name: Validation

on:
  pull_request:
  push:
    branches: [main]
  workflow_call:

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22.16.0
          cache: npm
      - run: npm ci
      - run: npm run format:check
      - run: npm run lint
      - run: npm run typecheck
      - run: npm run test:unit
      - run: npm run test:integration
      - run: npm run test:frontend
      - run: npm test
      - run: npm run audit:hyperframes-runtime
      - run: npm run build
      - run: npx playwright install --with-deps chromium
      - run: npm run test:e2e
      - run: npm run test:preview
      - name: Build production image
        run: |
          docker build \
            --build-arg APP_VERSION=0.1.0 \
            --build-arg GIT_COMMIT_SHA=${GITHUB_SHA} \
            --build-arg BUILD_TIMESTAMP=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
            -t oloka-video:${GITHUB_SHA} .
      - name: Verify production image durability contract
        run: |
          test "$(docker run --rm --entrypoint node oloka-video:${GITHUB_SHA} --version)" = "v22.16.0"
          test "$(docker run --rm --entrypoint litestream oloka-video:${GITHUB_SHA} version)" = "0.5.11"
          test "$(docker image inspect oloka-video:${GITHUB_SHA} --format '{{.Config.User}}')" = "1000:1000"
          test "$(docker image inspect oloka-video:${GITHUB_SHA} --format '{{index .Config.Labels "org.oloka.litestream.version"}}')" = "0.5.11"
          test "$(docker image inspect oloka-video:${GITHUB_SHA} --format '{{index .Config.Labels "org.oloka.litestream.archive.sha256"}}')" = "2f80fdb6b0a0ff7a116ee37adf02d3de8e977ef76e052b28a6690218f0f7ab55"
          docker run --rm --entrypoint sh oloka-video:${GITHUB_SHA} -c \
            "test ! -e /usr/bin/curl && test ! -e /usr/bin/wget && test -r /usr/share/licenses/litestream/LICENSE && ! grep -E 'access-key|secret-access-key|HF_S3_ACCESS_KEY_ID|HF_S3_SECRET_ACCESS_KEY' /etc/litestream.yml"
          set +e
          missing_output="$(docker run --rm oloka-video:${GITHUB_SHA} 2>&1)"
          missing_exit=$?
          set -e
          test "$missing_exit" -ne 0
          grep -q 'HF_S3_ACCESS_KEY_ID is required' <<<"$missing_output"
          ! grep -q 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' <<<"$missing_output"
          docker run --rm --entrypoint sh oloka-video:${GITHUB_SHA} -c \
            'test $(wc -c < /app/third_party/hyperframes/v0.7.104/hyperframe.runtime.iife.js) -eq 342023 && echo "a61e40e57329eeb9941c35ff9dac3ed8f0abfcee3246d2c5bfa2332e2df0c0c0  /app/third_party/hyperframes/v0.7.104/hyperframe.runtime.iife.js" | sha256sum --check --strict'
          docker run --rm --entrypoint sh oloka-video:${GITHUB_SHA} -c \
            'test $(wc -c < /app/third_party/fonts/noto-sans/NotoSans-VF.ttf) -eq 2049096 && echo "bfb7bb691513f12e734dc346c03a03f784912432d7e3fa8e56efcf906fe86b3d  /app/third_party/fonts/noto-sans/NotoSans-VF.ttf" | sha256sum --check --strict'
          docker run --rm --entrypoint sh oloka-video:${GITHUB_SHA} -c \
            'test ! -e /app/node_modules/@hyperframes/player && test ! -e /app/node_modules/@hyperframes/core && test ! -e /app/node_modules/@hyperframes/studio-server && ! grep -E "@hyperframes/(player|core|studio-server)" /app/package-lock.json'
      - name: Verify MinIO replication and ephemeral local recovery
        env:
          RECOVERY_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}
        run: bash scripts/run-docker-litestream-recovery.sh oloka-video:${GITHUB_SHA}
      - name: Record production image digest
        run: docker image inspect oloka-video:${GITHUB_SHA} --format 'image_id={{.Id}} repo_digests={{json .RepoDigests}}'