name: phase1-smoke
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Follows the sha256-clone pattern of validate.yml (DEV-598): the
# repository uses the sha256 git object format, so `actions/checkout` is
# off-limits and we clone manually from a container with git >= 2.45.
#
# `scripts/phase1-smoke.sh` builds every Phase-1 service as a static-ish
# binary (`go build`), spawns them bound to loopback on ephemeral ports,
# then drives User → Approval → Transform → Dummy-Sink → Verification
# with curl + jq. No docker-in-docker needed; the harness is self-
# contained inside the single CI container.
jobs:
  phase1-smoke:
    name: Phase 1 end-to-end smoke
    runs-on: ubuntu-latest
    container:
      image: golang:1.26-alpine3.23
    steps:
      - name: Install prerequisites (git, bash, curl, jq, openssl)
        run: |
          set -eu
          apk add --no-cache git bash curl jq openssl ca-certificates
          git --version
          go version
          jq --version
          openssl version

      - name: Clone repository (sha256-aware)
        run: |
          set -euo pipefail
          git clone --depth=1 --branch="${GITHUB_REF_NAME}" \
            "https://x-access-token:${GITHUB_TOKEN}@forgejo.basicstack.de/${GITHUB_REPOSITORY}.git" "${GITHUB_WORKSPACE}"
          cd "${GITHUB_WORKSPACE}"
          git log -1 --oneline

      - name: Run phase1-smoke
        working-directory: ${{ github.workspace }}
        env:
          # Keep working tree around when the trap tears down so a failed
          # run surfaces the service logs in the step output.
          KEEP_WORK: "1"
        run: |
          set -euo pipefail
          bash scripts/phase1-smoke.sh