name: Integration Tests

# Real integration tests against a live Proxmox VE instance.
#
# Architecture:
#   build           → GitHub-hosted, dotnet publish → upload artifact
#   container-image → GitHub-hosted, build+push Docker image to GHCR
#   integration     → self-hosted runner in Docker container
#
# Required repository secrets (for provisioning):
#   PVE_ENDPOINT       - Parent PVE API URL (e.g. https://pve.example.com:8006)
#   PVE_API_TOKEN      - Parent PVE API token (for Terraform + uploads)
#   PVE_TARGET_NODE    - Parent PVE node name
#
# Optional secrets (for skip_provision mode):
#   PVETEST_HOST       - Hostname or IP of a pre-existing nested PVE
#   PVETEST_APITOKEN   - API token for the pre-existing nested PVE
#
# WARNING: Integration tests create and destroy real resources on the target
# node. Never run against production.

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:
    inputs:
      skip_provision:
        description: 'Skip provisioning (use existing PVE from PVETEST_HOST secret)'
        required: false
        type: boolean
        default: false

permissions:
  contents: read
  packages: write

env:
  INFRA_DIR: tests/infrastructure
  SCRIPTS_DIR: tests/infrastructure/scripts
  PVE_PASSWORD: "Testpass123!"
  TEST_IMAGE: ghcr.io/goodolclint/psproxmoxve-integration

jobs:
  # ── Build module artifact (GitHub-hosted) ────────────────────────────
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v5

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '9.0.x'

      - name: Build module
        run: dotnet publish src/PSProxmoxVE/PSProxmoxVE.csproj --configuration Release --framework netstandard2.0 --output ./publish/netstandard2.0

      - name: Clean publish output
        run: rm -f ./publish/netstandard2.0/*.deps.json

      - name: Upload module artifact
        uses: actions/upload-artifact@v7
        with:
          name: module-integration
          path: ./publish/netstandard2.0/

  # ── Build test container image (GitHub-hosted) ───────────────────────
  container-image:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v5

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v7
        with:
          context: tests/infrastructure
          file: tests/infrastructure/Dockerfile
          push: true
          tags: ${{ env.TEST_IMAGE }}:${{ github.sha }},${{ env.TEST_IMAGE }}:latest

  # ── Clean up old container images from GHCR ──────────────────────────
  cleanup-images:
    needs: integration
    if: always()
    runs-on: ubuntu-latest
    timeout-minutes: 5
    env:
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
    steps:
      - name: Delete old container image versions
        uses: actions/delete-package-versions@v5
        with:
          package-name: psproxmoxve-integration
          package-type: container
          min-versions-to-keep: 1
          delete-only-untagged-versions: false
          token: ${{ secrets.GITHUB_TOKEN }}

  # ── Integration tests (self-hosted runner in Docker container) ───────
  integration:
    needs: [build, container-image]
    runs-on: [self-hosted, proxmox, integration]
    timeout-minutes: 45
    container:
      image: ghcr.io/goodolclint/psproxmoxve-integration:${{ github.sha }}
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
      volumes:
        - /opt/pve-isos:/opt/pve-isos
    strategy:
      fail-fast: false
      max-parallel: 1
      matrix:
        pve_version: ['9', '8']
        include:
          - pve_version: '9'
            iso_base: /opt/pve-isos/proxmox-ve_9.1-1.iso
            iso_filename: proxmox-ve_9.1-1-auto.iso
            vm_id: 99909
            vm_name: pve-test-pve9
          - pve_version: '8'
            iso_base: /opt/pve-isos/proxmox-ve_8.4-1.iso
            iso_filename: proxmox-ve_8.4-1-auto.iso
            vm_id: 99908
            vm_name: pve-test-pve8

    steps:
      - name: Mask test password
        run: echo "::add-mask::${PVE_PASSWORD}"

      - uses: actions/checkout@v5

      - name: Download module artifact
        uses: actions/download-artifact@v8
        with:
          name: module-integration
          path: ./publish/netstandard2.0/

      # ── Pre-flight cleanup ───────────────────────────────────────────

      - name: Pre-flight cleanup
        if: inputs.skip_provision != true
        shell: bash
        env:
          PVE_API_TOKEN: ${{ secrets.PVE_API_TOKEN }}
        run: |
          bash ${SCRIPTS_DIR}/preflight-cleanup.sh \
            "${{ secrets.PVE_ENDPOINT }}" \
            "${PVE_API_TOKEN}" \
            ${{ matrix.vm_id }} \
            "${{ matrix.iso_filename }}" \
            "${INFRA_DIR}"

      # ── Provision nested PVE ─────────────────────────────────────────

      - name: Generate answer file
        if: inputs.skip_provision != true
        shell: bash
        run: |
          sed "s/\${root_password}/${PVE_PASSWORD}/" \
            ${INFRA_DIR}/answer.toml.tftpl > ${RUNNER_TEMP}/answer.toml
          echo "Generated answer file:"
          cat ${RUNNER_TEMP}/answer.toml

      - name: Prepare auto-install ISO
        if: inputs.skip_provision != true
        shell: bash
        run: |
          bash ${SCRIPTS_DIR}/prepare-auto-iso.sh \
            "${{ matrix.iso_base }}" \
            ${RUNNER_TEMP}/answer.toml \
            ${SCRIPTS_DIR}/first-boot.sh \
            "${RUNNER_TEMP}/${{ matrix.iso_filename }}"

      - name: Terraform init
        if: inputs.skip_provision != true
        shell: bash
        working-directory: ${{ env.INFRA_DIR }}
        run: terraform init -input=false

      - name: Terraform apply
        if: inputs.skip_provision != true
        id: terraform
        shell: bash
        working-directory: ${{ env.INFRA_DIR }}
        env:
          TF_VAR_proxmox_endpoint: ${{ secrets.PVE_ENDPOINT }}
          TF_VAR_proxmox_api_token: ${{ secrets.PVE_API_TOKEN }}
          TF_VAR_target_node: ${{ secrets.PVE_TARGET_NODE }}
          TF_VAR_test_vm_password: ${{ env.PVE_PASSWORD }}
          TF_VAR_vm_id: ${{ matrix.vm_id }}
          TF_VAR_vm_name: ${{ matrix.vm_name }}
        run: |
          export TF_VAR_iso_local_path="${RUNNER_TEMP}/${{ matrix.iso_filename }}"
          terraform apply -auto-approve -input=false
          echo "vm_id=$(terraform output -raw pve_test_vm_id)" >> "$GITHUB_OUTPUT"

      - name: Wait for install and create API token
        if: inputs.skip_provision != true
        id: provision
        shell: bash
        env:
          PVE_API_TOKEN: ${{ secrets.PVE_API_TOKEN }}
        run: |
          OUTPUT=$(bash ${SCRIPTS_DIR}/create-api-token.sh \
            "${{ secrets.PVE_ENDPOINT }}" \
            "${PVE_API_TOKEN}" \
            "${{ steps.terraform.outputs.vm_id }}" \
            "${PVE_PASSWORD}" \
            900)
          VM_IP=$(echo "$OUTPUT" | grep "^IP=" | cut -d= -f2)
          VM_TOKEN=$(echo "$OUTPUT" | grep "^TOKEN=" | cut -d= -f2-)
          echo "::add-mask::${VM_IP}"
          echo "::add-mask::${VM_TOKEN}"
          echo "Nested PVE ${{ matrix.pve_version }} ready at ${VM_IP}"
          echo "host=${VM_IP}" >> "$GITHUB_OUTPUT"
          echo "token=${VM_TOKEN}" >> "$GITHUB_OUTPUT"

      # ── Resolve test target ──────────────────────────────────────────

      - name: Set test target
        id: target
        shell: bash
        run: |
          if [ "${{ inputs.skip_provision }}" = "true" ]; then
            echo "host=${{ secrets.PVETEST_HOST }}" >> "$GITHUB_OUTPUT"
            echo "port=${{ secrets.PVETEST_PORT || '8006' }}" >> "$GITHUB_OUTPUT"
            echo "token=${{ secrets.PVETEST_APITOKEN }}" >> "$GITHUB_OUTPUT"
            echo "node=${{ secrets.PVETEST_NODE || 'pve' }}" >> "$GITHUB_OUTPUT"
            echo "storage=${{ secrets.PVETEST_STORAGE || 'local' }}" >> "$GITHUB_OUTPUT"
          else
            echo "host=${{ steps.provision.outputs.host }}" >> "$GITHUB_OUTPUT"
            echo "port=8006" >> "$GITHUB_OUTPUT"
            echo "token=${{ steps.provision.outputs.token }}" >> "$GITHUB_OUTPUT"
            echo "node=pve" >> "$GITHUB_OUTPUT"
            echo "storage=local" >> "$GITHUB_OUTPUT"
          fi

      - name: Verify PVE API reachable
        shell: bash
        run: |
          HOST="${{ steps.target.outputs.host }}"
          PORT="${{ steps.target.outputs.port }}"
          TOKEN="${{ steps.target.outputs.token }}"
          echo "Testing connectivity to PVE ${{ matrix.pve_version }} API at ${HOST}:${PORT}..."
          if curl -sk --connect-timeout 10 \
              -H "Authorization: PVEAPIToken=${TOKEN}" \
              "https://${HOST}:${PORT}/api2/json/nodes" | grep -q '"node"'; then
            echo "PVE API is responsive"
          else
            echo "::error::Cannot reach PVE API at ${HOST}:${PORT}"
            exit 1
          fi

      # ── Install module ────────────────────────────────────────────────

      - name: Copy module to module path
        shell: pwsh
        run: |
          $modulePath = "$HOME/.local/share/powershell/Modules/PSProxmoxVE"
          New-Item -ItemType Directory -Path $modulePath -Force | Out-Null
          Copy-Item -Path ./publish/netstandard2.0/* -Destination $modulePath -Recurse -Force

      # ── Prepare test Linux VM ────────────────────────────────────────

      - name: Deploy test Linux VM to nested PVE
        if: inputs.skip_provision != true
        id: linux_vm
        shell: bash
        run: |
          OUTPUT=$(bash ${SCRIPTS_DIR}/prepare-test-vm.sh \
            "${{ steps.provision.outputs.host }}" \
            "${PVE_PASSWORD}" \
            200 \
            "${{ steps.target.outputs.node }}" \
            "${{ steps.provision.outputs.token }}")
          LINUX_VMID=$(echo "$OUTPUT" | grep "^LINUX_VMID=" | cut -d= -f2)
          echo "linux_vmid=${LINUX_VMID}" >> "$GITHUB_OUTPUT"

      # ── Run tests ─────────────────────────────────────────────────────

      - name: Create test ISO
        shell: bash
        run: dd if=/dev/urandom of=${RUNNER_TEMP}/pvetest.iso bs=1M count=1 2>/dev/null

      - name: Run integration tests
        shell: pwsh
        env:
          PVETEST_HOST: ${{ steps.target.outputs.host }}
          PVETEST_PORT: ${{ steps.target.outputs.port }}
          PVETEST_APITOKEN: ${{ steps.target.outputs.token }}
          PVETEST_NODE: ${{ steps.target.outputs.node }}
          PVETEST_STORAGE: ${{ steps.target.outputs.storage }}
          PVETEST_PVE_VERSION: ${{ matrix.pve_version }}
          PVETEST_LINUX_VMID: ${{ steps.linux_vm.outputs.linux_vmid }}
        run: |
          $env:PVETEST_ISO_PATH = Join-Path $env:RUNNER_TEMP "pvetest.iso"
          Import-Module Pester -MinimumVersion 5.0
          $config = New-PesterConfiguration
          $config.Run.Path = "tests/PSProxmoxVE.Tests/Integration"
          $config.Filter.Tag = "Integration"
          $config.Output.Verbosity = "Detailed"
          $config.TestResult.Enabled = $true
          $config.TestResult.OutputFormat = "NUnitXml"
          $config.TestResult.OutputPath = "TestResults/integration-results.xml"
          Invoke-Pester -Configuration $config

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: integration-test-results-pve${{ matrix.pve_version }}
          path: TestResults/

      # ── Teardown ─────────────────────────────────────────────────────

      - name: Terraform destroy
        if: always() && inputs.skip_provision != true
        shell: bash
        working-directory: ${{ env.INFRA_DIR }}
        env:
          TF_VAR_proxmox_endpoint: ${{ secrets.PVE_ENDPOINT }}
          TF_VAR_proxmox_api_token: ${{ secrets.PVE_API_TOKEN }}
          TF_VAR_target_node: ${{ secrets.PVE_TARGET_NODE }}
          TF_VAR_test_vm_password: ${{ env.PVE_PASSWORD }}
          TF_VAR_vm_id: ${{ matrix.vm_id }}
          TF_VAR_vm_name: ${{ matrix.vm_name }}
        run: |
          export TF_VAR_iso_local_path="${RUNNER_TEMP}/${{ matrix.iso_filename }}"
          terraform init -input=false
          terraform destroy -auto-approve -input=false || true
          rm -f terraform.tfstate terraform.tfstate.backup .terraform.tfstate.lock.info

      - name: Final cleanup
        if: always() && inputs.skip_provision != true
        shell: bash
        env:
          PVE_API_TOKEN: ${{ secrets.PVE_API_TOKEN }}
        run: |
          bash ${SCRIPTS_DIR}/preflight-cleanup.sh \
            "${{ secrets.PVE_ENDPOINT }}" \
            "${PVE_API_TOKEN}" \
            ${{ matrix.vm_id }} \
            "${{ matrix.iso_filename }}" \
            "${INFRA_DIR}" || true