name: Test backoffice (smb-crm)

# Automatic, unlike deploy-backoffice.yml: this workflow never touches the
# live host, only spins up a throwaway postgres:16-alpine container via the
# test suite itself (see backoffice/app/tests/conftest.py), so it's safe to
# run on every push/PR. Scoped to the paths that can actually affect these
# tests so unrelated changes elsewhere (n8n/, deploy/, docs/, etc.) don't
# trigger a run.
on:
  push:
    paths:
      - "backoffice/app/**"
      - "backoffice/db/**"
  pull_request:
    paths:
      - "backoffice/app/**"
      - "backoffice/db/**"

jobs:
  test:
    runs-on: [self-hosted, homelab]
    steps:
      # Plain git + fetch-by-sha instead of actions/checkout@v4 (Node.js
      # based; this runner deliberately has no Node toolchain) and instead
      # of deploy-backoffice.yml's branch-name clone (that workflow is
      # workflow_dispatch-only with a branch/tag input; push/pull_request
      # give us a commit SHA via github.sha, which needs a fetch-by-SHA, not
      # a branch checkout, to be exact for PRs).
      - name: Checkout
        env:
          DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
          GIT_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          find . -mindepth 1 -delete
          git init -q
          git remote add origin "http://${DEPLOY_TOKEN}@172.24.0.2:3000/BPPP/smb-online.git"
          git fetch --depth 1 origin "$GIT_SHA"
          git checkout -q FETCH_HEAD
          git remote set-url origin http://172.24.0.2:3000/BPPP/smb-online.git

      # This runner is bare-metal (no guaranteed python3.12 binary), but it
      # already has docker access (see deploy-backoffice.yml), so the venv is
      # built inside a python:3.12-slim container — the same base image
      # backoffice/app/Dockerfile ships on, so "3.12 venv" here means exactly
      # what runs in production, with zero assumptions about the host's own
      # Python. --network host is required: tests/conftest.py itself runs
      # `docker run -p 127.0.0.1:<port>:5432 postgres:16-alpine` as a sibling
      # container (via the mounted docker socket), and the test process must
      # see that published port on the same network namespace it lands in.
      - name: Install deps and run backoffice test suite (python:3.12-slim)
        run: |
          set -euo pipefail
          docker run --rm --network host \
            -v "$PWD":/repo \
            -v /var/run/docker.sock:/var/run/docker.sock \
            -w /repo \
            -e HOME=/tmp \
            python:3.12-slim bash -euxc '
              apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq docker.io >/dev/null
              python3 -m venv .venv
              .venv/bin/pip install -q --upgrade pip
              .venv/bin/pip install -q -r backoffice/app/requirements-dev.txt
              .venv/bin/python -m pytest backoffice/app/tests -q
            '