ci.yml

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  workflow_call:  # Allow release.yml to call this workflow

jobs:
  # ─── PHP Lint ───────────────────────────────────────────────
  php-lint:
    name: PHP Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          extensions: pdo_mysql, curl, openssl, json, mbstring, redis

      - name: Check PHP syntax
        run: |
          echo "Checking PHP files for syntax errors..."
          error_count=0
          while IFS= read -r file; do
            if ! php -l "$file" 2>&1 | grep -q "No syntax errors"; then
              php -l "$file"
              error_count=$((error_count + 1))
            fi
          done < <(find FINAL_PRODUCTION_SYSTEM -name '*.php' -not -path '*/vendor/*' -not -path '*/frontend/*')

          if [ "$error_count" -gt 0 ]; then
            echo "❌ Found syntax errors in $error_count file(s)"
            exit 1
          else
            echo "✅ All PHP files pass syntax check"
          fi

  # ─── Frontend Build & Test ──────────────────────────────────
  frontend:
    name: Frontend Build & Test
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: FINAL_PRODUCTION_SYSTEM/frontend
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'
          cache-dependency-path: FINAL_PRODUCTION_SYSTEM/frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: TypeScript & Build
        run: npm run build

      - name: Run tests
        run: npm test

      - name: Lint (warnings only)
        continue-on-error: true
        run: npm run lint

  # ─── Docker Stack Health Check ──────────────────────────────
  docker-health:
    name: Docker Stack
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Create .env file
        run: |
          cat > .env <<'EOF'
          DB_HOST=db
          DB_NAME=oem_activation
          DB_USER=oem_user
          DB_PASS=ci_oem_pass
          MARIADB_ROOT_PASSWORD=ci_root_pass
          REDIS_HOST=redis
          REDIS_PORT=6379
          REDIS_PASSWORD=ci_redis_pass
          APP_TIMEZONE=UTC
          BACKUP_RETENTION_DAYS=30
          CORS_ORIGINS=
          PHP_MEMORY_LIMIT=256M
          PHP_UPLOAD_MAX_FILESIZE=50M
          PHP_POST_MAX_SIZE=50M
          EOF
          # Strip leading whitespace from heredoc
          sed -i 's/^[[:space:]]*//' .env
          echo "--- .env contents ---"
          cat .env

      - name: Generate self-signed SSL cert for CI
        run: |
          mkdir -p ssl
          openssl req -x509 -nodes -days 1 -newkey rsa:2048 \
            -keyout ssl/server.key -out ssl/server.crt \
            -subj "/CN=localhost" 2>/dev/null
          echo "✅ SSL cert generated"

      - name: Build Docker images
        run: docker compose build

      - name: Start database and Redis first
        run: |
          docker compose up -d db redis
          echo "Waiting for database to be healthy..."
          for i in $(seq 1 40); do
            if docker compose exec -T db mariadb -uroot -pci_root_pass -e "SELECT 1" > /dev/null 2>&1; then
              echo "✅ Database ready after ~$((i * 5))s"
              break
            fi
            if [ "$i" -eq 40 ]; then
              echo "❌ Database failed to start"
              docker compose logs db
              exit 1
            fi
            sleep 5
          done

      - name: Start web and remaining services
        run: docker compose up -d

      - name: Wait for web server
        run: |
          echo "Waiting for web server health endpoint..."
          for i in $(seq 1 30); do
            if curl -sf http://localhost:8080/api/health.php > /dev/null 2>&1; then
              echo "✅ Web server healthy after ~$((i * 5))s"
              break
            fi
            if [ "$i" -eq 30 ]; then
              echo "❌ Web server failed to start"
              docker compose ps
              docker compose logs web --tail 50
              exit 1
            fi
            sleep 5
          done

      - name: Test API health endpoint
        run: |
          response=$(curl -sf http://localhost:8080/api/health.php)
          echo "Health response: $response"
          echo "$response" | grep -q "healthy" || (echo "❌ Health check failed" && exit 1)
          echo "✅ API health check passed"

      - name: Test database connectivity
        run: |
          docker compose exec -T db mariadb -uoem_user -pci_oem_pass oem_activation -e "SELECT COUNT(*) as table_count FROM information_schema.tables WHERE table_schema = 'oem_activation';" || (echo "❌ Database check failed" && exit 1)
          echo "✅ Database connectivity check passed"

      - name: Cleanup
        if: always()
        run: docker compose down -v

  # ─── Prefix Codemod Idempotency ─────────────────────────────
  # Re-runs tools/prefix-codemod.php in --verify mode against the committed
  # tree. Any unprefixed table reference in SQL or any unrewritten bare-name
  # SQL ref in PHP would be picked up here.
  codemod-verify:
    name: Prefix Codemod Idempotency
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          extensions: pdo_mysql, json, mbstring

      - name: Run codemod in dry-run mode (must produce zero changes)
        run: |
          OUT=$(php tools/prefix-codemod.php --root FINAL_PRODUCTION_SYSTEM --quiet 2>&1 || true)
          # Re-run normally to capture stats
          STATS=$(php tools/prefix-codemod.php --root FINAL_PRODUCTION_SYSTEM)
          echo "$STATS"
          # Both pass numbers must be zero
          SQL_CHANGED=$(echo "$STATS" | grep -oE "SQL: ([0-9]+) files changed" | grep -oE "[0-9]+" | head -1)
          PHP_CHANGED=$(echo "$STATS" | grep -oE "PHP: ([0-9]+) files changed" | grep -oE "[0-9]+" | head -1)
          if [ "$SQL_CHANGED" != "0" ] || [ "$PHP_CHANGED" != "0" ]; then
            echo "❌ Codemod is not idempotent: SQL=$SQL_CHANGED files, PHP=$PHP_CHANGED files would change."
            echo "Run: php tools/prefix-codemod.php --root FINAL_PRODUCTION_SYSTEM --apply"
            exit 1
          fi
          echo "✅ Codemod idempotent: 0 SQL + 0 PHP changes on second run."

      - name: Run codemod in --verify mode (zero unprefixed SQL refs)
        run: |
          php tools/prefix-codemod.php --root FINAL_PRODUCTION_SYSTEM --verify
          echo "✅ Verify mode pass: zero unprefixed table references."

  # ─── Restricted-PHP Smoke Test (panel-style env) ────────────
  # Simulates aaPanel-style restrictive PHP settings: low max_execution_time
  # (forces async per-migration runner) and no allow_url_fopen.
  installer-restricted-php:
    name: Installer (restricted PHP env)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup PHP with restrictive settings
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          extensions: pdo_mysql, curl, openssl, json, mbstring, zip
          ini-values: |
            max_execution_time=15
            memory_limit=128M
            allow_url_fopen=Off

      - name: Verify install/ajax.php parses under restrictive settings
        run: |
          # Lint pass with the restrictive INI loaded.
          php -l FINAL_PRODUCTION_SYSTEM/install/ajax.php
          php -l FINAL_PRODUCTION_SYSTEM/install/index.php
          # Smoke import: load ajax.php's helpers and confirm no fatals at load time.
          php -r '
            $_POST = ["action" => ""];
            $_GET  = [];
            ob_start();
            include "FINAL_PRODUCTION_SYSTEM/install/ajax.php";
            $out = ob_get_clean();
            echo "Loaded successfully. Output: " . substr($out, 0, 200) . "\n";
            if (!function_exists("installerBuildDsn")) { echo "FAIL: installerBuildDsn missing\n"; exit(1); }
            if (!function_exists("installerRunSqlFile")) { echo "FAIL: installerRunSqlFile missing\n"; exit(1); }
            if (!function_exists("installerSplitSql")) { echo "FAIL: installerSplitSql missing\n"; exit(1); }
            if (!function_exists("installerProbeSockets")) { echo "FAIL: installerProbeSockets missing\n"; exit(1); }
            if (!function_exists("installerCheckIncompleteState")) { echo "FAIL: installerCheckIncompleteState missing\n"; exit(1); }
            if (!function_exists("installerT")) { echo "FAIL: installerT missing\n"; exit(1); }
            echo "✅ All installer helpers loaded under restricted PHP.\n";
          '

      - name: Verify SQL splitter handles every existing migration
        run: |
          php -r '
            include "FINAL_PRODUCTION_SYSTEM/install/ajax.php";
            $files = glob("FINAL_PRODUCTION_SYSTEM/database/*.sql");
            $totalStmts = 0;
            foreach ($files as $f) {
              $sql = file_get_contents($f);
              $sql = preg_replace("/DELIMITER\s+[^\n]+/i", "", $sql);
              $sql = preg_replace("/^\s*(START\s+TRANSACTION|BEGIN)\s*;\s*\$/im", "", $sql);
              $sql = preg_replace("/^\s*COMMIT\s*;\s*\$/im", "", $sql);
              $stmts = installerSplitSql($sql);
              $count = count(array_filter($stmts, fn($s) => trim($s) !== ""));
              $totalStmts += $count;
              if ($count === 0) {
                echo "WARN: " . basename($f) . " produced 0 statements\n";
              }
            }
            echo "✅ Splitter handled " . count($files) . " files, " . $totalStmts . " total statements.\n";
          '