name: Linux control and agent

on:
  push:
    branches: ['**']
  pull_request:

permissions:
  contents: read

jobs:
  build-and-test:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Set up .NET 10
        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1  # v5.4.0
        with:
          dotnet-version: 10.0.x

      - name: Restore
        run: dotnet restore ServerMonitorManager.slnx --locked-mode

      - name: Build
        run: dotnet build ServerMonitorManager.slnx --configuration Release --no-restore

      - name: Test
        run: dotnet test tests/ServerMonitorManager.Control.Tests/ServerMonitorManager.Control.Tests.csproj --configuration Release --no-build

      - name: Verify formatting
        run: |
          dotnet format whitespace ServerMonitorManager.slnx --verify-no-changes --no-restore
          dotnet format style ServerMonitorManager.slnx --verify-no-changes --no-restore

      - name: Verify three-server acceptance harness
        run: |
          bash -n tests/acceptance/three-server-mesh.sh
          shellcheck --severity=error tests/acceptance/three-server-mesh.sh

      - name: Verify standalone bootstrap
        run: |
          bash -n deploy/ochenstarik-server-monitor-manager.sh
          bash -n deploy/ochenstarik-smm-policy-apply
          bash -n deploy/ochenstarik-smm-emergency
          bash -n tests/bootstrap/run-native-systemd-smoke.sh
          bash -n tests/bootstrap/run-systemd-container-smoke.sh
          bash -n tests/bootstrap/test-enrollment-token-argv.sh
          shellcheck --severity=error deploy/ochenstarik-server-monitor-manager.sh
          shellcheck --severity=error deploy/ochenstarik-smm-policy-apply
          shellcheck --severity=error deploy/ochenstarik-smm-emergency
          shellcheck --severity=error tests/bootstrap/run-native-systemd-smoke.sh
          shellcheck --severity=error tests/bootstrap/run-systemd-container-smoke.sh
          shellcheck --severity=error tests/bootstrap/test-enrollment-token-argv.sh
          bash tests/bootstrap/test-bootstrap-contract.sh
          bash tests/bootstrap/test-enrollment-token-argv.sh

      - name: Publish agent amd64
        run: dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj --configuration Release --runtime linux-x64 --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true

      - name: Publish agent arm64
        run: dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj --configuration Release --runtime linux-arm64 --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true

      - name: Publish provisioning helper amd64
        run: dotnet publish src/ServerMonitorManager.Provisioning.Helper/ServerMonitorManager.Provisioning.Helper.csproj --configuration Release --runtime linux-x64 --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true

      - name: Publish provisioning helper arm64
        run: dotnet publish src/ServerMonitorManager.Provisioning.Helper/ServerMonitorManager.Provisioning.Helper.csproj --configuration Release --runtime linux-arm64 --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true

      - name: Build systemd smoke release
        run: |
          dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj \
            --configuration Release --runtime linux-x64 --self-contained true \
            -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true -o smoke/agent
          dotnet publish src/ServerMonitorManager.Control/ServerMonitorManager.Control.csproj \
            --configuration Release --runtime linux-x64 --self-contained true \
            -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true -o smoke/control
          dotnet publish src/ServerMonitorManager.Provisioning.Helper/ServerMonitorManager.Provisioning.Helper.csproj \
            --configuration Release --runtime linux-x64 --self-contained true \
            -p:PublishSingleFile=true -p:PublishTrimmed=true -p:RestoreLockedMode=true -o smoke/provisioning-helper
          install -d smoke/deploy smoke/bootstrap
          install -m 0644 deploy/ochenstarik-smm-control.service smoke/deploy/
          install -m 0644 deploy/ochenstarik-smm-agent.service smoke/deploy/
          install -m 0644 deploy/ochenstarik-smm-provisioning-helper.service smoke/deploy/
          install -m 0644 deploy/ochenstarik-smm-firewall.service smoke/deploy/
          install -m 0755 deploy/ochenstarik-smm-policy-apply smoke/deploy/
          install -m 0755 deploy/ochenstarik-smm-emergency smoke/deploy/
          install -m 0755 deploy/ochenstarik-server-monitor-manager.sh smoke/bootstrap/
          tar -C smoke -czf smoke-release.tar.gz agent control provisioning-helper deploy bootstrap
          sha256sum smoke-release.tar.gz > smoke-release.tar.gz.sha256

      - name: Verify repeated systemd installation
        run: |
          set -Eeuo pipefail
          smoke_log=/tmp/smm-systemd-smoke.log
          report_failure() {
            local title="$1" message main_pid
            sudo systemctl status --no-pager ochenstarik-smm-control.service >>"$smoke_log" 2>&1 || true
            sudo journalctl --no-pager -u ochenstarik-smm-control.service -n 40 >>"$smoke_log" 2>&1 || true
            sudo ss -ltnp >>"$smoke_log" 2>&1 || true
            main_pid="$(sudo systemctl show -p MainPID --value ochenstarik-smm-control.service 2>/dev/null || true)"
            if [[ "$main_pid" =~ ^[1-9][0-9]*$ ]]; then
              sudo sh -c "tr '\0' '\n' </proc/$main_pid/environ | grep '^ASPNETCORE_'" \
                >>"$smoke_log" 2>&1 || true
              sudo sh -c "printf 'wchan='; cat /proc/$main_pid/wchan" >>"$smoke_log" 2>&1 || true
            fi
            message="$(tail -c 6000 "$smoke_log" | sed ':a;N;$!ba;s/%/%25/g;s/\r/%0D/g;s/\n/%0A/g')"
            printf '::error title=%s::%s\n' "$title" "$message"
            exit 1
          }
          sudo deploy/ochenstarik-server-monitor-manager.sh install-control \
            smoke-release.tar.gz 127.0.0.1 7443 >"$smoke_log" 2>&1 \
            || report_failure 'Initial Control installation failed'
          sudo test -x /usr/local/sbin/ochenstarik-smm-emergency \
            || report_failure 'Emergency recovery command was not installed'
          sudo /usr/local/sbin/ochenstarik-smm-emergency status >>"$smoke_log" 2>&1 \
            || report_failure 'Emergency recovery status failed'
          for _ in {1..30}; do
            sudo curl --fail --silent --cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \
              https://127.0.0.1:7443/healthz && break
            sleep 1
          done
          sudo curl --fail --silent --show-error \
            --cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \
            https://127.0.0.1:7443/healthz >>"$smoke_log" 2>&1 \
            || report_failure 'Initial Control healthcheck failed'
          sudo deploy/ochenstarik-server-monitor-manager.sh install-control \
            smoke-release.tar.gz 127.0.0.1 7443 >"$smoke_log" 2>&1 \
            || report_failure 'Repeated Control installation failed'
          sudo systemctl restart ochenstarik-smm-control.service \
            || report_failure 'Control restart failed'
          sudo systemctl is-active --quiet ochenstarik-smm-control.service \
            || report_failure 'Control is inactive after restart'
          sudo curl --fail --silent --show-error \
            --retry 10 --retry-all-errors --retry-delay 1 \
            --cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \
            https://127.0.0.1:7443/healthz >>"$smoke_log" 2>&1 \
            || report_failure 'Repeated Control healthcheck failed'

      - name: Clean up systemd smoke installation
        if: always()
        run: sudo deploy/ochenstarik-server-monitor-manager.sh uninstall-control --confirm-destroy-control || true