name: Linux control and agent

on:
  push:
    branches: ['**']
  pull_request:

permissions:
  contents: read

jobs:
  build-and-test:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up .NET 10
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x

      - name: Restore
        run: dotnet restore ServerMonitorManager.slnx

      - name: Build
        run: dotnet build ServerMonitorManager.slnx --configuration Release --no-restore

      - name: Test
        run: dotnet test tests/ServerMonitorManager.Control.Tests/ServerMonitorManager.Control.Tests.csproj --configuration Release --no-build

      - name: Verify formatting
        run: dotnet format ServerMonitorManager.slnx --verify-no-changes --no-restore

      - name: Verify three-server acceptance harness
        run: |
          bash -n tests/acceptance/three-server-mesh.sh
          shellcheck --severity=error tests/acceptance/three-server-mesh.sh

      - name: Verify standalone bootstrap
        run: |
          bash -n deploy/ochenstarik-server-monitor-manager.sh
          bash -n deploy/ochenstarik-smm-policy-apply
          shellcheck --severity=error deploy/ochenstarik-server-monitor-manager.sh
          shellcheck --severity=error deploy/ochenstarik-smm-policy-apply
          bash tests/bootstrap/test-bootstrap-contract.sh

      - name: Publish agent amd64
        run: dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj --configuration Release --runtime linux-x64 --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true

      - name: Publish agent arm64
        run: dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj --configuration Release --runtime linux-arm64 --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true

      - name: Build systemd smoke release
        run: |
          dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj \
            --configuration Release --runtime linux-x64 --self-contained true \
            -p:PublishSingleFile=true -p:PublishTrimmed=true -o smoke/agent
          dotnet publish src/ServerMonitorManager.Control/ServerMonitorManager.Control.csproj \
            --configuration Release --runtime linux-x64 --self-contained true \
            -p:PublishSingleFile=true -p:PublishTrimmed=true -o smoke/control
          install -d smoke/deploy smoke/bootstrap
          install -m 0644 deploy/ochenstarik-smm-control.service smoke/deploy/
          install -m 0644 deploy/ochenstarik-smm-agent.service smoke/deploy/
          install -m 0644 deploy/ochenstarik-smm-firewall.service smoke/deploy/
          install -m 0755 deploy/ochenstarik-smm-policy-apply smoke/deploy/
          install -m 0755 deploy/ochenstarik-server-monitor-manager.sh smoke/bootstrap/
          tar -C smoke -czf smoke-release.tar.gz agent control deploy bootstrap
          sha256sum smoke-release.tar.gz > smoke-release.tar.gz.sha256

      - name: Verify repeated systemd installation
        run: |
          set -Eeuo pipefail
          smoke_log=/tmp/smm-systemd-smoke.log
          report_failure() {
            local title="$1" message
            sudo systemctl status --no-pager ochenstarik-smm-control.service >>"$smoke_log" 2>&1 || true
            sudo journalctl --no-pager -u ochenstarik-smm-control.service -n 40 >>"$smoke_log" 2>&1 || true
            message="$(tail -c 6000 "$smoke_log" | sed ':a;N;$!ba;s/%/%25/g;s/\r/%0D/g;s/\n/%0A/g')"
            printf '::error title=%s::%s\n' "$title" "$message"
            exit 1
          }
          sudo deploy/ochenstarik-server-monitor-manager.sh install-control \
            smoke-release.tar.gz 127.0.0.1 7443 >"$smoke_log" 2>&1 \
            || report_failure 'Initial Control installation failed'
          for _ in {1..30}; do
            curl --fail --silent --cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \
              https://127.0.0.1:7443/healthz && break
            sleep 1
          done
          curl --fail --silent --show-error \
            --cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \
            https://127.0.0.1:7443/healthz \
            || report_failure 'Initial Control healthcheck failed'
          sudo deploy/ochenstarik-server-monitor-manager.sh install-control \
            smoke-release.tar.gz 127.0.0.1 7443 >"$smoke_log" 2>&1 \
            || report_failure 'Repeated Control installation failed'
          sudo systemctl restart ochenstarik-smm-control.service \
            || report_failure 'Control restart failed'
          sudo systemctl is-active --quiet ochenstarik-smm-control.service \
            || report_failure 'Control is inactive after restart'
          curl --fail --silent --show-error \
            --retry 10 --retry-all-errors --retry-delay 1 \
            --cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \
            https://127.0.0.1:7443/healthz \
            || report_failure 'Repeated Control healthcheck failed'

      - name: Clean up systemd smoke installation
        if: always()
        run: sudo deploy/ochenstarik-server-monitor-manager.sh uninstall-control --confirm-destroy-control || true