name: Linux control and agent

on:
  push:
    branches: ['**']
  pull_request:

permissions:
  contents: read

jobs:
  build-and-test:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Set up .NET 10
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68  # v6.0.0
        with:
          dotnet-version: 10.0.x

      - name: Restore
        run: dotnet restore ServerMonitorManager.slnx --locked-mode

      - name: Build
        run: dotnet build ServerMonitorManager.slnx --configuration Release --no-restore

      - name: Test
        run: dotnet test tests/ServerMonitorManager.Control.Tests/ServerMonitorManager.Control.Tests.csproj --configuration Release --no-build

      - name: Verify formatting
        run: |
          dotnet format whitespace ServerMonitorManager.slnx --verify-no-changes --no-restore
          dotnet format style ServerMonitorManager.slnx --verify-no-changes --no-restore

      - name: Verify three-server acceptance harness
        run: |
          bash -n tests/acceptance/three-server-mesh.sh
          shellcheck --severity=error tests/acceptance/three-server-mesh.sh

      - name: Verify Monitor snapshot contract
        run: |
          bash -n tests/acceptance/test_monitor_snapshot.sh
          bash -n tests/acceptance/test_previous_schema_contract.sh
          bash -n tests/acceptance/test_previous_schema_arm64.sh
          shellcheck --severity=error tests/acceptance/test_monitor_snapshot.sh
          shellcheck --severity=error tests/acceptance/test_previous_schema_contract.sh
          shellcheck --severity=error tests/acceptance/test_previous_schema_arm64.sh
          bash tests/acceptance/test_monitor_snapshot.sh
          bash tests/acceptance/test_previous_schema_contract.sh

      - name: Verify standalone bootstrap
        run: |
          bash -n deploy/ochenstarik-server-monitor-manager.sh
          bash -n deploy/ochenstarik-smm-policy-apply
          bash -n deploy/ochenstarik-smm-emergency
          bash -n tests/bootstrap/run-native-systemd-smoke.sh
          bash -n tests/bootstrap/run-systemd-container-smoke.sh
          bash -n tests/bootstrap/test-enrollment-token-argv.sh
          bash -n tests/bootstrap/test-release-contract.sh
          shellcheck --severity=error deploy/ochenstarik-server-monitor-manager.sh
          shellcheck --severity=error deploy/ochenstarik-smm-policy-apply
          shellcheck --severity=error deploy/ochenstarik-smm-emergency
          shellcheck --severity=error tests/bootstrap/run-native-systemd-smoke.sh
          shellcheck --severity=error tests/bootstrap/run-systemd-container-smoke.sh
          shellcheck --severity=error tests/bootstrap/test-enrollment-token-argv.sh
          shellcheck --severity=error tests/bootstrap/test-release-contract.sh
          bash tests/bootstrap/test-bootstrap-contract.sh
          bash tests/bootstrap/test-enrollment-token-argv.sh
          bash tests/bootstrap/test-release-contract.sh

      - name: Publish agent amd64
        run: dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj --configuration Release --runtime linux-x64 --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true

      - name: Publish agent arm64
        run: dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj --configuration Release --runtime linux-arm64 --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true

      - name: Publish control arm64 compatibility binary
        run: dotnet publish src/ServerMonitorManager.Control/ServerMonitorManager.Control.csproj --configuration Release --runtime linux-arm64 --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true -o compatibility/control-linux-arm64

      - name: Set up arm64 emulation
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0
        with:
          platforms: arm64

      - name: Verify previous schema with arm64 published Control
        run: |
          docker run --rm --platform linux/arm64 \
            --volume "$PWD:/workspace" --workdir /workspace \
            ubuntu:24.04 \
            bash tests/acceptance/test_previous_schema_arm64.sh \
              compatibility/control-linux-arm64/ochenstarik-smm-control

      - name: Publish provisioning helper amd64
        run: dotnet publish src/ServerMonitorManager.Provisioning.Helper/ServerMonitorManager.Provisioning.Helper.csproj --configuration Release --runtime linux-x64 --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true

      - name: Publish provisioning helper arm64
        run: dotnet publish src/ServerMonitorManager.Provisioning.Helper/ServerMonitorManager.Provisioning.Helper.csproj --configuration Release --runtime linux-arm64 --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true

      - name: Build systemd smoke release
        run: |
          dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj \
            --configuration Release --runtime linux-x64 --self-contained true \
            -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true -o smoke/agent
          dotnet publish src/ServerMonitorManager.Control/ServerMonitorManager.Control.csproj \
            --configuration Release --runtime linux-x64 --self-contained true \
            -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true -o smoke/control
          dotnet publish src/ServerMonitorManager.Provisioning.Helper/ServerMonitorManager.Provisioning.Helper.csproj \
            --configuration Release --runtime linux-x64 --self-contained true \
            -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true -o smoke/provisioning-helper
          install -d smoke/deploy smoke/bootstrap
          install -m 0644 deploy/ochenstarik-smm-control.service smoke/deploy/
          install -m 0644 deploy/ochenstarik-smm-agent.service smoke/deploy/
          install -m 0644 deploy/ochenstarik-smm-provisioning-helper.service smoke/deploy/
          install -m 0644 deploy/ochenstarik-smm-firewall.service smoke/deploy/
          install -m 0755 deploy/ochenstarik-smm-policy-apply smoke/deploy/
          install -m 0755 deploy/ochenstarik-smm-emergency smoke/deploy/
          install -m 0755 deploy/ochenstarik-server-monitor-manager.sh smoke/bootstrap/
          tar -C smoke -czf smoke-release.tar.gz agent control provisioning-helper deploy bootstrap
          sha256sum smoke-release.tar.gz > smoke-release.tar.gz.sha256

      - name: Verify complete published enrollment with systemd
        run: bash tests/bootstrap/run-native-systemd-smoke.sh smoke-release.tar.gz deploy/ochenstarik-server-monitor-manager.sh

      - name: Clean up systemd smoke installation
        if: always()
        run: |
          sudo /usr/local/sbin/ochenstarik-server-monitor-manager.sh uninstall-agent --purge || true
          sudo /usr/local/sbin/ochenstarik-server-monitor-manager.sh uninstall-control --confirm-destroy-control || true
