | ForEach-Object { $_.Line }
          $sg = Select-String -Path .env -Pattern '^NUXT_PUBLIC_SG_APIURL=' | ForEach-Object { $_.Line }
          $publicApi = Select-String -Path .env -Pattern '^CONFIG_PUBLIC_API_BASE_URL=' | ForEach-Object { $_.Line }
          $serverBindIp = Select-String -Path .env -Pattern '^SERVER_HTTP_BIND_IP=' | ForEach-Object { $_.Line }
          if ($api -ne 'NUXT_PUBLIC_BASE_APIURL=http://192.168.1.100:4100') { exit 1 }
          if ($socket -ne 'NUXT_PUBLIC_BASE_SOCKETURL=ws://192.168.1.100:3002') { exit 1 }
          if ($sg -ne 'NUXT_PUBLIC_SG_APIURL=http://192.168.1.100:3003') { exit 1 }
          if ($publicApi -ne 'CONFIG_PUBLIC_API_BASE_URL=http://192.168.1.100:4100') { exit 1 }
          if ($serverBindIp -ne 'SERVER_HTTP_BIND_IP=0.0.0.0') { exit 1 }
          Write-Host "OK: .env 配置正确"

      - name: Test public API URL migration helper
        run: |
          powershell -ExecutionPolicy Bypass -File .\scripts\Test-PublicApiBaseUrl.ps1

      - name: Test server HTTP bind migration helper
        run: |
          powershell -ExecutionPolicy Bypass -File .\scripts\Test-ServerHttpBindIp.ps1