name: RustFS Table Test

on:
  workflow_dispatch:
    inputs:
      package_url:
        description: 'Direct .deb URL (nightly/R2/dev). Overrides rustfs_version.'
        required: false
        type: string
      rustfs_version:
        description: 'RustFS release tag to test (leave empty to use the latest nightly deb)'
        required: false
        type: string
      skip_smoke:
        description: 'Skip the PyIceberg end-to-end case (TBL-101)'
        required: false
        type: boolean
        default: false

concurrency:
  group: rustfs-shared-functional-tests
  cancel-in-progress: false

permissions:
  contents: read

env:
  RUSTFS_NODES: ${{ secrets.RUSTFS_NODES || vars.RUSTFS_NODES || 'vm000 vm001 vm002 vm003' }}
  RUSTFS_SSH_USER: ${{ secrets.RUSTFS_SSH_USER || vars.RUSTFS_SSH_USER || 'azureuser' }}
  RUSTFS_API_ENDPOINT: ${{ secrets.RUSTFS_API_ENDPOINT || vars.RUSTFS_API_ENDPOINT || 'http://rustfs-node1:9000' }}
  RUSTFS_ACCESS_KEY: ${{ secrets.RUSTFS_ACCESS_KEY }}
  RUSTFS_SECRET_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
  RUSTFS_NIGHTLY_PACKAGE_URL: https://dl.rustfs.com/artifacts/rustfs/packages/nightly/rustfs-nightly-latest.deb
  PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}

jobs:
  table-test:
    name: table-test
    runs-on: smoke-testing
    timeout-minutes: 60
    steps:
      - name: Checkout repository (for report parser)
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Initialize functional evidence
        id: evidence
        run: |
          set -euo pipefail
          umask 077
          FUNCTIONAL_ARTIFACTS_DIR="${RUNNER_TEMP}/rustfs-table-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
          mkdir -- "${FUNCTIONAL_ARTIFACTS_DIR}" "${FUNCTIONAL_ARTIFACTS_DIR}-scratch"
          {
            printf 'FUNCTIONAL_ARTIFACTS_DIR=%s\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
            printf 'LOG_FILE=%s/suite.log\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
            printf 'REPORT_FILE=%s/report.md\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
            printf 'TMPDIR=%s-scratch\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
          } >> "${GITHUB_ENV}"

      - name: Checkout auto-testing scripts
        timeout-minutes: 5
        env:
          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
        run: |
          set -euo pipefail
          rm -rf auto-testing
          for attempt in 1 2 3 4 5; do
            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
              echo "auto-testing cloned (attempt ${attempt})"
              exit 0
            fi
            rm -rf auto-testing
            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
            sleep $((attempt * 15))
          done
          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
          exit 1

      - name: Show environment
        run: |
          set -euo pipefail
          echo "nodes: ${RUSTFS_NODES}"
          echo "endpoint: ${RUSTFS_API_ENDPOINT}"
          aws --version
          python3 --version

      - name: Cleanup environment (before)
        timeout-minutes: 5
        continue-on-error: true
        run: |
          set -uo pipefail
          for node in ${RUSTFS_NODES}; do
            ssh -o BatchMode=yes -o ConnectTimeout=10 "${RUSTFS_SSH_USER}@${node}" '
              set -euo pipefail
              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
              ${SUDO} systemctl stop rustfs 2>/dev/null || true
              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
                ${SUDO} dpkg -P rustfs
              fi
              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
              ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms /var/lib/rustfs/kms-backup
            ' || echo "pre-cleanup failed on ${node} (continuing)"
          done

      - name: Run table suite
        id: test
        timeout-minutes: 45
        run: |
          set -euo pipefail
          chmod +x auto-testing/rustfs-table-test.sh
          PACKAGE_URL='${{ inputs.package_url }}'
          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
          SMOKE_PATH="${GITHUB_WORKSPACE:-$PWD}/scripts/table-catalog/pyiceberg_smoke.py"
          ARGS=(-y --smoke-script "${SMOKE_PATH}")
          if [ '${{ inputs.skip_smoke }}' = 'true' ]; then
            ARGS+=(--skip-smoke)
          fi
          if [ -n "${PACKAGE_URL}" ]; then
            ARGS+=(--package-url "${PACKAGE_URL}")
          elif [ -n "${RUSTFS_VERSION}" ] && [ "${RUSTFS_VERSION}" != "null" ]; then
            ARGS+=(--package-url "https://github.com/rustfs/rustfs/releases/download/${RUSTFS_VERSION}/rustfs_${RUSTFS_VERSION}_amd64.deb")
          else
            ARGS+=(--package-url "${RUSTFS_NIGHTLY_PACKAGE_URL}")
          fi
          ./auto-testing/rustfs-table-test.sh "${ARGS[@]}" --log-file "${LOG_FILE}"

      - name: Generate report
        timeout-minutes: 2
        if: ${{ always() && steps.evidence.outcome == 'success' }}
        run: |
          set -euo pipefail
          PACKAGE_URL='${{ inputs.package_url }}'
          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
          if [ -n "${PACKAGE_URL}" ]; then
            PACKAGE_SOURCE="${PACKAGE_URL}"
          elif [ -n "${RUSTFS_VERSION}" ] && [ "${RUSTFS_VERSION}" != "null" ]; then
            PACKAGE_SOURCE="version ${RUSTFS_VERSION}"
          else
            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
          fi
          CASE_TABLE="${FUNCTIONAL_ARTIFACTS_DIR}/cases.md"
          CASE_RESULT=success
          python3 scripts/functional_case_report.py "${LOG_FILE}" "${CASE_TABLE}" || CASE_RESULT=failure
          RESULT=failure
          if [ '${{ steps.test.outcome }}' = 'success' ] && [ "${CASE_RESULT}" = 'success' ]; then
            RESULT=success
          fi

          {
            echo "# RustFS S3 Tables (Iceberg REST Catalog) test report"
            echo ""
            echo "- Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
            echo "- Attempt: ${GITHUB_RUN_ATTEMPT}"
            echo "- Workflow Commit: ${GITHUB_SHA}"
            echo "- Trigger: ${{ github.event_name }}"
            echo "- Package: ${PACKAGE_SOURCE}"
            echo "- Test Step Outcome: ${RESULT}"
            echo "- Suite Step Outcome: ${{ steps.test.outcome }}"
            echo ""
            if [ "${RESULT}" = "success" ]; then
              cat "${CASE_TABLE}"
              echo ""
              echo "## Log tail"
              echo '```text'
              tail -n 200 "${LOG_FILE}"
              echo '```'
            else
              echo "The suite or evidence validation failed. See this run's artifact for partial case results and suite.log."
            fi
          } | tee "${REPORT_FILE}"
          cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
          [ "${RESULT}" = "success" ]

      - name: Upload functional report to dashboard
        timeout-minutes: 2
        if: ${{ always() && steps.evidence.outcome == 'success' }}
        continue-on-error: true
        env:
          GH_TOKEN: ${{ env.PF_TESTING_GH_TOKEN }}
          REPORT_FILE: ${{ env.REPORT_FILE }}
          SUITE: table
        run: |
          set -euo pipefail
          if [ -z "${GH_TOKEN:-}" ]; then
            echo "PF_TESTING_GH_TOKEN is not configured; skipping dashboard upload"
            exit 0
          fi
          DATE="$(date -u +%Y-%m-%d)"
          REPORT_PATH="functional-reports/${SUITE}/${DATE}.md"
          B64_FILE="$(mktemp)"
          python3 -c 'import base64,sys;print(base64.b64encode(open(sys.argv[1],"rb").read()).decode())' "${REPORT_FILE}" > "${B64_FILE}"
          SHA="$(gh api "repos/rustfs/dashboard/contents/${REPORT_PATH}" -q '.sha' 2>/dev/null || true)"
          if [ -n "${SHA}" ]; then
            jq -n --arg msg "report(${SUITE}): ${DATE}" --rawfile content "${B64_FILE}" --arg sha "${SHA}" \
              '{message:$msg, content:($content|rtrimstr("\n")), sha:$sha}' \
              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
          else
            jq -n --arg msg "report(${SUITE}): ${DATE}" --rawfile content "${B64_FILE}" \
              '{message:$msg, content:($content|rtrimstr("\n"))}' \
              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
          fi
          echo "dashboard updated: ${REPORT_PATH}"

      - name: Manage backlog issues (dedup / label / auto-close)
        timeout-minutes: 2
        # Replaces the old per-run failure filing. One entry point that:
        # - dedups by signal: failing cases are matched against open backlog
        #   issues by label (category + case ID); covered cases become a
        #   comment on the existing issue, only uncovered cases file a new one
        # - labels new issues (functional-test, category, case IDs, env)
        # - closes fixed issues after a fully green run
        # - never files or closes on cancelled runs
        if: ${{ always() && steps.evidence.outcome == 'success' }}
        continue-on-error: true
        env:
          GH_TOKEN: ${{ env.PF_TESTING_GH_TOKEN }}
        run: |
          set -euo pipefail
          if [ -z "${GH_TOKEN:-}" ]; then
            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue management"
            exit 0
          fi
          if [ ! -f auto-testing/scripts/issue_manager.py ]; then
            echo "issue_manager.py not found; skipping backlog issue management"
            exit 0
          fi
          PACKAGE_URL='${{ inputs.package_url }}'
          PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
          if [ -n "${PACKAGE_URL}" ]; then PACKAGE_SOURCE="${PACKAGE_URL}"; fi
          python3 auto-testing/scripts/issue_manager.py handle \
            --repo rustfs/backlog \
            --suite table --category table --suite-label "S3 Tables" \
            --outcome '${{ steps.test.outcome }}' \
            --report "${FUNCTIONAL_ARTIFACTS_DIR}/cases.md" \
            --run-url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
            --run-id "${GITHUB_RUN_ID}" \
            --attempt "${GITHUB_RUN_ATTEMPT}" \
            --commit "${GITHUB_SHA}" \
            --trigger "${GITHUB_EVENT_NAME}" \
            --package-source "${PACKAGE_SOURCE}" \
            --report-file "${REPORT_FILE}" \
            --log "${LOG_FILE}" \
            --date "$(date -u +%Y-%m-%d)"

      - name: File failure issue in rustfs/backlog
        timeout-minutes: 2
        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled') }}
        continue-on-error: true
        env:
          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
          EVIDENCE_OUTCOME: ${{ steps.evidence.outcome }}
          SUITE: 'table'
          SUITE_LABEL: 'S3 Tables'
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          set -euo pipefail
          if [ -z "${GH_TOKEN:-}" ]; then
            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
            exit 0
          fi
          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
          EXISTING="$(gh issue list -R rustfs/backlog --state all \
            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
            --json number --jq '.[].number' || true)"
          if [ -n "${EXISTING}" ]; then
            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
            exit 0
          fi
          redact() {
            sed -E \
              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
          }
          BODY_FILE="$(mktemp)"
          {
            echo "The **${SUITE_LABEL}** functional suite failed."
            echo ""
            echo "- Suite: \`${SUITE}\`"
            echo "- Run: ${RUN_URL}"
            echo "- Attempt: ${GITHUB_RUN_ATTEMPT}"
            echo "- Workflow Commit: ${GITHUB_SHA}"
            echo "- Trigger: ${GITHUB_EVENT_NAME}"
            echo "- Date: $(date -u +%Y-%m-%d)"
            echo ""
            echo "## Report (errors and symptoms)"
            echo ""
            if [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${REPORT_FILE}" ]; then
              redact < "${REPORT_FILE}"
            elif [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${LOG_FILE:-}" ]; then
              echo "(report file missing; log tail below)"
              echo ""
              tail -n 200 "${LOG_FILE}" | redact
            else
              echo "(no report or log file was produced)"
            fi
          } | head -c 55000 > "${BODY_FILE}"
          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
              --body-file "${BODY_FILE}" --label functional-test; then
            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
          fi
          echo "filed backlog issue for suite ${SUITE}"

      - name: Upload report and logs
        timeout-minutes: 2
        if: ${{ always() && steps.evidence.outcome == 'success' }}
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: rustfs-table-test-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/report.md
            ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/cases.md
            ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/suite.log
          if-no-files-found: error
          retention-days: 30

      - name: Cleanup environment (after)
        timeout-minutes: 5
        if: always()
        continue-on-error: true
        run: |
          set -uo pipefail
          for node in ${RUSTFS_NODES}; do
            ssh -o BatchMode=yes -o ConnectTimeout=10 "${RUSTFS_SSH_USER}@${node}" '
              set -euo pipefail
              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
              ${SUDO} systemctl stop rustfs 2>/dev/null || true
              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
                ${SUDO} dpkg -P rustfs
              fi
              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
              ${SUDO} rm -f /etc/default/rustfs
            ' || echo "cleanup failed on ${node} (continuing)"
          done

      - name: "Continue functional chain (next: Pool expansion)"
        # Only chain-triggered runs forward to the next suite; standalone
        # workflow_dispatch runs stop after their own cleanup.
        if: ${{ always() && github.event_name == 'repository_dispatch' }}
        continue-on-error: true
        env:
          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
        run: |
          set -euo pipefail
          if [ -z "${GH_TOKEN:-}" ]; then
            echo "PF_TESTING_GH_TOKEN is not configured; cannot dispatch the next suite" >&2
            exit 1
          fi
          echo "Dispatching next functional suite: Pool expansion"
          gh api --method POST repos/rustfs/rustfs/dispatches \
            -f event_type='rustfs-chain-pool-expand' \
            -F 'client_payload[from_suite]=table'

      - name: Notify on failure
        if: failure()
        run: echo "RustFS table test workflow failed (harness/environment breakdown); see logs and report artifact."