ci.yml

name: build_and_test_godon_cli

on:
  pull_request:
    branches: [ main ]

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
        clean: true

    - name: Clean working directory
      run: |
        git clean -ffdx
        git status

    - name: Install Nix
      uses: cachix/install-nix-action@v25
      with:
        nix_path: nixpkgs=channel:nixos-25.11
        extra_nix_config: |
          sandbox = false
          sandbox-paths = /etc/ssl/certs/ca-bundle.crt
          experimental-features = nix-command flakes

    - name: Configure Nix daemon SSL certificates
      run: |
        # Find and symlink SSL certificates for Nix daemon
        sudo mkdir -p /etc/ssl/certs
        CERT_BUNDLE=$(find /nix/store -name "ca-bundle.crt" | head -1)
        echo "Found certificate bundle: $CERT_BUNDLE"
        sudo ln -sf "$CERT_BUNDLE" /etc/ssl/certs/ca-bundle.crt
        sudo ln -sf "$CERT_BUNDLE" /etc/ssl/certs/ca-certificates.crt

        # Set environment variables for this session
        export SSL_CERT_FILE="/etc/ssl/certs/ca-bundle.crt"
        export NIX_SSL_CERT_FILE="/etc/ssl/certs/ca-bundle.crt"
        export CURL_CA_BUNDLE="/etc/ssl/certs/ca-bundle.crt"

        # Add to nix.conf for daemon
        echo "ssl-cert-file = /etc/ssl/certs/ca-bundle.crt" | sudo tee -a /etc/nix/nix.conf

        echo "SSL certificates configured for Nix daemon"

    - name: Build with Nix
      run: |
        export SSL_CERT_FILE="/etc/ssl/certs/ca-bundle.crt"
        export NIX_SSL_CERT_FILE="/etc/ssl/certs/ca-bundle.crt"
        export CURL_CA_BUNDLE="/etc/ssl/certs/ca-bundle.crt"
        nix --experimental-features "nix-command flakes" build --verbose

    - name: Test binary
      run: |
        echo "Checking build output..."
        echo "Result path:"
        nix path-info .#default
        echo "Contents of result directory:"
        ls -la $(nix path-info .#default)/ || echo "result directory contents"
        echo "Checking $out/bin directory:"
        ls -la $(nix path-info .#default)/bin/ || echo "$out/bin not found"

        # Verify static binary
        BINARY_PATH="$(nix path-info .#default)/bin/godon_cli"
        echo "=== Binary information ==="
        file "$BINARY_PATH"
        echo "=== Dynamic libraries check (should show 'not a dynamic executable' or similar) ==="
        ldd "$BINARY_PATH" || echo "✅ Binary appears to be statically linked (ldd failed as expected)"

        echo "Testing compiled binary with direct path..."
        "$BINARY_PATH" --help

    - name: Start Prism mock container
      run: |
        # Docker debug info
        echo "=== Docker Debug Info ==="
        docker --version
        docker info
        echo "=== Checking Docker daemon ==="
        docker ps

        # Download the OpenAPI spec with retry
        echo "Downloading OpenAPI spec..."
        curl -L --retry 3 --retry-delay 5 -o openapi.yml \
          https://raw.githubusercontent.com/godon-dev/godon-images/main/images/godon-api/openapi.yml

        # Verify the spec was downloaded
        if [ ! -f openapi.yml ]; then
          echo "Failed to download OpenAPI spec"
          exit 1
        fi
        echo "OpenAPI spec downloaded successfully"
        echo "=== Spec file size ==="
        wc -l openapi.yml
        echo "=== First 20 lines of spec ==="
        head -20 openapi.yml
        echo "=== Paths section ==="
        grep -A 20 "^paths:" openapi.yml || echo "No paths section found"
        echo "=== All path definitions ==="
        grep -E "^\s*/" openapi.yml || echo "No path definitions found"

        # Start Prism container in background
        echo "=== Starting Prism container ==="
        docker run -d --name prism -p 4010:4010 \
          --log-driver json-file \
          --log-opt max-size=10m \
          -v $(pwd)/openapi.yml:/tmp/openapi.yml \
          stoplight/prism:4 \
          mock --host 0.0.0.0 /tmp/openapi.yml

        # Check if container started
        echo "=== Checking container status ==="
        sleep 5
        docker ps -a | grep prism || echo "Container not found in docker ps"
        
        echo "=== Container detailed info ==="
        docker ps -a --filter name=prism
        docker logs prism || echo "No logs available"
        
        echo "=== Container inspection ==="
        docker inspect prism || echo "Could not inspect container"
        echo "=== Network ports ==="
        docker port prism || echo "Could not get port mappings"

        # Wait for Prism to start with better error handling
        echo "=== Waiting for Prism to start ==="
        for i in {1..10}; do
          echo "Attempt $i: Checking if Prism is ready..."
          
          # Check if container is still running
          if ! docker ps | grep -q prism; then
            echo "❌ Container stopped unexpectedly"
            echo "=== Container exit logs ==="
            docker logs prism
            docker ps -a --filter name=prism
            exit 1
          fi
          
          # Try to connect to an actual endpoint from our spec
          if curl -sf http://localhost:4010/breeders > /dev/null 2>&1; then
            echo "✅ Prism is ready!"
            break
          else
            echo "Prism not ready yet, waiting..."
            sleep 3
          fi
          
          if [ $i -eq 10 ]; then
            echo "❌ Prism failed to start after 10 attempts"
            echo "=== Final container state ==="
            docker ps -a --filter name=prism
            echo "=== Final container logs ==="
            docker logs prism
            exit 1
          fi
        done

        # Test basic connectivity
        echo "=== Testing basic connectivity ==="
        curl -v http://localhost:4010 || echo "Basic connection failed"

        # Verify Prism is responding
        echo "=== Testing Prism health ==="
        curl -v http://localhost:4010/health || echo "Health check failed"

        # Test available endpoints
        echo "=== Testing available Prism endpoints ==="
        echo "Testing root path:"
        curl -v http://localhost:4010/ 2>&1 | head -10 || echo "Root path failed"

        echo "Testing /v0 path:"
        curl -v http://localhost:4010/v0 2>&1 | head -10 || echo "/v0 path failed"

        echo "Testing /v0/breeders:"
        curl -v http://localhost:4010/v0/breeders 2>&1 | head -10 || echo "/v0/breeders failed"

        echo "Testing OpenAPI spec:"
        curl -v http://localhost:4010/openapi.json 2>&1 | head -5 || echo "OpenAPI spec failed"

        echo "=== Testing exact URLs that CLI will use ==="
        echo "Testing /breeders (what CLI should call):"
        curl -v http://localhost:4010/breeders 2>&1 | head -10 || echo "/breeders failed"

        echo "Testing POST /breeders:"
        curl -X POST -H "Content-Type: application/json" -d '{"name":"test"}' \
          http://localhost:4010/breeders 2>&1 | head -10 || echo "POST /breeders failed"

        echo "Testing /credentials (new endpoints):"
        curl -v http://localhost:4010/credentials 2>&1 | head -10 || echo "/credentials failed"

        echo "Testing POST /credentials:"
        curl -X POST -H "Content-Type: application/json" \
          -d '{"name":"test","credentialType":"ssh_private_key","content":"test_key_content"}' \
          http://localhost:4010/credentials 2>&1 | head -10 || echo "POST /credentials failed"

        echo "Testing /targets:"
        curl -v http://localhost:4010/targets 2>&1 | head -10 || echo "/targets failed"

        echo "Testing POST /targets:"
        curl -X POST -H "Content-Type: application/json" \
          -d '{"name":"test","targetType":"ssh","address":"10.0.0.1"}' \
          http://localhost:4010/targets 2>&1 | head -10 || echo "POST /targets failed"

        echo "=== Prism setup complete ==="

    - name: Integration tests against Prism mock
      run: |
        # Get the binary path
        BINARY_PATH=$(nix path-info .#default)/bin/godon_cli

        echo "Running integration tests against Prism mock..."

        # Test breeder list with HTTP (default)
        echo "Testing: breeder list (HTTP default)"
        $BINARY_PATH --hostname=localhost --port=4010 breeder list

        # Test explicit HTTP prefix
        echo "Testing: breeder list (explicit http:// prefix)"
        $BINARY_PATH --hostname=http://localhost --port=4010 breeder list

        # Test HTTPS prefix with insecure flag (using HTTP port for testing)
        echo "Testing: breeder list (HTTPS prefix with --insecure flag)"
        $BINARY_PATH --hostname=https://localhost --port=4010 --insecure breeder list || echo "Expected: HTTPS on HTTP port may fail"

        # Test HTTPS prefix without insecure flag (should fail on missing certificates)
        echo "Testing: breeder list (HTTPS prefix without --insecure flag - should fail)"
        $BINARY_PATH --hostname=https://localhost --port=4010 breeder list && echo "❌ Unexpected success - should have failed without certificates" || echo "✅ Expected failure without SSL certificates"

        # Test help command shows new --insecure flag
        echo "Testing: help shows --insecure flag"
        $BINARY_PATH --help | grep -q "insecure" && echo "✅ --insecure flag documented in help" || echo "❌ --insecure flag missing from help"

        # Create test YAML files using echo
        echo 'meta:' > test_breeder.yml
        echo '  configVersion: "0.2"' >> test_breeder.yml
        echo 'breeder:' >> test_breeder.yml
        echo '  type: "linux_performance"' >> test_breeder.yml
        echo 'settings:' >> test_breeder.yml
        echo '  sysctl:' >> test_breeder.yml
        echo '    vm.swappiness:' >> test_breeder.yml
        echo '      constraints:' >> test_breeder.yml
        echo '        lower: 0' >> test_breeder.yml
        echo '        upper: 100' >> test_breeder.yml

        echo "Testing: breeder create"
        $BINARY_PATH --hostname=localhost --port=4010 breeder create --name="test-breeder" --file=test_breeder.yml

        # Test breeder show with a mock UUID
        echo "Testing: breeder show"
        $BINARY_PATH --hostname=localhost --port=4010 breeder show --id=550e8400-e29b-41d4-a716-446655440000

        # Create update test file (config only, id passed via --id flag)
        echo 'breeder:' > test_breeder_update.yml
        echo '  type: "test_breeder"' >> test_breeder_update.yml
        echo 'objectives:' >> test_breeder_update.yml
        echo '  - name: "latency"' >> test_breeder_update.yml
        echo 'settings:' >> test_breeder_update.yml
        echo '  sysctl:' >> test_breeder_update.yml
        echo '    net.core.somaxconn:' >> test_breeder_update.yml
        echo '      constraints:' >> test_breeder_update.yml
        echo '        - step: 100' >> test_breeder_update.yml
        echo '          lower: 4096' >> test_breeder_update.yml
        echo '          upper: 131072' >> test_breeder_update.yml

        echo "Testing: breeder update"
        $BINARY_PATH --hostname=localhost --port=4010 breeder update --id=550e8400-e29b-41d4-a716-446655440000 --file=test_breeder_update.yml

        echo "Testing: breeder update with --force"
        $BINARY_PATH --hostname=localhost --port=4010 breeder update --id=550e8400-e29b-41d4-a716-446655440000 --file=test_breeder_update.yml --force

        # Test breeder purge (safe mode)
        echo "Testing: breeder purge (safe mode)"
        $BINARY_PATH --hostname=localhost --port=4010 breeder purge --id=550e8400-e29b-41d4-a716-446655440000

        # Test breeder stop
        echo "Testing: breeder stop"
        $BINARY_PATH --hostname=localhost --port=4010 breeder stop --id=550e8400-e29b-41d4-a716-446655440000

        # Test breeder start
        echo "Testing: breeder start"
        $BINARY_PATH --hostname=localhost --port=4010 breeder start --id=550e8400-e29b-41d4-a716-446655440000

        # Test breeder purge with force flag
        echo "Testing: breeder purge --force"
        $BINARY_PATH --hostname=localhost --port=4010 breeder purge --force --id=550e8400-e29b-41d4-a716-446655440000

        # Test help shows new commands
        echo "Testing: help shows stop/start commands"
        $BINARY_PATH breeder --help | grep -q "stop" && echo "✅ stop command documented" || echo "❌ stop command missing"
        $BINARY_PATH breeder --help | grep -q "start" && echo "✅ start command documented" || echo "❌ start command missing"
        echo "Testing: breeder purge --help shows --force flag"
        $BINARY_PATH breeder purge --help | grep -q "force" && echo "✅ --force flag documented in purge" || echo "❌ --force flag missing from purge"

        # Test help commands
        echo "Testing: help commands"
        $BINARY_PATH --help
        $BINARY_PATH breeder --help || true  # May fail but tests argument parsing

        # === Credential Command Tests ===
        echo ""
        echo "=== Testing Credential Commands ==="

        # Test credential list
        echo "Testing: credential list"
        $BINARY_PATH --hostname=localhost --port=4010 credential list

        # Create test credential YAML file
        echo 'name: "test_ssh_key"' > test_credential.yml
        echo 'credentialType: "ssh_private_key"' >> test_credential.yml
        echo 'description: "Test SSH key for CI"' >> test_credential.yml
        echo 'content: "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA2Z2H7V..."' >> test_credential.yml

        # Test credential create
        echo "Testing: credential create"
        $BINARY_PATH --hostname=localhost --port=4010 credential create --file=test_credential.yml

        # Test credential show with mock UUID
        echo "Testing: credential show (including content)"
        $BINARY_PATH --hostname=localhost --port=4010 credential show --id=550e8400-e29b-41d4-a716-446655440001

        # Test credential delete
        echo "Testing: credential delete"
        $BINARY_PATH --hostname=localhost --port=4010 credential delete --id=550e8400-e29b-41d4-a716-446655440001

        # Test help shows credential commands
        echo "Testing: help shows credential commands"
        $BINARY_PATH --help | grep -q "credential" && echo "✅ Credential commands documented in help" || echo "❌ Credential commands missing from help"

        # Test --debug flag
        echo "Testing: --debug flag works without breaking logic"
        $BINARY_PATH --hostname=localhost --port=4010 --debug breeder list
        echo "✅ --debug flag works"

        # === Target Command Tests ===
        echo ""
        echo "=== Testing Target Commands ==="

        # Test target list
        echo "Testing: target list"
        $BINARY_PATH --hostname=localhost --port=4010 target list

        # Create test target YAML file
        echo 'name: "test-web-server"' > test_target.yml
        echo 'targetType: "ssh"' >> test_target.yml
        echo 'spec:' >> test_target.yml
        echo '  address: "192.168.1.100"' >> test_target.yml
        echo '  username: "deploy"' >> test_target.yml
        echo 'metadata:' >> test_target.yml
        echo '  description: "Test web server"' >> test_target.yml

        # Test target create
        echo "Testing: target create"
        $BINARY_PATH --hostname=localhost --port=4010 target create --file=test_target.yml

        # Test target show with mock UUID
        echo "Testing: target show"
        $BINARY_PATH --hostname=localhost --port=4010 target show --id=550e8400-e29b-41d4-a716-446655440022

        # Test target delete
        echo "Testing: target delete"
        $BINARY_PATH --hostname=localhost --port=4010 target delete --id=550e8400-e29b-41d4-a716-446655440022

        # Test help shows target commands
        echo "Testing: help shows target commands"
        $BINARY_PATH --help | grep -q "target" && echo "✅ Target commands documented in help" || echo "❌ Target commands missing from help"

        echo "Testing: JSON output for target list"
        $BINARY_PATH --hostname=localhost --port=4010 --output=json target list

        echo "Testing: YAML output for target list"
        $BINARY_PATH --hostname=localhost --port=4010 --output=yaml target list

        # === Error Handling Tests ===
        echo ""
        echo "=== Testing Error Handling ==="

        # Test missing file
        echo "Testing: missing file error"
        if $BINARY_PATH --hostname=localhost --port=4010 breeder create --name=test --file=nonexistent.yml 2>/dev/null; then
          echo "❌ Should have failed on missing file"
          exit 1
        else
          echo "✅ Failed on missing file as expected"
        fi

        # Test missing required argument
        echo "Testing: missing --id argument"
        if $BINARY_PATH --hostname=localhost --port=4010 breeder show 2>/dev/null; then
          echo "❌ Should have failed on missing --id"
          exit 1
        else
          echo "✅ Failed on missing --id as expected"
        fi

        # === Output Format Tests ===
        echo ""
        echo "=== Testing Output Formats ==="

        echo "Testing: JSON output format"
        JSON_OUTPUT=$($BINARY_PATH --hostname=localhost --port=4010 --output=json breeder list)
        if echo "$JSON_OUTPUT" | grep -q '"id"\|"name"\|"status"'; then
          echo "✅ JSON output contains expected fields"
        else
          echo "❌ JSON output missing expected fields"
        fi

        echo "Testing: YAML output format"
        YAML_OUTPUT=$($BINARY_PATH --hostname=localhost --port=4010 --output=yaml breeder list)
        if echo "$YAML_OUTPUT" | grep -q -e '^-' -e 'id:' -e 'name:'; then
          echo "✅ YAML output contains expected fields"
        else
          echo "❌ YAML output missing expected fields"
        fi

        echo "Testing: JSON output for breeder show"
        $BINARY_PATH --hostname=localhost --port=4010 --output=json breeder show --id=550e8400-e29b-41d4-a716-446655440000

        echo "Testing: YAML output for credential list"
        $BINARY_PATH --hostname=localhost --port=4010 --output=yaml credential list

    - name: Cleanup Prism container
      if: always()
      run: |
        docker stop prism || true
        docker rm prism || true