name: Linux control and agent

on:
  push:
    branches: ['**']
  pull_request:

permissions:
  contents: read

jobs:
  build-and-test:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up .NET 10
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x

      - name: Restore
        run: dotnet restore ServerMonitorManager.slnx

      - name: Build
        run: dotnet build ServerMonitorManager.slnx --configuration Release --no-restore

      - name: Test
        run: dotnet test tests/ServerMonitorManager.Control.Tests/ServerMonitorManager.Control.Tests.csproj --configuration Release --no-build

      - name: Verify formatting
        run: dotnet format ServerMonitorManager.slnx --verify-no-changes --no-restore

      - name: Verify three-server acceptance harness
        run: |
          bash -n tests/acceptance/three-server-mesh.sh
          shellcheck --severity=error tests/acceptance/three-server-mesh.sh

      - name: Verify standalone bootstrap
        run: |
          bash -n deploy/ochenstarik-server-monitor-manager.sh
          bash -n deploy/ochenstarik-smm-policy-apply
          shellcheck --severity=error deploy/ochenstarik-server-monitor-manager.sh
          shellcheck --severity=error deploy/ochenstarik-smm-policy-apply
          bash tests/bootstrap/test-bootstrap-contract.sh

      - name: Publish agent amd64
        run: dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj --configuration Release --runtime linux-x64 --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true

      - name: Publish agent arm64
        run: dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj --configuration Release --runtime linux-arm64 --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true

      - name: Build systemd smoke release
        run: |
          dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj \
            --configuration Release --runtime linux-x64 --self-contained true \
            -p:PublishSingleFile=true -p:PublishTrimmed=true -o smoke/agent
          dotnet publish src/ServerMonitorManager.Control/ServerMonitorManager.Control.csproj \
            --configuration Release --runtime linux-x64 --self-contained true \
            -p:PublishSingleFile=true -p:PublishTrimmed=true -o smoke/control
          install -d smoke/deploy smoke/bootstrap
          install -m 0644 deploy/ochenstarik-smm-control.service smoke/deploy/
          install -m 0644 deploy/ochenstarik-smm-agent.service smoke/deploy/
          install -m 0644 deploy/ochenstarik-smm-firewall.service smoke/deploy/
          install -m 0755 deploy/ochenstarik-smm-policy-apply smoke/deploy/
          install -m 0755 deploy/ochenstarik-server-monitor-manager.sh smoke/bootstrap/
          tar -C smoke -czf smoke-release.tar.gz agent control deploy bootstrap
          sha256sum smoke-release.tar.gz > smoke-release.tar.gz.sha256

      - name: Verify repeated systemd installation
        run: |
          set -Eeuo pipefail
          sudo deploy/ochenstarik-server-monitor-manager.sh install-control \
            smoke-release.tar.gz 127.0.0.1 7443
          for _ in {1..30}; do
            curl --fail --silent --cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \
              https://127.0.0.1:7443/healthz && break
            sleep 1
          done
          curl --fail --silent --show-error \
            --cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \
            https://127.0.0.1:7443/healthz
          sudo deploy/ochenstarik-server-monitor-manager.sh install-control \
            smoke-release.tar.gz 127.0.0.1 7443
          sudo systemctl restart ochenstarik-smm-control.service
          sudo systemctl is-active --quiet ochenstarik-smm-control.service
          curl --fail --silent --show-error \
            --retry 10 --retry-all-errors --retry-delay 1 \
            --cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \
            https://127.0.0.1:7443/healthz

      - name: Clean up systemd smoke installation
        if: always()
        run: sudo deploy/ochenstarik-server-monitor-manager.sh uninstall-control --confirm-destroy-control || true