name: ACCESS Core CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

env:
  DJANGO_SETTINGS_MODULE: access_core.settings.base
  POSTGRES_DB: access_core_test
  POSTGRES_USER: testuser
  POSTGRES_PASSWORD: testpass
  POSTGRES_HOST: localhost
  # Deterministic test-only key (same value as access_core/settings/test.py).
  PHI_LOCAL_ENCRYPTION_KEY: VcTbV55bLdCaKgpV1ihnVkTQkP4hj4I2nY/bfEexS0g=

jobs:
  lint-and-test:
    name: Lint & Test
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_DB: access_core_test
          POSTGRES_USER: testuser
          POSTGRES_PASSWORD: testpass
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: pip

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install pytest pytest-django "ruff==0.16.5"

      - name: Lint (Ruff)
        run: |
          ruff check access_core/
          ruff format --check access_core/

      - name: Run migrations
        env:
          DJANGO_SECRET_KEY: ci-test-secret-key-not-for-production
        run: |
          python manage.py migrate --noinput

      - name: Run unit tests
        env:
          DJANGO_SECRET_KEY: ci-test-secret-key-not-for-production
        run: |
          python manage.py test access_core/ --verbosity 1

      - name: Run integration tests (mock server)
        if: github.ref == 'refs/heads/main'
        env:
          DJANGO_SECRET_KEY: ci-test-secret-key-not-for-production
          CMS_API_BASE_URL: http://localhost:3001
          CMS_FHIR_VERSION_PATH: ""
        run: |
          # The Actions service postgres on :5432 is already running with migrations
          # applied (same credentials via the job env). Starting compose's `db` would
          # collide with it on host port 5432 — only start the mock server here.
          docker compose up -d cms-mock
          for i in $(seq 1 30); do
            wget -qO- http://localhost:3001/fhir/metadata && break
            sleep 2
          done
          wget -q http://localhost:3001/fhir/metadata
          python scripts/test_django_integration.py --base http://localhost:3001

# Hold until we have AWS access.
#  build-docker:
#    name: Build Docker Image
#    needs: lint-and-test
#    runs-on: ubuntu-latest
#    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
#
#    steps:
#      - uses: actions/checkout@v4
#
#      - name: Set up Docker Buildx
#        uses: docker/setup-buildx-action@v3
#
#      - name: Login to ECR (AWS)
#        if: github.event_name != 'pull_request'
#        run: |
#          aws ecr get-login-password --region us-east-1 \
#            | docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-east-1.amazonaws.com
#
#      - name: Build and tag Docker image
#        uses: docker/build-push-action@v5
#        with:
#          context: .
#          push: false
#          tags: |
#            123456789012.dkr.ecr.us-east-1.amazonaws.com/access-core:${{ github.sha }}
#            123456789012.dkr.ecr.us-east-1.amazonaws.com/access-core:latest
#
#      - name: Push to ECR
#        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
#        uses: docker/build-push-action@v5
#        with:
#          context: .
#          push: true
#          tags: |
#            123456789012.dkr.ecr.us-east-1.amazonaws.com/access-core:${{ github.sha }}
#
#      - name: Deploy to ECS (staging)
#        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
#        run: |
#          aws ecs update-service \
#            --cluster access-core-staging \
#            --service web \
#            --force-new-deployment \
#            --region us-east-1