name: erp-kit Test Workspace App

# Reusable workflow: deploy one app's test workspace, then run its integration
# and E2E suites in parallel against it.

on:
  workflow_call:
    inputs:
      app:
        description: "App name under apps/ to deploy and test."
        required: true
        type: string
    # Declared explicitly so the caller passes only what is needed.
    secrets:
      TAILOR_PFMU_CLIENT_ID:
        required: true
      TAILOR_PFMU_CLIENT_SECRET:
        required: true
      TAILOR_PLATFORM_TOKEN:
        required: true

# One run per (PR, app): the jobs share a single workspace, so overlapping runs
# would interfere. Cancel superseded runs.
concurrency:
  group: erp-kit-test-workspace-${{ github.event.pull_request.number || github.ref }}-${{ inputs.app }}
  cancel-in-progress: true

jobs:
  deploy:
    # Builds the frontend and deploys, so it needs a full runner.
    runs-on: ${{ vars.ERP_KIT_BUILD_RUNNER || 'ubuntu-latest' }}
    permissions:
      contents: read
    timeout-minutes: 15
    outputs:
      workspace_id: ${{ steps.ws.outputs.workspace_id }}
      frontend_url: ${{ steps.deploy.outputs.deployed_url }}
      app_url: ${{ steps.deploy.outputs.app_url }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          cache: pnpm
          cache-dependency-path: ./pnpm-lock.yaml
          node-version-file: package.json

      - run: pnpm install

      - name: Fetch Tailor token
        id: token
        uses: ./.github/actions/erp-kit-fetch-tailor-token
        with:
          client_id: ${{ secrets.TAILOR_PFMU_CLIENT_ID }}
          client_secret: ${{ secrets.TAILOR_PFMU_CLIENT_SECRET }}
          token: ${{ secrets.TAILOR_PLATFORM_TOKEN }}

      - name: Resolve workspace
        id: ws
        uses: ./.github/actions/erp-kit-get-or-create-workspace
        with:
          token: ${{ steps.token.outputs.token }}
          app: ${{ inputs.app }}
          workspace_name_prefix: ${{ vars.ERP_KIT_WORKSPACE_PREFIX || github.event.repository.name }}-${{ inputs.app }}-test
          organization_id: ${{ vars.TAILOR_PLATFORM_ORGANIZATION_ID }}
          folder_id: ${{ vars.TAILOR_PLATFORM_FOLDER_ID }}
          region: ${{ vars.ERP_KIT_WORKSPACE_REGION || 'asia-northeast' }}

      - name: Deploy application
        id: deploy
        if: ${{ steps.ws.outputs.workspace_id != '' }}
        uses: ./.github/actions/erp-kit-deploy
        with:
          token: ${{ steps.token.outputs.token }}
          workspace_id: ${{ steps.ws.outputs.workspace_id }}
          app: ${{ inputs.app }}

      - name: Seed data
        if: ${{ steps.ws.outputs.workspace_id != '' }}
        uses: ./.github/actions/erp-kit-seed
        with:
          token: ${{ steps.token.outputs.token }}
          workspace_id: ${{ steps.ws.outputs.workspace_id }}
          app: ${{ inputs.app }}

  e2e:
    needs: deploy
    if: ${{ needs.deploy.outputs.frontend_url != '' }}
    # Playwright runs in a job container, which needs a full VM runner.
    runs-on: ${{ vars.ERP_KIT_BUILD_RUNNER || 'ubuntu-latest' }}
    permissions:
      contents: read
    timeout-minutes: 15
    # Official Playwright image (browsers preinstalled). Bump the tag and digest
    # together when the Playwright version changes.
    container:
      image: mcr.microsoft.com/playwright:v1.62.1-noble@sha256:dcc5531e97840b9b5e794f2814476b21571c5124a3fca2267d73041f56e7580e
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          cache: pnpm
          cache-dependency-path: ./pnpm-lock.yaml
          node-version-file: package.json

      - run: pnpm install

      - name: Install jq
        run: apt-get update && apt-get install -y jq

      - name: Fetch Tailor token
        id: token
        uses: ./.github/actions/erp-kit-fetch-tailor-token
        with:
          client_id: ${{ secrets.TAILOR_PFMU_CLIENT_ID }}
          client_secret: ${{ secrets.TAILOR_PFMU_CLIENT_SECRET }}
          token: ${{ secrets.TAILOR_PLATFORM_TOKEN }}

      - name: Warm up test workspace
        # A freshly deployed workspace is slow on its first requests; warm it up
        # before the tests hit it in parallel.
        shell: bash
        env:
          FRONTEND_URL: ${{ needs.deploy.outputs.frontend_url }}
        run: |
          frontend="$FRONTEND_URL"
          for i in $(seq 1 10); do
            t=$(curl -s -o /dev/null -w '%{time_total}' --max-time 60 "$frontend" || echo 60)
            echo "warmup #$i: ${t}s"
            if awk "BEGIN{exit !($t < 2)}"; then break; fi
            sleep 3
          done

      - name: Run E2E tests
        # playwright.config.ts reads E2E_BASE_URL from the env and sets the
        # worker count and full test-level parallelism itself. E2E_BASE_URL must
        # be set here, not in global setup: the config reads it before global
        # setup runs.
        run: pnpm -C "apps/$APP/frontend" run test:e2e
        env:
          APP: ${{ inputs.app }}
          TAILOR_PLATFORM_TOKEN: ${{ steps.token.outputs.token }}
          TAILOR_PLATFORM_WORKSPACE_ID: ${{ needs.deploy.outputs.workspace_id }}
          E2E_BASE_URL: ${{ needs.deploy.outputs.frontend_url }}
          CI: "true"

      - name: Upload Playwright report
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report-${{ inputs.app }}
          path: apps/${{ inputs.app }}/frontend/playwright-report/
          retention-days: 3
          if-no-files-found: ignore

  integration:
    needs: deploy
    if: ${{ needs.deploy.outputs.workspace_id != '' }}
    # Test-only job (no build, no deploy).
    runs-on: ${{ vars.ERP_KIT_TEST_RUNNER || 'ubuntu-slim' }}
    permissions:
      contents: read
    # The deploy job already prepared this workspace. setup.ts skips its own
    # setup when TAILOR_PLATFORM_WORKSPACE_ID is set, so running alongside the
    # E2E job is safe.
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          cache: pnpm
          cache-dependency-path: ./pnpm-lock.yaml
          node-version-file: package.json

      - run: pnpm install

      - name: Fetch Tailor token
        id: token
        uses: ./.github/actions/erp-kit-fetch-tailor-token
        with:
          client_id: ${{ secrets.TAILOR_PFMU_CLIENT_ID }}
          client_secret: ${{ secrets.TAILOR_PFMU_CLIENT_SECRET }}
          token: ${{ secrets.TAILOR_PLATFORM_TOKEN }}

      - name: Run integration tests
        working-directory: apps/${{ inputs.app }}/backend
        env:
          TAILOR_PLATFORM_TOKEN: ${{ steps.token.outputs.token }}
          TAILOR_PLATFORM_WORKSPACE_ID: ${{ needs.deploy.outputs.workspace_id }}
        run: pnpm test:integration