name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  verify:
    name: Lint, Typecheck, Test, Build
    # Label des self-hosted Forgejo-Runners auf vm-git (Labels: docker, self-hosted).
    # 'ubuntu-latest' matchte den Runner nicht, daher bleibt der Job sonst in der Queue.
    runs-on: docker
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10.30.1
          run_install: false

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Tests laden .env via node --env-file (siehe packages/api/package.json).
      # Im CI ist sie nicht vorhanden, also legen wir eine minimale CI-Variante an.
      # Werte sind Dummies: Tests mocken DB und Auth, die Module-Init-Checks brauchen
      # nur, dass die Variablen ueberhaupt gesetzt sind.
      - name: Prepare CI .env
        run: |
          cat > .env <<'EOF'
          DATABASE_URL=postgresql://ci:ci@localhost:5432/ci
          BETTER_AUTH_SECRET=ci-test-secret-not-used-for-real-please-replace-32
          BETTER_AUTH_BASE_URL=http://localhost:3002
          PASSKEY_RP_ID=localhost
          PASSKEY_RP_NAME=Hellth Hub CI
          API_PORT=3002
          TRUSTED_ORIGINS=http://localhost:3001
          NEXT_PUBLIC_API_URL=http://localhost:3002
          PLATFORM_ADMIN_EMAILS=ci@example.org
          NEXT_PUBLIC_PLATFORM_ADMIN_EMAILS=ci@example.org
          ADMIN_EMAIL=ci@example.org
          ADMIN_INITIAL_PASSWORD=ci-test-password-not-used-32-chars
          ENABLE_DB_MIGRATIONS=false
          ALLOW_SEED_SIGNUP=false
          HEALTH_AUDIT_LOGS=false
          EOF

      - name: Lint
        run: pnpm lint

      - name: Typecheck
        run: pnpm typecheck

      - name: Test
        run: pnpm test

      - name: Build admin
        env:
          NEXT_PUBLIC_API_URL: http://localhost:3002
        run: pnpm --filter admin build