name: execution-zone-module Doc-Tests

# Runs the executable execution-zone-module doc-test
# (doctests/logos-execution-zone-runtime.test.yaml) end-to-end via the shared
# doctest CLI: builds logoscore and lgpm, packages and installs THIS commit of
# the execution-zone module as an .lgx, starts the daemon, loads the module,
# calls its methods, and asserts on the output.
#
# ──────────────────────────────────────────────────────────────────────────────
# One-time setup required for the clickable report links to work:
#
#   1. Repo Settings → Pages → "Build and deployment" → Source: "Deploy from a
#      branch", Branch: `gh-pages` / `(root)`. (The publish-report job creates
#      the gh-pages branch on its first run.)
#   2. Nothing else — GITHUB_TOKEN already has the permissions granted below.
#
# Each run publishes the two-column HTML report to:
#   https://<owner>.github.io/<repo>/pr-<N>/<os>/      (pull requests)
#   https://<owner>.github.io/<repo>/main/<os>/        (pushes to main/master)
# and (for PRs) posts/updates a comment with the links.
#
# Note: pull requests opened from forks get a read-only GITHUB_TOKEN, so the
# Pages push and PR comment are skipped for them — the downloadable artifact is
# still produced. PRs from branches in this repo get the full clickable links.
# ──────────────────────────────────────────────────────────────────────────────

on:
  pull_request:
    branches: [master, main]
  push:
    branches: [master, main]

concurrency:
  group: doctests-${{ github.ref }}
  cancel-in-progress: true

jobs:
  doctests:
    name: execution-zone-module doc-tests (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]

    runs-on: ${{ matrix.os }}
    timeout-minutes: 90

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@main

      - name: Setup Cachix
        uses: cachix/cachix-action@v15
        with:
          name: logos-co
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

      # Resolve the commit under test. For pull requests this is the PR's head
      # commit (not the synthetic merge commit); for pushes it's the pushed
      # commit. Passed to --release-for below so the doc-test packages THIS commit
      # of logos-execution-zone-module instead of the latest published flake.
      #
      # Fork PRs are the exception: their head commit lives in the fork, not in
      # logos-co/logos-execution-zone-module, so nix could not fetch
      # `github:logos-co/logos-execution-zone-module/<sha>`. We blank the SHA for
      # forks (--release-for repo= → pins that repo to latest), so the doc-test
      # still runs for fork PRs, just against master.
      - name: Resolve commit under test
        id: commit
        shell: bash
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ] && \
             [ "${{ github.event.pull_request.head.repo.fork }}" = "true" ]; then
            echo "sha=" >> "$GITHUB_OUTPUT"
            echo "Fork PR detected — doc-test will run against latest master."
          else
            echo "sha=${{ github.event.pull_request.head.sha || github.sha }}" >> "$GITHUB_OUTPUT"
          fi

      # The runner is the shared `doctest` CLI, invoked directly via its flake
      # (github:logos-co/logos-doctest). The flake bundles Python + PyYAML
      # (+ rich), so no pip install step is needed.
      #
      # --release-for pins the {release} placeholder for logos-execution-zone-module
      # to the commit under test, so
      # `github:logos-co/logos-execution-zone-module{release}` in the spec becomes
      # `.../<sha>` — the doc-test packages and exercises this PR/push rather than
      # master. Every other repo URL still resolves to latest.
      - name: Run execution-zone-module runtime doc-test
        run: |
          # --continue-on-fail so the run walks every step and the published
          # report is complete. The job still fails (non-zero exit) if any step
          # failed; this only changes whether we stop early.
          nix run github:logos-co/logos-doctest -- run \
            doctests/logos-execution-zone-runtime.test.yaml \
            --verbose \
            --continue-on-fail \
            --release-for logos-execution-zone-module=${{ steps.commit.outputs.sha }} \
            --report "${{ runner.temp }}/lez-doctest-report.html"

      - name: Stage report for upload
        if: always()
        shell: bash
        run: |
          mkdir -p report-out
          # Name it index.html so the published directory URL renders directly.
          if [ -f "${{ runner.temp }}/lez-doctest-report.html" ]; then
            cp "${{ runner.temp }}/lez-doctest-report.html" report-out/index.html
          else
            echo "<h1>No report produced</h1>" > report-out/index.html
          fi

      - name: Upload execution-zone-module execution report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: lez-doctest-report-${{ matrix.os }}
          path: report-out/index.html
          if-no-files-found: warn

      - name: Verify markdown generation
        run: |
          nix run github:logos-co/logos-doctest -- generate \
            doctests/logos-execution-zone-runtime.test.yaml \
            --release-for logos-execution-zone-module=${{ steps.commit.outputs.sha }} \
            -o "/tmp/logos-execution-zone-runtime.md"
          test -s "/tmp/logos-execution-zone-runtime.md"
          echo "Generated markdown successfully"

  publish-report:
    name: Publish report to GitHub Pages
    needs: doctests
    # Run even when tests fail — a failing run is exactly when you want to open
    # the report. Skip on forks, where GITHUB_TOKEN can't push or comment.
    if: ${{ always() && github.event.pull_request.head.repo.fork != true }}
    runs-on: ubuntu-latest

    permissions:
      contents: write          # push to the gh-pages branch
      pull-requests: write      # post/update the PR comment

    # Serialize Pages pushes so two refs can't race on the gh-pages branch.
    concurrency:
      group: gh-pages-publish
      cancel-in-progress: false

    steps:
      - name: Download all reports
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          # No `name:` → downloads every artifact into artifacts/<name>/...

      - name: Arrange site directory
        id: arrange
        shell: bash
        run: |
          set -euo pipefail
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            BASE="pr-${{ github.event.pull_request.number }}"
          else
            BASE="main"
          fi
          echo "base=$BASE" >> "$GITHUB_OUTPUT"

          mkdir -p "site/$BASE"
          found=""
          for os in ubuntu-latest macos-latest; do
            src="artifacts/lez-doctest-report-$os/index.html"
            if [ -f "$src" ]; then
              mkdir -p "site/$BASE/$os"
              cp "$src" "site/$BASE/$os/index.html"
              found="$found $os"
            fi
          done
          echo "found=$found" >> "$GITHUB_OUTPUT"

          # Landing page for this ref linking to each OS report.
          {
            echo "<!doctype html><meta charset=utf-8>"
            echo "<title>execution-zone-module doc-test reports — $BASE</title>"
            echo "<style>body{font:16px system-ui;margin:40px;max-width:640px}a{color:#2563eb}</style>"
            echo "<h1>execution-zone-module doc-test reports</h1>"
            echo "<p><strong>$BASE</strong> · commit <code>${GITHUB_SHA::7}</code></p><ul>"
            for os in ubuntu-latest macos-latest; do
              if [ -d "site/$BASE/$os" ]; then
                echo "<li><a href=\"./$os/\">$os</a></li>"
              fi
            done
            echo "</ul>"
          } > "site/$BASE/index.html"

      - name: Deploy to gh-pages
        if: steps.arrange.outputs.found != ''
        uses: peaceiris/actions-gh-pages@v4
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: ./site
          keep_files: true          # don't wipe other PRs' directories
          commit_message: "Publish execution-zone-module doc-test report for ${{ steps.arrange.outputs.base }} (${{ github.sha }})"

      - name: Comment on PR with report links
        if: ${{ github.event_name == 'pull_request' && steps.arrange.outputs.found != '' }}
        uses: actions/github-script@v7
        with:
          script: |
            const base = "${{ steps.arrange.outputs.base }}";
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const root = `https://${owner}.github.io/${repo}/${base}`;
            const oses = "${{ steps.arrange.outputs.found }}".trim().split(/\s+/).filter(Boolean);

            const links = oses.map(os => `- [\`${os}\` report](${root}/${os}/)`).join("\n");
            const marker = "<!-- lez-doctest-report-links -->";
            const body =
              `${marker}\n` +
              `### 📊 execution-zone-module doc-test report\n\n` +
              `This commit of the execution-zone module, packaged as an \`.lgx\` and run ` +
              `through a logoscore daemon — rendered alongside the commands actually ` +
              `run and their output (updated each run, commit \`${context.sha.slice(0,7)}\`):\n\n` +
              `${links}\n\n` +
              `_Pages can take a minute to update after the run finishes._`;

            const { data: comments } = await github.rest.issues.listComments({
              owner, repo, issue_number: context.issue.number, per_page: 100,
            });
            const existing = comments.find(c => c.body && c.body.includes(marker));
            if (existing) {
              await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
            } else {
              await github.rest.issues.createComment({ owner, repo, issue_number: context.issue.number, body });
            }