name: Main Release

on:
  push:
    branches: [main]

jobs:
  hadolint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        continue-on-error: true
        with:
          dockerfile: pkg/Dockerfile

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
        with:
          python-version: "3.14"
      - name: Install dependencies
        run: pip install -r requirements.txt pytest ruff==0.17.1
      - name: Lint (undefined names)
        run: ruff check src/ tests/ --select F821
      - name: Run unit tests
        run: pytest tests/ -v
        env:
          # indexer/server read env at import; unit tests need no real backend
          QDRANT_URL: http://localhost:6333
          COLLECTION_NAME: test

  integration-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Cleanup old Qdrant container
        run: |
          docker rm -f qdrant-${{ github.run_id }} 2>/dev/null || true

      - name: Start Qdrant
        run: |
          docker run -d --name qdrant-${{ github.run_id }} \
            --network "container:$(hostname)" \
            docker.io/qdrant/qdrant:v1.19

      - name: Wait for Qdrant
        run: |
          # /healthz answers before the storage engine accepts writes, and a cold
          # container on a loaded host can take several seconds to create its
          # first collection. Gate on a real write round-trip, not on /healthz.
          ready=""
          for i in $(seq 1 60); do
            if curl -sf "http://localhost:6333/healthz" > /dev/null 2>&1 \
              && curl -sf -X PUT "http://localhost:6333/collections/ci_readiness_probe?timeout=60" \
                   -H 'Content-Type: application/json' \
                   -d '{"vectors":{"size":4,"distance":"Cosine"}}' > /dev/null 2>&1; then
              curl -sf -X DELETE "http://localhost:6333/collections/ci_readiness_probe" > /dev/null 2>&1 || true
              ready="yes"
              echo "QDRANT ready: write path OK (attempt $i)"
              break
            fi
            echo "Waiting for Qdrant... ($i/60)"
            sleep 1
          done
          if [ -z "$ready" ]; then
            echo "Qdrant write path never became ready"
            docker logs --tail 100 qdrant-${{ github.run_id }} || true
            exit 1
          fi

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
        with:
          python-version: "3.14"
      - name: Install dependencies
        run: pip install -r requirements.txt pytest
      - name: Run integration tests
        run: pytest tests/ -v -m integration
        env:
          QDRANT_URL: http://localhost:6333
          COLLECTION_NAME: test_mcp_maildir
          # The qdrant client defaults to a 5s request timeout, which a cold
          # collection on a shared runner can exceed; this job has no SLA.
          QDRANT_TIMEOUT: "60"

      - name: Qdrant diagnostics
        if: failure()
        run: |
          docker ps -a || true
          docker logs --tail 200 qdrant-${{ github.run_id }} || true

      - name: Cleanup Qdrant
        if: always()
        run: docker rm -f qdrant-${{ github.run_id }} || true

  build:
    needs: [test, integration-test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - run: docker build -f pkg/Dockerfile -t jcabillot/mcp-maildir:${{ github.sha }} .

  tag:
    needs: [build]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
      - name: Configure git auth
        run: |
          git remote set-url origin "https://x-access-token:${{ secrets.SA_TOKEN_ACTION_PUSH_TAGS }}@scm.cabillot.eu/perso/mcp-maildir.git"
      - uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # v1.75.0
        env:
          GITHUB_TOKEN: ${{ secrets.SA_TOKEN_ACTION_PUSH_TAGS }}
          DEFAULT_BUMP: patch
          RELEASE_BRANCHES: main
          WITH_V: true
          GIT_API_TAGGING: false