# .github/workflows/ci.yml — slice-1 CI (spec §6.2).
# Gates: fmt --check, clippy -D warnings, test --all, cargo deny check.
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  # Manual trigger for the twilio-live job (pre-release validation against
  # real Twilio credentials). Never runs per-PR — the routine clippy/test
  # jobs use default features (MockCallControlClient); the live
  # TwilioCallControlClient is feature-gated behind `twilio-live` + only the
  # maintainer exercises it before tagging a release (spec §1.2 + plan T6/T10).
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always

jobs:
  fmt:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - run: cargo fmt --check

  clippy:
    runs-on: ubuntu-latest
    services:
      valkey:
        image: valkey/valkey:latest
        ports:
          - 6379:6379
        options: >-
          --health-cmd "valkey-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 3
    env:
      VALKEY_URL: redis://127.0.0.1:6379/
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - name: Install libopus (media crate FFI dep)
        run: apt-get update && apt-get install -y libopus-dev
      - uses: Swatinem/rust-cache@v2
      - run: cargo clippy --all -- -D warnings

  test:
    runs-on: ubuntu-latest
    services:
      valkey:
        image: valkey/valkey:latest
        ports:
          - 6379:6379
        options: >-
          --health-cmd "valkey-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 3
    strategy:
      matrix:
        toolchain: [stable, "1.85"]
    env:
      VALKEY_URL: redis://127.0.0.1:6379/
    steps:
      - uses: actions/checkout@v4

      # Seam gate (slice-4 §7 #3; re-pinned slice-5):
      #
      # `loop_driver.rs` stays byte-identical to slice-3 — the hot-path
      # poll loop is untouched. `rtc_session.rs` was re-pinned in slice-5
      # for MediaAddressConfig (2026-07-04 scalability review, B1:
      # bind/advertised address split + port range). If a legitimate
      # change is needed, update the pinned blob hashes below in the same
      # PR — loud and reviewable by design.
      - name: Seam gate — loop_driver frozen (slice-3) + rtc_session pinned (slice-5)
        run: |
          EXPECTED_LOOP_DRIVER='744bf314edf7f4925c8bb3bd0f5176dbc88f8113'
          EXPECTED_RTC_SESSION='f47d63b9a2883d37066a93c9daa0e2cf8816bec4'
          GOT_LOOP_DRIVER=$(git hash-object crates/rutster-media/src/loop_driver.rs)
          GOT_RTC_SESSION=$(git hash-object crates/rutster-media/src/rtc_session.rs)
          if [ "$GOT_LOOP_DRIVER" != "$EXPECTED_LOOP_DRIVER" ]; then
            echo "::error::loop_driver.rs blob mismatch: $GOT_LOOP_DRIVER != $EXPECTED_LOOP_DRIVER"
            exit 1
          fi
          if [ "$GOT_RTC_SESSION" != "$EXPECTED_RTC_SESSION" ]; then
            echo "::error::rtc_session.rs blob mismatch: $GOT_RTC_SESSION != $EXPECTED_RTC_SESSION"
            exit 1
          fi

      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.toolchain }}
      - name: Install libopus (media crate FFI dep)
        run: apt-get update && apt-get install -y libopus-dev
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --all

  deny:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check

  # slice-4½ (ADR-0010): the CI-regressed threshold sweep. Default-off
  # `sim-bench` feature; runs `cargo test --all --features=sim-bench`
  # in a SEPARATE job per PR + nightly. A latency regression fails the
  # build the same way a broken test does. `--test-threads=1` is
  # load-bearing: concurrent sim-bench tests would contaminate each
  # other's shared gauge (the TickLagStats reads the SHARED tokio
  # runtime; concurrent sweeps across tests would all pollute the same
  # gauge). See crates/rutster-sim/src/thresholds.rs's
  # `bench_assertions` module docs + spec §5.4 + §6.5.
  sim-bench:
    name: sim-bench (stable)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - name: Install libopus (media crate FFI dep)
        run: apt-get update && apt-get install -y libopus-dev
      - uses: Swatinem/rust-cache@v2
      - name: cargo fmt + clippy on sim-bench feature paths
        run: |
          cargo fmt --all --check
          cargo clippy --all --all-targets --features=sim-bench -- -D warnings
      - name: Run sim-bench threshold sweep
        run: cargo test --all --features=sim-bench -- --test-threads=1

  # The live TwilioCallControlClient is feature-gated behind `twilio-live`
  # (reqwest + rustls-tls + tracing + serde_json pulled in only when the
  # feature is on). This job exercises it against REAL Twilio credentials.
  # It runs ONLY on manual `workflow_dispatch` (never per-PR) — the routine
  # clippy/test jobs above use default features (MockCallControlClient).
  # The maintainer triggers this before tagging a release, after setting the
  # TWILIO_* secrets in the repo settings (spec §1.2 + plan T10 Step 3).
  twilio-live:
    name: twilio-live (manual only)
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch'
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - name: Install libopus (media crate FFI dep)
        run: apt-get update && apt-get install -y libopus-dev
      - uses: Swatinem/rust-cache@v2
      - name: Clippy with twilio-live feature
        run: cargo clippy --all --all-targets --features=twilio-live -- -D warnings
      - name: Twilio-live tests (includes ignored live e2e; needs TWILIO_* secrets)
        env:
          RUTSTER_TWILIO_ACCOUNT_SID: ${{ secrets.TWILIO_ACCOUNT_SID }}
          RUTSTER_TWILIO_AUTH_TOKEN: ${{ secrets.TWILIO_AUTH_TOKEN }}
          RUTSTER_TWILIO_MEDIA_BIND: 0.0.0.0:8081
          RUTSTER_TWILIO_WEBHOOK_BASE: ${{ secrets.TWILIO_WEBHOOK_BASE }}
          RUTSTER_TWILIO_TEST_TO: ${{ secrets.TWILIO_TEST_TO }}
          RUTSTER_TWILIO_TEST_FROM: ${{ secrets.TWILIO_TEST_FROM }}
        run: cargo test --all --features=twilio-live -- --include-ignored

  # deploy-B §6.1 image-build — builds all four first-party images via
  # `docker buildx build --target` against deploy/Dockerfile. Runs AFTER the
  # fmt/clippy/test/deny/sim-bench matrix gates: the smoke job downstream
  # depends on these built images.
  #
  # Single builder invocation that builds all four --targets would be ideal
  # (shared cache), but buildx's `--target` is one-per-invocation — so four
  # build steps share the GHA cache via `cache-from/cache-to: type=gha`.
  # Warm caches take image-build from ~6 min to ~90s.
  image-build:
    name: image-build (4 images)
    runs-on: ubuntu-latest
    needs: [fmt, clippy, test, deny, sim-bench]
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # libopus-dev — the headers the `opus` crate's build.rs expects.
      # (The builder stage of deploy/Dockerfile already installs this
      # inside the build image; this is a belt-and-braces step so a local
      # buildx cache root has the headers if the cache misses.)
      - name: Build-time host deps (belt-and-braces)
        run: sudo apt-get update && sudo apt-get install -y libopus-dev

      - name: Build rutster-engine image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: deploy/Dockerfile
          target: rutster-engine
          tags: rutster-engine:ci-${{ github.sha }}
          push: false
          load: true
          cache-from: type=gha,scope=rutster-engine
          cache-to: type=gha,mode=max,scope=rutster-engine

      - name: Build rutster-brain image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: deploy/Dockerfile
          target: rutster-brain
          tags: rutster-brain:ci-${{ github.sha }}
          push: false
          load: true
          cache-from: type=gha,scope=rutster-brain
          cache-to: type=gha,mode=max,scope=rutster-brain

      - name: Build rutster-edge image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: deploy/Dockerfile
          target: rutster-edge
          tags: rutster-edge:ci-${{ github.sha }}
          push: false
          load: true
          cache-from: type=gha,scope=rutster-edge
          cache-to: type=gha,mode=max,scope=rutster-edge

      - name: Build rutster-allinone image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: deploy/Dockerfile
          target: rutster-allinone
          tags: rutster-allinone:ci-${{ github.sha }}
          push: false
          load: true
          cache-from: type=gha,scope=rutster-allinone
          cache-to: type=gha,mode=max,scope=rutster-allinone

      - name: Smoke-tag the images for the downstream smoke job
        # The smoke job references images as `:smoke`
        # (deploy/smoke/compose_smoke.sh tags images with the
        # RUTSTER_IMAGES_TAG env). Tag the freshly-built :ci-<sha> images as
        # :smoke too, so the smoke job picks them up.
        run: |
          for img in rutster-engine rutster-brain rutster-edge rutster-allinone; do
            docker tag "${img}:ci-${{ github.sha }}" "${img}:smoke"
          done
          docker images | grep rutster

      - name: caddy validate
        # Validate the Caddyfile inside the freshly-built rutster-edge image.
        # Cheap regression against malformed Caddyfile (the local `caddy
        # validate` in Task 3 is optional; this one is mandatory in CI).
        run: |
          docker run --rm \
            -e RUTSTER_DOMAIN=pbx.example.com \
            -e RUTSTER_ACME_EMAIL=test@example.com \
            -v "$PWD/deploy/Caddyfile:/etc/caddy/Caddyfile:ro" \
            rutster-edge:smoke \
            caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile

  # deploy-B §9 all-in-one smoke — boots rutster-allinone with
  # RUTSTER_LOCAL_CERTS=true (Caddy internal CA, no ACME in CI), extracts
  # the CA root cert from /data, opens wss:// to /twilio/media-stream,
  # sends Twilio's connected+start handshake frames, streams 200 PCM-zeroed
  # frames at 20ms cadence, asserts the engine replies with at least one
  # text frame through the real edge->FOB WS path. Spec §9 acceptance:
  #   * "boots"
  #   * "Caddy terminates TLS via its internal CA (no ACME in CI)"
  #   * "full sim call through the real edge->FOB WS path"
  # The reload-during-call smoke (Task 9 below) and compose smoke (Task 9)
  # are separate jobs that depend on this one.
  smoke:
    name: smoke (all-in-one TLS sim call)
    runs-on: ubuntu-latest
    needs: [image-build]
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python (stdlib-only; no pip)
        uses: actions/setup-python@v5
        with:
          python-version: "3.x"

      # Pull the freshly-built image from the image-build job. Since
      # jobs run on separate runners + `push: false` in image-build means
      # the image isn't in any registry, the smoke job rebuilds from the
      # GHA cache (warm — image-build populated it). This adds ~30s vs
      # an image-download artifact, but avoids the registry-auth + image-
      # save/load plumbing.
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Rebuild rutster-allinone:smoke (warm cache from image-build)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: deploy/Dockerfile
          target: rutster-allinone
          tags: rutster-allinone:smoke
          push: false
          load: true
          cache-from: type=gha,scope=rutster-allinone

      - name: Run all-in-one smoke (deploy/smoke/allinone_smoke.py)
        run: |
          python3 deploy/smoke/allinone_smoke.py
        env:
          RUTSTER_ALLINONE_IMAGE: rutster-allinone:smoke
          RUTSTER_ALLINONE_PORT: "18443"

  # deploy-B §9 compose smoke — T2 four-service compose stack boots + all
  # services healthy + Caddy TLS /healthz + /readyz. Lighter than the
  # all-in-one smoke (which already proved the WS path) — its job is the
  # orchestrator shape + the network_mode: "service:engine" brain->engine tap
  # posture across the four services.
  smoke-compose:
    name: smoke (T2 compose four-service)
    runs-on: ubuntu-latest
    needs: [image-build]
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # Rebuild all three first-party images from the warm GHA cache
      # populated by image-build. Valkey is upstream (no rebuild needed).
      - name: Rebuild rutster-edge:smoke
        uses: docker/build-push-action@v5
        with:
          context: .
          file: deploy/Dockerfile
          target: rutster-edge
          tags: rutster-edge:smoke
          push: false
          load: true
          cache-from: type=gha,scope=rutster-edge

      - name: Rebuild rutster-engine:smoke
        uses: docker/build-push-action@v5
        with:
          context: .
          file: deploy/Dockerfile
          target: rutster-engine
          tags: rutster-engine:smoke
          push: false
          load: true
          cache-from: type=gha,scope=rutster-engine

      - name: Rebuild rutster-brain:smoke
        uses: docker/build-push-action@v5
        with:
          context: .
          file: deploy/Dockerfile
          target: rutster-brain
          tags: rutster-brain:smoke
          push: false
          load: true
          cache-from: type=gha,scope=rutster-brain

      # jq is pre-installed on ubuntu-latest GHA runners.
      - name: Run compose smoke (deploy/smoke/compose_smoke.sh)
        run: bash deploy/smoke/compose_smoke.sh
        env:
          RUTSTER_IMAGES_TAG: smoke

  # deploy-B §9 + spec §3.2 + TLS brief §5 risk 1: Caddy config-reload
  # during a live simulated call, asserting zero frame drops. The
  # stream_close_delay 24h mitigation in deploy/Caddyfile is the load-
  # bearing fixture; caddy #6420 / #7222 are open upstream bugs — the
  # smoke is "don't trust untested" made CI-regressed.
  smoke-reload:
    name: smoke (caddy reload during live call, zero drops)
    runs-on: ubuntu-latest
    needs: [smoke]   # reuses the rutster-allinone:smoke image, warm cache
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python (stdlib-only; no pip)
        uses: actions/setup-python@v5
        with:
          python-version: "3.x"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Rebuild rutster-allinone:smoke (warm cache)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: deploy/Dockerfile
          target: rutster-allinone
          tags: rutster-allinone:smoke
          push: false
          load: true
          cache-from: type=gha,scope=rutster-allinone

      - name: Run reload-during-call smoke (deploy/smoke/reload_during_call.py)
        run: python3 deploy/smoke/reload_during_call.py
        env:
          RUTSTER_ALLINONE_IMAGE: rutster-allinone:smoke
          RUTSTER_ALLINONE_PORT: "18444"