ci.yml

# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
#
# CI workflow for tests repository
# Runs E2E integration tests against Docker Compose stack with Ledger, Engine, and Control.

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  # Allow manual trigger for testing
  workflow_dispatch:

# Cancel in-progress runs when new commits are pushed
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  # ==========================================================================
  # Build: Compile tests (fast feedback on syntax errors)
  # ==========================================================================
  build:
    name: Build Tests
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - name: Checkout tests repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Rust toolchain
        uses: dtolnay/rust-action@7ac8906b4da87dbf44ef2c5cc52b4e736c91b7f6 # master
        with:
          toolchain: "1.92"
          components: clippy

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
        with:
          shared-key: "tests-build"

      - name: Check formatting
        run: cargo fmt --check

      - name: Run clippy
        run: cargo clippy --all-targets -- -D warnings

      - name: Build tests
        run: cargo test --no-run

  # ==========================================================================
  # E2E Integration Tests: Full stack with Ledger + Engine + Control
  # ==========================================================================
  e2e-integration-tests:
    name: E2E Integration Tests
    runs-on: ubuntu-latest
    needs: [build]
    timeout-minutes: 30
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - name: Checkout meta-repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: inferadb/inferadb
          submodules: recursive
          path: inferadb

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Build and start E2E stack
        working-directory: inferadb
        run: |
          echo "Building Docker images..."
          docker compose -f docker-compose.e2e.yml build

          echo "Starting services..."
          docker compose -f docker-compose.e2e.yml up -d

      - name: Wait for services to be healthy
        working-directory: inferadb
        run: |
          echo "Waiting for services to become healthy..."
          
          TIMEOUT=180
          ELAPSED=0
          
          while [[ $ELAPSED -lt $TIMEOUT ]]; do
            LEDGER_HEALTHY=$(docker inspect --format='{{.State.Health.Status}}' inferadb-e2e-ledger 2>/dev/null || echo "unknown")
            CONTROL_HEALTHY=$(docker inspect --format='{{.State.Health.Status}}' inferadb-e2e-control 2>/dev/null || echo "unknown")
            ENGINE_HEALTHY=$(docker inspect --format='{{.State.Health.Status}}' inferadb-e2e-engine 2>/dev/null || echo "unknown")
            
            echo "  Ledger: $LEDGER_HEALTHY | Control: $CONTROL_HEALTHY | Engine: $ENGINE_HEALTHY (${ELAPSED}s)"
            
            if [[ "$LEDGER_HEALTHY" == "healthy" ]] && \
               [[ "$CONTROL_HEALTHY" == "healthy" ]] && \
               [[ "$ENGINE_HEALTHY" == "healthy" ]]; then
              echo "All services are healthy!"
              exit 0
            fi
            
            sleep 5
            ELAPSED=$((ELAPSED + 5))
          done
          
          echo "ERROR: Services did not become healthy within ${TIMEOUT}s"
          echo ""
          echo "Container logs:"
          docker compose -f docker-compose.e2e.yml logs
          exit 1

      - name: Install Rust toolchain
        uses: dtolnay/rust-action@7ac8906b4da87dbf44ef2c5cc52b4e736c91b7f6 # master
        with:
          toolchain: "1.92"

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
        with:
          shared-key: "tests-build"
          workspaces: "inferadb/tests"

      - name: Run E2E integration tests
        working-directory: inferadb/tests
        env:
          INFERADB_API_URL: "http://localhost:9090"
          ENGINE_URL: "http://localhost:8080"
          ENGINE_GRPC_URL: "http://localhost:8081"
          ENGINE_MESH_URL: "http://localhost:8082"
          CONTROL_URL: "http://localhost:9090"
          RUST_LOG: "debug"
        run: |
          cargo test --test integration -- --test-threads=1 --nocapture

      - name: Collect logs on failure
        if: failure()
        working-directory: inferadb
        run: |
          echo "=== Docker Compose Logs ==="
          docker compose -f docker-compose.e2e.yml logs --tail=500
          
          echo ""
          echo "=== Container Status ==="
          docker compose -f docker-compose.e2e.yml ps

      - name: Stop E2E stack
        if: always()
        working-directory: inferadb
        run: |
          docker compose -f docker-compose.e2e.yml down -v --remove-orphans

  # ==========================================================================
  # Overall status check - required for branch protection
  # ==========================================================================
  ci-success:
    name: CI Success
    needs: [build, e2e-integration-tests]
    runs-on: ubuntu-latest
    if: always()
    permissions:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - name: Check CI results
        env:
          BUILD_RESULT: ${{ needs.build.result }}
          E2E_RESULT: ${{ needs.e2e-integration-tests.result }}
        run: |
          echo "## CI Results"
          echo ""
          echo "| Check | Status |"
          echo "|-------|--------|"
          echo "| Build | $BUILD_RESULT |"
          echo "| E2E Integration Tests | $E2E_RESULT |"
          echo ""

          # Function to validate result
          validate_result() {
            local name="$1"
            local result="$2"
            if [[ "$result" != "success" && "$result" != "skipped" ]]; then
              echo "FAILED: $name ($result)"
              return 1
            fi
            return 0
          }

          # Check all results
          FAILED=0
          validate_result "Build" "$BUILD_RESULT" || FAILED=1
          validate_result "E2E Integration Tests" "$E2E_RESULT" || FAILED=1

          if [[ $FAILED -eq 1 ]]; then
            echo ""
            echo "Some CI checks failed!"
            exit 1
          fi

          echo ""
          echo "All CI checks passed!"