name: wai-fleet service

# A WAI fleet as a service (wai/wai-fleet, extensions/fleet.md §9): its tests (the corpus's report
# signed byte for byte, the directory recovered after a restart, a line a crash cut short cut off,
# one process per directory, every summary of the corpus read and written again by the reference
# relay's own types, and records the relay's own code signs collected from a file over HTTP),
# clippy with warnings as errors, and its smoke checks over HTTP against an instance started here
# with the corpus's organisation key, the report's bundle checked by fleet_verify.py. On Linux;
# on the macOS runner (a host the service would be deployed to) the release build and the smoke
# checks, without the tests, which build the reference relay.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    branches: [main]
    paths:
      - 'wai/wai-rs/**'
      - 'wai/wai-fleet/**'
      - 'wai/live-conformance/**'
      - 'wai/claim-conformance/**'
      - 'wai/extensions/fleet.md'
      - 'joule-code/joule-code-rs/crates/joule-moq-relay/**'
      - 'joule-code/joule-code-rs/crates/joule-moq/**'
      - 'joule-code/joule-code-rs/crates/jwp/**'
      - 'joule-code/joule-code-rs/vendor/wtransport/**'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-fleet.yml'
  pull_request:
    paths:
      - 'wai/wai-rs/**'
      - 'wai/wai-fleet/**'
      - 'wai/live-conformance/**'
      - 'wai/claim-conformance/**'
      - 'wai/extensions/fleet.md'
      - 'joule-code/joule-code-rs/crates/joule-moq-relay/**'
      - 'joule-code/joule-code-rs/crates/joule-moq/**'
      - 'joule-code/joule-code-rs/crates/jwp/**'
      - 'joule-code/joule-code-rs/vendor/wtransport/**'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-fleet.yml'

jobs:
  relevant:
    name: does this change touch it
    runs-on: linux
    outputs:
      run: ${{ steps.gate.outputs.run }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - id: gate
        run: |
          set -euo pipefail
          r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-fleet.yml \
                "${{ github.event.pull_request.base.sha }}" \
                "${{ github.event.pull_request.head.sha }}")
          echo "this change touches wai-fleet: $r"
          echo "run=$r" >> "$GITHUB_OUTPUT"

  service-linux:
    name: service · linux
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Install Rust 1.98.0
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
          rustup toolchain install 1.98.0 --profile minimal --component clippy
          rustup default 1.98.0
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: Tests and clippy
        shell: bash
        working-directory: wai/wai-fleet
        run: |
          set -euo pipefail
          cargo test --locked --release 2>&1 | tee "$RUNNER_TEMP/test.log"
          grep -qE '^test result: ok\. [1-9][0-9]* passed; 0 failed' "$RUNNER_TEMP/test.log" || { echo "::error::no test ran"; exit 1; }
          cargo clippy --locked --release --all-targets -- -D warnings
      - name: The smoke checks over HTTP
        shell: bash
        working-directory: wai/wai-fleet
        run: |
          set -euo pipefail
          cargo build --locked --release
          dir="$RUNNER_TEMP/fleet"; key="$RUNNER_TEMP/organisation.key"; rm -rf "$dir" "$key"
          # The corpus's organisation key, from its fixed seed (a test key, never a deployment's).
          python3 -I -c 'import hashlib,sys; sys.stdout.buffer.write(hashlib.sha256(b"wai:fleet/corpus/key\x00organisation").digest())' > "$key"
          WAI_FLEET_KEY="$key" WAI_FLEET_DIR="$dir" WAI_FLEET_ADDR=127.0.0.1:18252 \
            "${CARGO_TARGET_DIR:-target}/release/wai-fleet" serve 2> "$RUNNER_TEMP/service.log" &
          pid=$!
          trap 'kill $pid 2>/dev/null || true; cat "$RUNNER_TEMP/service.log"' EXIT
          for _ in $(seq 1 50); do curl -s -o /dev/null http://127.0.0.1:18252/v1/fleet/health && break; sleep 0.2; done
          bash smoke.sh http://127.0.0.1:18252

  service-macos:
    name: service · macos
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: macos
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      # launchd's PATH omits cargo on the macOS host runner.
      - name: Put cargo on PATH
        shell: bash
        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: The smoke checks over HTTP
        shell: bash
        working-directory: wai/wai-fleet
        run: |
          set -euo pipefail
          nice -n 10 cargo build --locked --release
          dir="$RUNNER_TEMP/fleet"; key="$RUNNER_TEMP/organisation.key"; rm -rf "$dir" "$key"
          python3 -I -c 'import hashlib,sys; sys.stdout.buffer.write(hashlib.sha256(b"wai:fleet/corpus/key\x00organisation").digest())' > "$key"
          WAI_FLEET_KEY="$key" WAI_FLEET_DIR="$dir" WAI_FLEET_ADDR=127.0.0.1:18252 \
            "${CARGO_TARGET_DIR:-target}/release/wai-fleet" serve 2> "$RUNNER_TEMP/service.log" &
          pid=$!
          trap 'kill $pid 2>/dev/null || true; cat "$RUNNER_TEMP/service.log"' EXIT
          for _ in $(seq 1 50); do curl -s -o /dev/null http://127.0.0.1:18252/v1/fleet/health && break; sleep 0.2; done
          bash smoke.sh http://127.0.0.1:18252