CI.yaml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  pull-requests: write

jobs:
  lint:
    name: PSScriptAnalyzer Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Cache PowerShell modules
        id: cache-lint-modules
        uses: actions/cache@v5
        with:
          path: ~/.local/share/powershell/Modules
          key: ${{ runner.os }}-psmodules-lint-${{ hashFiles('build.depend.psd1') }}
          restore-keys: |
            ${{ runner.os }}-psmodules-lint-

      - name: Install PSScriptAnalyzer
        if: steps.cache-lint-modules.outputs.cache-hit != 'true'
        shell: pwsh
        run: |
          $moduleFound = Get-Module -ListAvailable -Name PSScriptAnalyzer
          if ($moduleFound) {
            try {
              Import-Module PSScriptAnalyzer -Force -ErrorAction Stop
              Get-Command Invoke-ScriptAnalyzer -ErrorAction Stop | Out-Null
              Write-Host 'PSScriptAnalyzer already available'
            }
            catch {
              Write-Host 'PSScriptAnalyzer cache appears invalid; reinstalling...'
              Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
              Install-Module -Name PSScriptAnalyzer -Force -Scope CurrentUser
            }
          }
          else {
            Write-Host 'Installing PSScriptAnalyzer...'
            Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
            Install-Module -Name PSScriptAnalyzer -Force -Scope CurrentUser
          }

      - name: Run PSScriptAnalyzer
        shell: pwsh
        run: |
          $results = Invoke-ScriptAnalyzer -Path ./PlexAutomationToolkit -Recurse -Settings PSGallery -ReportSummary
          $errors = $results | Where-Object { $_.Severity -eq 'Error' }

          if ($results) {
            Write-Host "::group::PSScriptAnalyzer Results"
            $results | Format-Table -AutoSize
            Write-Host "::endgroup::"
          }

          if ($errors) {
            Write-Host "::error::PSScriptAnalyzer found $($errors.Count) error(s)"
            exit 1
          }

          Write-Host "PSScriptAnalyzer passed with no errors"

  unit-tests:
    name: Unit Tests (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macOS-latest]
    steps:
      - uses: actions/checkout@v6

      - name: Cache PowerShell modules
        uses: actions/cache@v5
        with:
          path: |
            ~/Documents/PowerShell/Modules
            ~/.local/share/powershell/Modules
          key: ${{ runner.os }}-psmodules-${{ hashFiles('build.depend.psd1') }}
          restore-keys: |
            ${{ runner.os }}-psmodules-

      - name: Build and Test
        shell: pwsh
        run: |
          New-Item -Path out -ItemType Directory -Force | Out-Null
          ./build.ps1 -Task Build,Test -Bootstrap

      - name: Upload Coverage to Codecov
        uses: codecov/codecov-action@v6
        if: success()
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: out/codeCoverage.xml
          flags: ${{ matrix.os }}
          fail_ci_if_error: false

      - name: Upload Test Results
        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: test-results-${{ matrix.os }}
          path: out/
          retention-days: 30

  unit-tests-ps51:
    name: Unit Tests (Windows PowerShell 5.1)
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v6

      - name: Cache PowerShell modules
        uses: actions/cache@v5
        with:
          path: |
            ~/Documents/WindowsPowerShell/Modules
          key: ${{ runner.os }}-psmodules-ps51-${{ hashFiles('build.depend.psd1') }}
          restore-keys: |
            ${{ runner.os }}-psmodules-ps51-

      - name: Build and Test
        shell: powershell
        run: |
          New-Item -Path out -ItemType Directory -Force | Out-Null
          ./build.ps1 -Task Build,Test -Bootstrap

      - name: Upload Coverage to Codecov
        uses: codecov/codecov-action@v6
        if: success()
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: out/codeCoverage.xml
          flags: windows-ps51
          fail_ci_if_error: false

      - name: Upload Test Results
        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: test-results-windows-ps51
          path: out/
          retention-days: 30

  integration-tests:
    name: Integration Tests (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 90
    # Only run for pushes to main or PRs from the same repo (has access to secrets)
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
    needs: [unit-tests, unit-tests-ps51]
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
      - uses: actions/checkout@v6

      - name: Cache PowerShell modules
        uses: actions/cache@v5
        with:
          path: |
            ~/Documents/PowerShell/Modules
            ~/.local/share/powershell/Modules
          key: ${{ runner.os }}-psmodules-${{ hashFiles('build.depend.psd1') }}
          restore-keys: |
            ${{ runner.os }}-psmodules-

      - name: Build Module
        shell: pwsh
        run: ./build.ps1 -Task Build -Bootstrap

      - name: Check Integration Secrets
        id: check-secrets
        shell: pwsh
        env:
          PLEX_SERVER_URI: ${{ secrets.PLEX_SERVER_URI }}
          PLEX_TOKEN: ${{ secrets.PLEX_TOKEN }}
        run: |
          if (-not $env:PLEX_SERVER_URI -or -not $env:PLEX_TOKEN) {
            Write-Host "::warning::Integration tests skipped - PLEX_SERVER_URI or PLEX_TOKEN secrets not configured"
            "secrets_configured=false" >> $env:GITHUB_OUTPUT
            exit 0
          }
          "secrets_configured=true" >> $env:GITHUB_OUTPUT

      - name: Validate Plex Token
        if: steps.check-secrets.outputs.secrets_configured == 'true'
        shell: pwsh
        env:
          PLEX_SERVER_URI: ${{ secrets.PLEX_SERVER_URI }}
          PLEX_TOKEN: ${{ secrets.PLEX_TOKEN }}
        run: |
          # Import the built module
          $moduleManifest = Get-ChildItem -Path Output/PlexAutomationToolkit -Filter '*.psd1' -Recurse |
            Select-Object -First 1
          if (-not $moduleManifest) {
            Write-Host "::error::Module manifest not found in Output/PlexAutomationToolkit"
            exit 1
          }
          Import-Module $moduleManifest.FullName -Force

          # Add a temporary server for validation
          $validationServerName = 'CI-TokenValidation'
          Add-PatServer -Name $validationServerName -ServerUri $env:PLEX_SERVER_URI -Token $env:PLEX_TOKEN -SkipValidation -Confirm:$false

          try {
            $testResult = Test-PatServer -Name $validationServerName

            if (-not $testResult.IsAuthenticated) {
              $errorLines = @(
                "PLEX_TOKEN secret is expired or invalid (401)."
                "To fix:"
                "  1) Run 'Update-PatServerToken' locally to get a fresh token"
                "  2) Update the PLEX_TOKEN secret in GitHub repo Settings > Secrets and variables > Actions"
              )
              Write-Host "::error::$($errorLines -join ' ')"
              exit 1
            }

            if (-not $testResult.IsConnected) {
              Write-Host "::warning::Plex server at $env:PLEX_SERVER_URI is not reachable. Integration tests may fail."
            }
            else {
              Write-Host "Token validation successful: $($testResult.FriendlyName) v$($testResult.Version)"
            }
          }
          finally {
            Remove-PatServer -Name $validationServerName -Confirm:$false -ErrorAction 'SilentlyContinue'
          }

      - name: Run Integration Tests
        if: steps.check-secrets.outputs.secrets_configured == 'true'
        timeout-minutes: 75
        shell: pwsh
        env:
          PLEX_SERVER_URI: ${{ secrets.PLEX_SERVER_URI }}
          PLEX_TOKEN: ${{ secrets.PLEX_TOKEN }}
          PLEX_TEST_SECTION_ID: ${{ secrets.PLEX_TEST_SECTION_ID }}
          PLEX_TEST_SECTION_NAME: ${{ secrets.PLEX_TEST_SECTION_NAME }}
          PLEX_TEST_LIBRARY_PATH: ${{ secrets.PLEX_TEST_LIBRARY_PATH }}
          PLEX_ALLOW_LIBRARY_REFRESH: ${{ secrets.PLEX_ALLOW_LIBRARY_REFRESH }}
        run: |
          # Set up build environment (required for persistence tests)
          Set-BuildEnvironment -Force

          # Import the built module
          $moduleManifest = Get-ChildItem -Path Output/PlexAutomationToolkit -Filter '*.psd1' -Recurse |
            Select-Object -First 1
          if (-not $moduleManifest) {
            Write-Host "::error::Module manifest not found in Output/PlexAutomationToolkit"
            exit 1
          }
          Write-Host "Importing module from: $($moduleManifest.FullName)"
          Import-Module $moduleManifest.FullName -Force

          Write-Host "Running integration tests against: $env:PLEX_SERVER_URI"
          Invoke-Pester -Path tests/Integration/ -CI -Output Detailed

      - name: Upload Integration Test Results
        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: integration-results-${{ matrix.os }}
          path: testResults.xml
          if-no-files-found: ignore