name: ci-release-gate

on:
  workflow_dispatch:

jobs:
  release-gate:
    runs-on: ubuntu-latest
    timeout-minutes: 120

    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: hyb_oa
          POSTGRES_USER: hyboa_user
          POSTGRES_PASSWORD: hyboa_password
        ports:
          - 5432:5432
        options: >-
          --health-cmd="pg_isready -U hyboa_user -d hyb_oa"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=10

    env:
      QA_DB_HOST: 127.0.0.1
      QA_DB_PORT: 5432
      QA_DB_USER: hyboa_user
      QA_DB_PASSWORD: hyboa_password
      QA_DB_ADMIN_DB: postgres
      QA_PORT: 3000
      QA_HOST: 127.0.0.1
      DEPLOY_SERVER: ${{ secrets.RELEASE_DEPLOY_SERVER }}
      REMOTE_DIR: ${{ secrets.RELEASE_REMOTE_DIR }}
      REMOTE_ENV_FILE: ${{ secrets.RELEASE_REMOTE_ENV_FILE }}
      LIVE_SMOKE_BASE_URL: ${{ secrets.LIVE_SMOKE_BASE_URL }}
      LIVE_SMOKE_ADMIN_IDENTIFIER: ${{ secrets.LIVE_SMOKE_ADMIN_IDENTIFIER }}
      LIVE_SMOKE_ADMIN_PASSWORD: ${{ secrets.LIVE_SMOKE_ADMIN_PASSWORD }}
      LIVE_SMOKE_EMPLOYEE_IDENTIFIER: ${{ secrets.LIVE_SMOKE_EMPLOYEE_IDENTIFIER }}
      LIVE_SMOKE_EMPLOYEE_PASSWORD: ${{ secrets.LIVE_SMOKE_EMPLOYEE_PASSWORD }}
      LIVE_EXPECT_WECOM_STATUS: ${{ secrets.LIVE_EXPECT_WECOM_STATUS }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: |
            server/package-lock.json
            client/package-lock.json

      - name: Install server dependencies
        working-directory: server
        run: npm ci

      - name: Install client dependencies
        working-directory: client
        run: npm ci

      - name: Install PostgreSQL client
        run: sudo apt-get update && sudo apt-get install -y postgresql-client

      - name: Install Playwright browsers
        working-directory: client
        run: npx playwright install --with-deps

      - name: Setup SSH agent
        uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: ${{ secrets.RELEASE_DEPLOY_SSH_KEY }}

      - name: Trust deploy host
        run: |
          mkdir -p ~/.ssh
          host_part="${DEPLOY_SERVER#*@}"
          ssh-keyscan -H "$host_part" >> ~/.ssh/known_hosts

      - name: Run release gate
        run: bash scripts/qa/run-release-gate.sh ci-release

      - name: Upload release gate artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: release-gate-artifacts-${{ github.run_id }}
          path: |
            artifacts/release-gate
            client/playwright-report
            client/test-results
          if-no-files-found: ignore