package e2e

import (
	"archive/tar"
	"archive/zip"
	"bytes"
	"compress/gzip"
	"context"
	"database/sql"
	"encoding/json"
	"io"
	"net/http"
	"net/url"
	"os"
	"path/filepath"
	"slices"
	"strconv"
	"strings"
	"testing"
	"time"

	"github.com/klauspost/compress/zstd"
)

// The CI suite drives the real pipeline runner against a mock Docker Engine
// on a unix socket, so no container engine is needed.

const ciSimpleTOML = `
image = "debian:latest"

[on]
manual = true
push = ["main"]

[[steps]]
name = "hello"
run_sh = "echo hello"
`

const ciArtifactTOML = `
image = "debian:latest"
work_dir = "/ci"

[on]
manual = true

[[steps]]
name = "build"
run_sh = "echo building"
publish_file = ["/ci/output.txt"]
`

// ciEnv starts a server wired to a fresh mock engine and seeds "ci-repo".
// extraEnv holds further environment pairs for newEnv.
func ciEnv(t *testing.T, extraEnv ...string) (*env, *mockDocker, *session) {
	t.Helper()
	m := newMockDocker(t)
	e := newEnv(t, append([]string{"CI_DOCKER_SOCKET", m.sock}, extraEnv...)...)
	admin := e.admin()
	e.createRepo(admin, "ci-repo")
	e.seedRepo("ci-repo", nil)
	return e, m, admin
}

// ciSeedToml pushes a .hearthforge-ci.toml into ci-repo and returns the
// commit sha. Re-seeding the same content is a no-op commit, so a test can
// put its config back without failing.
func ciSeedToml(e *env, toml string) string {
	t := e.t
	t.Helper()
	work := t.TempDir()
	gitRun(t, work, "clone", "-q", e.repoPath("ci-repo"), ".")
	if err := os.WriteFile(filepath.Join(work, ".hearthforge-ci.toml"), []byte(toml), 0o644); err != nil {
		t.Fatal(err)
	}
	gitRun(t, work, "add", ".hearthforge-ci.toml")
	// Nothing to commit when the config is unchanged.
	_, _ = gitTry(work, "commit", "-q", "-m", "Add CI config")
	gitRun(t, work, "push", "-q", "origin", "HEAD:main")
	e.Srv.Git.InvalidateRefCache("ci-repo")
	return gitRun(t, work, "rev-parse", "HEAD")
}

// ciTrigger posts the manual trigger and returns the new run id. Without a
// branch field the route builds HEAD of the default branch, so the expected
// sha is checked and a stale fixture fails loudly.
func ciTrigger(e *env, admin *session, sha string, overrides url.Values) int64 {
	t := e.t
	t.Helper()
	if head := e.headCommit("ci-repo"); head != sha {
		t.Fatalf("ciTrigger: expected HEAD %s, repo HEAD is %s", sha, head)
	}
	if overrides == nil {
		overrides = url.Values{}
	}
	loc := admin.post("/ci-repo/ci/run", overrides).mustRedirect("/ci-repo/ci/")
	id, err := strconv.ParseInt(idFromPath(t, loc), 10, 64)
	if err != nil {
		t.Fatalf("run id in %q: %v", loc, err)
	}
	return id
}

// ciLatestRunID is the highest run id in the database, or 0.
func ciLatestRunID(e *env) int64 {
	var id sql.NullInt64
	if err := e.DB.QueryRowContext(context.Background(),
		`SELECT MAX(id) FROM ci_runs`).Scan(&id); err != nil {
		e.t.Fatal(err)
	}
	return id.Int64
}

// ciPushRun pushes a commit to a branch over HTTP and returns the run the
// push trigger created.
func ciPushRun(e *env, sha, branch string) int64 {
	t := e.t
	t.Helper()
	before := ciLatestRunID(e)
	gitRun(t, e.repoPath("ci-repo"), "push", "--force", e.authURL("ci-repo"),
		sha+":refs/heads/"+branch)
	e.Srv.Git.InvalidateRefCache("ci-repo")
	var id int64
	ciWaitFor(t, "a run from the push to "+branch, func() bool {
		id = ciLatestRunID(e)
		return id > before
	})
	return id
}

// ciWaitForRun polls until the run leaves pending/running/queued.
func ciWaitForRun(e *env, runID int64, timeout ...time.Duration) string {
	t := e.t
	t.Helper()
	limit := 15 * time.Second
	if len(timeout) > 0 {
		limit = timeout[0]
	}
	var status string
	ciWaitFor(t, "run "+strconv.FormatInt(runID, 10)+" to complete", func() bool {
		status = ciRunStatus(e, runID)
		return status != "" && status != "pending" && status != "running" && status != "queued" &&
			!e.Srv.CI.Active(runID)
	}, limit)
	return status
}

func ciRunStatus(e *env, runID int64) string {
	var status string
	err := e.DB.QueryRowContext(context.Background(),
		`SELECT status FROM ci_runs WHERE id = ?`, runID).Scan(&status)
	if err != nil {
		e.t.Fatalf("run %d: %v", runID, err)
	}
	return status
}

// ciStepRow is one row of ci_steps.
type ciStepRow struct {
	Status string
	Log    string
}

// ciSteps returns every step of a run with that name, in insertion order.
func ciSteps(e *env, runID int64, name string) []ciStepRow {
	rows, err := e.DB.QueryContext(context.Background(),
		`SELECT status, log FROM ci_steps WHERE run_id = ? AND name = ? ORDER BY id ASC`,
		runID, name)
	if err != nil {
		e.t.Fatal(err)
	}
	defer rows.Close()
	var out []ciStepRow
	for rows.Next() {
		var s ciStepRow
		if err := rows.Scan(&s.Status, &s.Log); err != nil {
			e.t.Fatal(err)
		}
		out = append(out, s)
	}
	return out
}

// ciStep returns the first step of a run with that name.
func ciStep(e *env, runID int64, name string) ciStepRow {
	steps := ciSteps(e, runID, name)
	if len(steps) == 0 {
		e.t.Fatalf("run %d has no step %q", runID, name)
	}
	return steps[0]
}

// ciOverrides decodes the stored variable overrides of a run.
func ciOverrides(e *env, runID int64) map[string]string {
	var raw sql.NullString
	if err := e.DB.QueryRowContext(context.Background(),
		`SELECT variable_overrides FROM ci_runs WHERE id = ?`, runID).Scan(&raw); err != nil {
		e.t.Fatal(err)
	}
	out := map[string]string{}
	if raw.String != "" {
		if err := json.Unmarshal([]byte(raw.String), &out); err != nil {
			e.t.Fatalf("overrides %q: %v", raw.String, err)
		}
	}
	return out
}

func ciRunPath(runID int64) string { return "/ci-repo/ci/" + strconv.FormatInt(runID, 10) }

// eqStrings compares two string lists.
func eqStrings(a, b []string) bool {
	if len(a) != len(b) {
		return false
	}
	for i := range a {
		if a[i] != b[i] {
			return false
		}
	}
	return true
}

// ── pipelines tab ────────────────────────────────────────────────────────

func TestCIPipelinesTab(t *testing.T) {
	e, m, admin := ciEnv(t)

	t.Run("tab is visible in repo nav", func(t *testing.T) {
		r := admin.get("/ci-repo").mustStatus(200)
		if !contains(r.Texts(".repo-tab"), "Pipelines") {
			t.Errorf("repo tabs = %v", r.Texts(".repo-tab"))
		}
	})

	t.Run("history page shows empty state when no runs", func(t *testing.T) {
		r := admin.get("/ci-repo/ci").mustStatus(200)
		if !r.Has(".empty-state") {
			t.Fatal("empty state missing")
		}
		if !strings.Contains(r.Text(".empty-state"), "No pipeline runs yet") {
			t.Errorf("empty state = %q", r.Text(".empty-state"))
		}
	})

	t.Run("the run form posts and overrides a declared variable", func(t *testing.T) {
		// Regression: an input-less form posted an empty body and the route
		// crashed whenever the config declared a variable.
		sha := ciSeedToml(e, `
image = "debian:latest"

[on]
manual = true

[variables]
  [variables.GREETING]
  default = "hello"
  description = "What to echo"

[[steps]]
name = "say"
run_sh = "echo $GREETING"
`)
		m.reset()
		m.queueExec(execResp{output: "hi\n"})

		r := admin.get("/ci-repo/ci").mustStatus(200)
		if got := r.Value(`input[name="var_GREETING"]`); got != "hello" {
			t.Fatalf("var_GREETING default = %q", got)
		}
		runID := ciTrigger(e, admin, sha, url.Values{"var_GREETING": {"goodbye"}})
		ciWaitForRun(e, runID)

		got := ciOverrides(e, runID)
		if len(got) != 1 || got["GREETING"] != "goodbye" {
			t.Errorf("overrides = %v", got)
		}
	})

	t.Run("an untouched variable field is not recorded as an override", func(t *testing.T) {
		sha := ciSeedToml(e, `
image = "debian:latest"

[on]
manual = true

[variables]
  [variables.GREETING]
  default = "hello"

[[steps]]
name = "say"
run_sh = "echo $GREETING"
`)
		m.reset()
		m.queueExec(execResp{output: "hi\n"})

		runID := ciTrigger(e, admin, sha, url.Values{"var_GREETING": {"hello"}})
		ciWaitForRun(e, runID)

		if got := ciOverrides(e, runID); len(got) != 0 {
			t.Errorf("overrides = %v, want none", got)
		}
	})

	t.Run("an empty POST to the run route does not crash", func(t *testing.T) {
		sha := ciSeedToml(e, `
image = "debian:latest"

[on]
manual = true

[variables]
  [variables.GREETING]
  default = "hello"

[[steps]]
name = "say"
run_sh = "echo $GREETING"
`)
		_ = sha
		m.reset()
		m.queueExec(execResp{output: "hi\n"})

		r := admin.post("/ci-repo/ci/run", url.Values{})
		if r.Code != http.StatusFound {
			t.Fatalf("status = %d, body %s", r.Code, r.BodyString())
		}
		id, err := strconv.ParseInt(idFromPath(t, r.Location()), 10, 64)
		if err != nil {
			t.Fatal(err)
		}
		ciWaitForRun(e, id)
	})

	t.Run("the run form builds the selected branch with its own config", func(t *testing.T) {
		mainSHA := ciSeedToml(e, ciSimpleTOML)
		work := t.TempDir()
		gitRun(t, work, "clone", "-q", e.repoPath("ci-repo"), ".")
		if err := os.WriteFile(filepath.Join(work, ".hearthforge-ci.toml"), []byte(`
image = "debian:latest"

[variables]
  [variables.FEATURE_ONLY]
  default = "on"

[[steps]]
name = "say"
run_sh = "echo $FEATURE_ONLY"
`), 0o644); err != nil {
			t.Fatal(err)
		}
		gitRun(t, work, "commit", "-q", "-am", "Feature CI config")
		gitRun(t, work, "push", "-q", "origin", "HEAD:refs/heads/feature")
		e.Srv.Git.InvalidateRefCache("ci-repo")
		featureSHA := gitRun(t, work, "rev-parse", "HEAD")
		defer func() {
			gitRun(t, e.repoPath("ci-repo"), "branch", "-D", "feature")
			e.Srv.Git.InvalidateRefCache("ci-repo")
		}()

		r := admin.get("/ci-repo/ci").mustStatus(200)
		if got := r.Value(`input[name="branch"]`); got != "main" {
			t.Errorf("default branch field = %q", got)
		}
		if r.Has(`input[name="var_FEATURE_ONLY"]`) {
			t.Error("main shows the feature branch variable")
		}
		r = admin.get("/ci-repo/ci?branch=feature").mustStatus(200)
		if got := r.Value(`input[name="branch"]`); got != "feature" {
			t.Errorf("branch field = %q", got)
		}
		if got := r.Value(`select[name="branch"]`); got != "feature" {
			t.Errorf("selected branch = %q", got)
		}
		if got := r.Value(`input[name="var_FEATURE_ONLY"]`); got != "on" {
			t.Errorf("var_FEATURE_ONLY default = %q", got)
		}

		m.reset()
		m.queueExec(execResp{output: "off\n"})
		loc := admin.post("/ci-repo/ci/run", url.Values{
			"branch": {"feature"}, "var_FEATURE_ONLY": {"off"},
		}).mustRedirect("/ci-repo/ci/")
		runID, err := strconv.ParseInt(idFromPath(t, loc), 10, 64)
		if err != nil {
			t.Fatal(err)
		}
		ciWaitForRun(e, runID)
		var sha, branch string
		if err := e.DB.QueryRowContext(context.Background(),
			`SELECT commit_sha, commit_branch FROM ci_runs WHERE id = ?`, runID).
			Scan(&sha, &branch); err != nil {
			t.Fatal(err)
		}
		if sha != featureSHA || sha == mainSHA || branch != "feature" {
			t.Errorf("run built %s on %q, want %s on feature", sha, branch, featureSHA)
		}
		if got := ciOverrides(e, runID); got["FEATURE_ONLY"] != "off" {
			t.Errorf("overrides = %v", got)
		}

		for _, b := range []string{"nope", mainSHA, "HEAD~1"} {
			r := admin.post("/ci-repo/ci/run", url.Values{"branch": {b}})
			if r.Code != http.StatusBadRequest {
				t.Errorf("branch %q: status = %d", b, r.Code)
			}
		}
	})

	t.Run("help section is collapsible and contains template download", func(t *testing.T) {
		r := admin.get("/ci-repo/ci").mustStatus(200)
		if !r.Has("details.ci-help") {
			t.Error("help section missing")
		}
		if !r.Has(`a[download=".hearthforge-ci.toml"]`) {
			t.Error("template download link missing")
		}
	})
}

// ── successful run ───────────────────────────────────────────────────────

func TestCISuccessfulRun(t *testing.T) {
	e, m, admin := ciEnv(t)
	m.queueExec(execResp{output: "hello from mock CI\n"})
	sha := ciSeedToml(e, ciSimpleTOML)
	runID := ciTrigger(e, admin, sha, nil)
	ciWaitForRun(e, runID)

	t.Run("run status is success", func(t *testing.T) {
		if got := ciRunStatus(e, runID); got != "success" {
			t.Errorf("status = %q", got)
		}
	})

	t.Run("step status is success and log is captured", func(t *testing.T) {
		step := ciStep(e, runID, "hello")
		if step.Status != "success" {
			t.Errorf("step status = %q", step.Status)
		}
		if !strings.Contains(step.Log, "hello from mock CI") {
			t.Errorf("step log = %q", step.Log)
		}
	})

	t.Run("history page shows the completed run", func(t *testing.T) {
		r := admin.get("/ci-repo/ci").mustStatus(200)
		if r.Count(".ci-status-pill.ci-status-success") == 0 {
			t.Error("no success pill on the history page")
		}
		if r.Count(`a.commit-hash[href^="/ci-repo/commit/"]`) == 0 {
			t.Error("commit hash is not a link to the commit page")
		}
		// The trigger label uses the owner display name, like every other
		// place that names the admin.
		if !contains(r.Texts(".text-muted"), "by "+e.Cfg.OwnerDisplayName) || contains(r.Texts(".text-muted"), "by admin") {
			t.Errorf("trigger labels = %v", r.Texts(".text-muted"))
		}
	})

	t.Run("run detail page shows step and log", func(t *testing.T) {
		r := admin.get(ciRunPath(runID)).mustStatus(200)
		steps := r.Texts(".ci-step")
		if len(steps) < 2 {
			t.Fatalf("steps = %v", steps)
		}
		// Setup is a real step and sorts before the config's steps.
		if !strings.Contains(steps[0], "pipeline setup") || !strings.Contains(steps[0], "success") {
			t.Errorf("first step = %q", steps[0])
		}
		if !strings.Contains(steps[1], "hello") {
			t.Errorf("second step = %q", steps[1])
		}
		if !contains(r.Texts(".ci-step-log"), "hello from mock CI") {
			t.Errorf("logs = %v", r.Texts(".ci-step-log"))
		}
	})

	t.Run("retry re-executes the same run in-place", func(t *testing.T) {
		r := admin.post(ciRunPath(runID)+"/retry", url.Values{})
		if got := r.mustRedirect(ciRunPath(runID)); got != ciRunPath(runID) {
			t.Errorf("redirect = %q", got)
		}
		if got := ciWaitForRun(e, runID); got != "success" {
			t.Errorf("status after retry = %q", got)
		}
		// No new run was created: the row still exists under the same id.
		if ciRunStatus(e, runID) != "success" {
			t.Error("run row changed")
		}
	})
}

// ── failing run ──────────────────────────────────────────────────────────

func TestCIFailingRun(t *testing.T) {
	e, m, admin := ciEnv(t)
	m.queueExec(execResp{output: "build error: file not found\n", exitCode: 1})
	sha := ciSeedToml(e, ciSimpleTOML)
	runID := ciTrigger(e, admin, sha, nil)
	ciWaitForRun(e, runID)

	t.Run("run status is failure", func(t *testing.T) {
		if got := ciRunStatus(e, runID); got != "failure" {
			t.Errorf("status = %q", got)
		}
	})

	t.Run("step status is failure and error log captured", func(t *testing.T) {
		step := ciStep(e, runID, "hello")
		if step.Status != "failure" {
			t.Errorf("step status = %q", step.Status)
		}
		if !strings.Contains(step.Log, "build error") {
			t.Errorf("step log = %q", step.Log)
		}
	})

	t.Run("run detail page shows failure status", func(t *testing.T) {
		r := admin.get(ciRunPath(runID)).mustStatus(200)
		if r.Count(".ci-status-pill.ci-status-failure") == 0 {
			t.Error("no failure pill on the run page")
		}
	})
}

// ── cancel ───────────────────────────────────────────────────────────────

func TestCICancel(t *testing.T) {
	e, _, admin := ciEnv(t)

	t.Run("cancelling a pending run marks it cancelled", func(t *testing.T) {
		sha := ciSeedToml(e, ciSimpleTOML)
		runID := ciTrigger(e, admin, sha, nil)
		admin.post(ciRunPath(runID)+"/cancel", url.Values{}).mustRedirect(ciRunPath(runID))

		status := ciWaitForRun(e, runID)
		switch status {
		case "cancelled", "success", "failure":
		default:
			t.Fatalf("status = %q", status)
		}
	})
}

const ciSlowTOML = `
image = "debian:latest"

[on]
manual = true

[[steps]]
name = "slow"
run_sh = "sleep 60"

[[steps]]
name = "after"
run_sh = "echo after"
`

// ciStepStatus is the status of the first step with that name, or "".
func ciStepStatus(e *env, runID int64, name string) string {
	if steps := ciSteps(e, runID, name); len(steps) > 0 {
		return steps[0].Status
	}
	return ""
}

// ciWaitFor polls cond for up to ten seconds, or the given timeout.
func ciWaitFor(t *testing.T, what string, cond func() bool, timeout ...time.Duration) {
	t.Helper()
	limit := 10 * time.Second
	if len(timeout) > 0 {
		limit = timeout[0]
	}
	for deadline := time.Now().Add(limit); time.Now().Before(deadline); {
		if cond() {
			return
		}
		time.Sleep(20 * time.Millisecond)
	}
	t.Fatalf("timed out waiting for %s", what)
}

func TestCICancelMidRun(t *testing.T) {
	e, m, admin := ciEnv(t)

	t.Run("the interrupted step reads cancelled", func(t *testing.T) {
		sha := ciSeedToml(e, ciSlowTOML)
		m.reset()
		m.queueExec(execResp{delay: 30 * time.Second})
		runID := ciTrigger(e, admin, sha, nil)
		ciWaitFor(t, "slow step to run", func() bool { return ciStepStatus(e, runID, "slow") == "running" })

		admin.post(ciRunPath(runID)+"/cancel", url.Values{}).mustRedirect(ciRunPath(runID))
		ciWaitFor(t, "slow step to settle", func() bool { return ciStepStatus(e, runID, "slow") != "running" })
		if got := ciStep(e, runID, "slow").Status; got != "cancelled" {
			t.Errorf("slow status = %q", got)
		}
		if got := ciStep(e, runID, "after").Status; got != "skipped" {
			t.Errorf("after status = %q", got)
		}
		if got := ciRunStatus(e, runID); got != "cancelled" {
			t.Errorf("run status = %q", got)
		}
	})

	t.Run("a cancel during artifact collection is not overwritten", func(t *testing.T) {
		sha := ciSeedToml(e, ciArtifactTOML)
		m.reset()
		m.archiveDelay = 30 * time.Second
		runID := ciTrigger(e, admin, sha, nil)
		ciWaitFor(t, "artifact download", func() bool {
			return slices.Contains(m.containerRequests(), "GET archive")
		})

		admin.post(ciRunPath(runID)+"/cancel", url.Values{}).mustRedirect(ciRunPath(runID))
		ciWaitFor(t, "build step to settle", func() bool { return ciStepStatus(e, runID, "build") != "running" })
		// The final status write follows the step write within milliseconds.
		time.Sleep(300 * time.Millisecond)
		if got := ciRunStatus(e, runID); got != "cancelled" {
			t.Errorf("run status = %q", got)
		}
	})
}

func TestCIContainerLifecycle(t *testing.T) {
	e, m, admin := ciEnv(t)
	sha := ciSeedToml(e, ciSimpleTOML)
	m.reset()
	runID := ciTrigger(e, admin, sha, nil)
	ciWaitForRun(e, runID)

	name := "hearthforge-ci-" + strconv.FormatInt(runID, 10)
	reqs := m.containerRequests()
	// A leftover from a cancelled create must not block the name.
	if len(reqs) < 2 || reqs[0] != "DELETE "+name || reqs[1] != "POST create?name="+name {
		t.Errorf("requests = %v", reqs)
	}
	labels, _ := m.createBody()["Labels"].(map[string]any)
	if labels["com.hearthforge.ci"] != "1" {
		t.Errorf("labels = %v", labels)
	}
}

func TestCIRepoDeleteStopsRuns(t *testing.T) {
	e, m, admin := ciEnv(t)
	sha := ciSeedToml(e, ciArtifactTOML)
	m.reset()
	done := ciTrigger(e, admin, sha, nil)
	ciWaitForRun(e, done)
	artifacts := filepath.Join(e.Cfg.CIArtifactsDir(), strconv.FormatInt(done, 10))
	if _, err := os.Stat(artifacts); err != nil {
		t.Fatalf("artifacts of run %d: %v", done, err)
	}

	m.queueExec(execResp{delay: 30 * time.Second})
	active := ciTrigger(e, admin, sha, nil)
	ciWaitFor(t, "build step to run", func() bool { return ciStepStatus(e, active, "build") == "running" })
	m.setVolumesOnHost("hearthforge-ci-cache-old")

	admin.post("/ci-repo/settings/delete", nil).mustRedirect("/")

	if !slices.Contains(m.containerRequests(), "DELETE hearthforge-ci-"+strconv.FormatInt(active, 10)) {
		t.Errorf("active container not removed: %v", m.containerRequests())
	}
	if _, err := os.Stat(artifacts); !os.IsNotExist(err) {
		t.Errorf("artifacts still there: %v", err)
	}
	if !slices.Contains(m.deletedVolumes(), "hearthforge-ci-cache-old") {
		t.Errorf("volumes deleted = %v", m.deletedVolumes())
	}
}

// ── artifacts ────────────────────────────────────────────────────────────

func TestCIArtifacts(t *testing.T) {
	e, _, admin := ciEnv(t)
	sha := ciSeedToml(e, ciArtifactTOML)
	runID := ciTrigger(e, admin, sha, nil)
	ciWaitForRun(e, runID)

	var artifactID int64
	var filename string
	var count int
	rows, err := e.DB.QueryContext(context.Background(),
		`SELECT id, filename FROM ci_artifacts WHERE run_id = ? ORDER BY id`, runID)
	if err != nil {
		t.Fatal(err)
	}
	for rows.Next() {
		if err := rows.Scan(&artifactID, &filename); err != nil {
			t.Fatal(err)
		}
		count++
	}
	rows.Close()

	t.Run("artifact row created in DB", func(t *testing.T) {
		if count != 1 {
			t.Fatalf("artifacts = %d", count)
		}
		if filename != "output.txt" {
			t.Errorf("filename = %q", filename)
		}
	})

	t.Run("artifact is downloadable via HTTP", func(t *testing.T) {
		if artifactID <= 0 {
			t.Fatal("no artifact id")
		}
		r := e.anon().get(ciRunPath(runID) + "/artifacts/" + strconv.FormatInt(artifactID, 10))
		r.mustStatus(200)
		if r.BodyString() != "artifact-content-123" {
			t.Errorf("body = %q", r.BodyString())
		}
	})

	t.Run("run detail page shows artifact list", func(t *testing.T) {
		r := admin.get(ciRunPath(runID)).mustStatus(200)
		if r.Count(".ci-artifact-item") == 0 {
			t.Fatal("no artifact items")
		}
		if !strings.Contains(r.Text(".ci-artifact-name"), "output.txt") {
			t.Errorf("artifact name = %q", r.Text(".ci-artifact-name"))
		}
	})
}

// ── badge ────────────────────────────────────────────────────────────────

func TestCIBadge(t *testing.T) {
	e, m, admin := ciEnv(t)
	m.queueExec(execResp{output: "ok\n"})
	sha := ciSeedToml(e, ciSimpleTOML)
	runID := ciTrigger(e, admin, sha, nil)
	ciWaitForRun(e, runID)

	t.Run("badge SVG returns success status after successful run", func(t *testing.T) {
		r := e.anon().get("/ci-repo/ci/badge.svg").mustStatus(200)
		if !strings.Contains(r.Header.Get("Content-Type"), "image/svg+xml") {
			t.Errorf("content type = %q", r.Header.Get("Content-Type"))
		}
		if !r.Contains("<svg") || !r.Contains("success") {
			t.Errorf("badge = %q", r.BodyString())
		}
	})

	t.Run("badge returns 404 for private repo when not logged in", func(t *testing.T) {
		e.createRepo(admin, "private-ci-repo", "is_private", "1")
		e.anon().get("/private-ci-repo/ci/badge.svg").mustStatus(404)
	})
}

// ── secrets ──────────────────────────────────────────────────────────────

func TestCISecrets(t *testing.T) {
	e, m, admin := ciEnv(t)

	t.Run("can add, list, and delete a secret via settings", func(t *testing.T) {
		admin.post("/ci-repo/settings/ci-secrets", url.Values{
			"name": {"MY_SECRET"}, "value": {"super-secret-value"},
			"description": {"A test secret"},
		}).mustRedirect("/ci-repo/settings")

		r := admin.get("/ci-repo/settings").mustStatus(200)
		if n := len(matchingTexts(r.Texts("code"), "MY_SECRET")); n != 1 {
			t.Fatalf("MY_SECRET shown %d times", n)
		}
		if !r.Contains("●●●●●●") {
			t.Error("secret value is not masked")
		}

		id := r.Value(`form[action="/ci-repo/settings/ci-secrets/delete"] input[name=id]`)
		if id == "" {
			t.Fatal("no delete form for the secret")
		}
		admin.post("/ci-repo/settings/ci-secrets/delete", url.Values{"id": {id}}).
			mustRedirect("/ci-repo/settings")

		r = admin.get("/ci-repo/settings").mustStatus(200)
		if n := len(matchingTexts(r.Texts("code"), "MY_SECRET")); n != 0 {
			t.Errorf("MY_SECRET still shown %d times", n)
		}
	})

	t.Run("secret value is masked in step logs", func(t *testing.T) {
		admin.post("/ci-repo/settings/ci-secrets", url.Values{
			"name": {"MASK_ME"}, "value": {"s3cr3t-p4ssw0rd"},
		}).mustRedirect("/ci-repo/settings")

		m.reset()
		m.queueExec(execResp{output: "s3cr3t-p4ssw0rd is the value\n"})
		sha := ciSeedToml(e, ciSimpleTOML)
		runID := ciTrigger(e, admin, sha, nil)
		ciWaitForRun(e, runID)

		step := ciStep(e, runID, "hello")
		if strings.Contains(step.Log, "s3cr3t-p4ssw0rd") {
			t.Errorf("secret leaked into the log: %q", step.Log)
		}
		if !strings.Contains(step.Log, "[MASKED]") {
			t.Errorf("log = %q", step.Log)
		}
	})
}

// matchingTexts keeps the entries containing sub.
func matchingTexts(list []string, sub string) []string {
	var out []string
	for _, s := range list {
		if strings.Contains(s, sub) {
			out = append(out, s)
		}
	}
	return out
}

// ── per-repo run IDs ─────────────────────────────────────────────────────

func TestCIPerRepoRunIDs(t *testing.T) {
	e, m, admin := ciEnv(t)
	sha := ciSeedToml(e, ciSimpleTOML)
	for range 2 {
		m.reset()
		ciWaitForRun(e, ciTrigger(e, admin, sha, nil))
	}

	t.Run("repo_run_id is set and increments per repo", func(t *testing.T) {
		rows, err := e.DB.QueryContext(context.Background(),
			`SELECT repo_run_id FROM ci_runs ORDER BY repo_run_id ASC`)
		if err != nil {
			t.Fatal(err)
		}
		defer rows.Close()
		i := 0
		for rows.Next() {
			var id sql.NullInt64
			if err := rows.Scan(&id); err != nil {
				t.Fatal(err)
			}
			if !id.Valid || id.Int64 <= 0 {
				t.Fatal("repo_run_id is not set")
			}
			i++
			if id.Int64 != int64(i) {
				t.Fatalf("repo_run_id %d at position %d", id.Int64, i)
			}
		}
		if i == 0 {
			t.Fatal("no runs")
		}
	})

	t.Run("run detail page shows repo-local run number", func(t *testing.T) {
		var runID, repoRunID int64
		if err := e.DB.QueryRowContext(context.Background(),
			`SELECT id, repo_run_id FROM ci_runs ORDER BY id ASC LIMIT 1`).
			Scan(&runID, &repoRunID); err != nil {
			t.Fatal(err)
		}
		r := admin.get(ciRunPath(runID)).mustStatus(200)
		want := "#" + strconv.FormatInt(repoRunID, 10)
		if !strings.Contains(r.Text("h2"), want) {
			t.Errorf("heading = %q, want %q", r.Text("h2"), want)
		}
	})
}

// ── skip reasons ─────────────────────────────────────────────────────────

const ciSkipIfTOML = `
image = "debian:latest"

[on]
manual = true

[[steps]]
name = "first"
run_sh = "echo first"

[[steps]]
name = "second"
run_if = "false"
run_sh = "echo second"

[[steps]]
name = "third"
run_sh = "echo third"
`

func TestCISkipReasons(t *testing.T) {
	e, m, admin := ciEnv(t)

	t.Run("run_if failure sets skip reason in log", func(t *testing.T) {
		sha := ciSeedToml(e, ciSkipIfTOML)
		m.reset()
		m.queueExec(execResp{output: "first\n"}) // first step
		m.queueExec(execResp{exitCode: 1})       // run_if check of second
		m.queueExec(execResp{output: "third\n"}) // third step
		runID := ciTrigger(e, admin, sha, nil)
		ciWaitForRun(e, runID)

		step := ciStep(e, runID, "second")
		if step.Status != "skipped" {
			t.Errorf("status = %q", step.Status)
		}
		if !strings.Contains(step.Log, "condition not met") {
			t.Errorf("log = %q", step.Log)
		}
	})

	t.Run("failed step causes remaining steps to be skipped with reason", func(t *testing.T) {
		sha := ciSeedToml(e, ciSkipIfTOML)
		m.reset()
		m.queueExec(execResp{output: "boom\n", exitCode: 1}) // first step fails
		runID := ciTrigger(e, admin, sha, nil)
		ciWaitForRun(e, runID)

		step := ciStep(e, runID, "third")
		if step.Status != "skipped" {
			t.Errorf("status = %q", step.Status)
		}
		if !strings.Contains(step.Log, "previous step failed") {
			t.Errorf("log = %q", step.Log)
		}
	})
}

// ── docker unavailable ───────────────────────────────────────────────────

func TestCIDockerUnavailable(t *testing.T) {
	// newEnv points CI_DOCKER_SOCKET at a path that does not exist.
	e := newEnv(t)
	admin := e.admin()
	e.createRepo(admin, "ci-repo")
	e.seedRepo("ci-repo", nil)

	t.Run("run is marked skipped when docker socket is missing", func(t *testing.T) {
		sha := ciSeedToml(e, ciSimpleTOML)
		runID := ciTrigger(e, admin, sha, nil)
		if got := ciWaitForRun(e, runID); got != "skipped" {
			t.Errorf("status = %q", got)
		}
	})
}

// ── manual trigger without on.manual ─────────────────────────────────────

const ciNoManualTOML = `
image = "debian:latest"

[on]
push = ["main"]

[[steps]]
name = "hello"
run_sh = "echo hi"
`

func TestCIManualTriggerWithoutOnManual(t *testing.T) {
	e, m, admin := ciEnv(t)

	t.Run("manual run is allowed even without manual = true in config", func(t *testing.T) {
		sha := ciSeedToml(e, ciNoManualTOML)
		m.reset()
		m.queueExec(execResp{output: "hi\n"})
		runID := ciTrigger(e, admin, sha, nil)
		if got := ciWaitForRun(e, runID); got != "success" {
			t.Errorf("status = %q", got)
		}
	})

	t.Run("Run pipeline button is not disabled when toml lacks manual = true", func(t *testing.T) {
		ciSeedToml(e, ciNoManualTOML)
		r := admin.get("/ci-repo/ci").mustStatus(200)
		if !contains(r.Texts("button"), "Run pipeline") {
			t.Fatalf("buttons = %v", r.Texts("button"))
		}
		if r.Has("button[disabled]") {
			t.Error("the Run pipeline button is disabled")
		}
	})
}

// ── auto-refresh toggle ──────────────────────────────────────────────────

func TestCIAutoRefreshToggle(t *testing.T) {
	e, _, admin := ciEnv(t)

	t.Run("Pause refresh button appears on active run and ?refresh=off shows Resume", func(t *testing.T) {
		sha := ciSeedToml(e, ciSimpleTOML)
		runID := ciTrigger(e, admin, sha, nil)

		// The run may already have finished, so only the refresh link's
		// existence is checked, exactly as the browser test did.
		admin.get(ciRunPath(runID)).mustStatus(200)

		r := admin.get(ciRunPath(runID) + "?refresh=off").mustStatus(200)
		if n := r.Count(`meta[http-equiv="refresh"]`); n != 0 {
			t.Errorf("meta refresh count = %d", n)
		}
		ciWaitForRun(e, runID)
	})
}

// ── purge cache ──────────────────────────────────────────────────────────

func TestCIPurgeCache(t *testing.T) {
	_, _, admin := ciEnv(t)

	t.Run("Purge caches button is visible and submits successfully", func(t *testing.T) {
		r := admin.get("/ci-repo/ci").mustStatus(200)
		if !contains(r.Texts("button"), "Purge caches") {
			t.Fatalf("buttons = %v", r.Texts("button"))
		}
		redirect := admin.post("/ci-repo/ci/purge-cache", url.Values{})
		redirect.mustRedirect("/ci-repo/ci")

		r = admin.follow(redirect).mustStatus(200)
		if !strings.Contains(r.Text("h2"), "Pipelines") {
			t.Errorf("heading = %q", r.Text("h2"))
		}
		msg := r.Text(".form-success, .form-error")
		if !strings.Contains(strings.ToLower(msg), "purge") {
			t.Errorf("message = %q", msg)
		}
	})
}

// ── repo upload ──────────────────────────────────────────────────────────

const ciCloneTOML = `
image = "debian:latest"
work_dir = "/ci/build"
clone_project_to = "/ci/build/project"

[on]
manual = true

[[steps]]
name = "hello"
run_sh = "echo hi"
`

func TestCIRepoUpload(t *testing.T) {
	e, m, admin := ciEnv(t)
	ciSeedToml(e, ciCloneTOML)

	// Sibling subtests reseed the config, and the trigger route always builds
	// HEAD. Put the clone config back first.
	trigger := func() int64 {
		sha := ciSeedToml(e, ciCloneTOML)
		return ciTrigger(e, admin, sha, nil)
	}

	t.Run("the checkout is uploaded, not bind-mounted", func(t *testing.T) {
		m.reset()
		runID := trigger()
		if got := ciWaitForRun(e, runID); got != "success" {
			t.Fatalf("status = %q", got)
		}
		if len(m.uploadsInto(t, "/ci/build/project")) == 0 {
			t.Fatalf("no upload carries files under the clone directory; uploads = %v", m.uploadedPaths())
		}
		binds, _ := json.Marshal(m.createBody()["HostConfig"])
		if strings.Contains(string(binds), e.DataDir) {
			t.Errorf("binds reference the data directory: %s", binds)
		}
	})

	t.Run("the container never runs git", func(t *testing.T) {
		m.reset()
		runID := trigger()
		if got := ciWaitForRun(e, runID); got != "success" {
			t.Fatalf("status = %q", got)
		}
		if strings.Contains(m.allCommandText(), "git") {
			t.Errorf("commands = %v", m.commands())
		}
	})

	t.Run("a failing checkout fails the run before any step runs", func(t *testing.T) {
		m.reset()
		m.uploadError = "read-only file system"

		runID := trigger()
		if got := ciWaitForRun(e, runID); got != "failure" {
			t.Fatalf("status = %q", got)
		}
		if got := ciStep(e, runID, "hello").Status; got != "skipped" {
			t.Errorf("hello status = %q", got)
		}
		setup := ciStep(e, runID, "pipeline setup")
		if setup.Status != "failure" {
			t.Errorf("setup status = %q", setup.Status)
		}
		if !strings.Contains(setup.Log, "read-only file system") {
			t.Errorf("setup log = %q", setup.Log)
		}
	})

	t.Run("a cache path inside the clone directory is rejected", func(t *testing.T) {
		m.reset()
		sha := ciSeedToml(e, `
image = "debian:latest"
clone_project_to = "/ci/build/project"
cache = ["/ci/build/project/target"]

[on]
manual = true

[[steps]]
name = "hello"
run_sh = "echo hi"
`)
		runID := ciTrigger(e, admin, sha, nil)
		if got := ciWaitForRun(e, runID); got != "failure" {
			t.Fatalf("status = %q", got)
		}
		if n := m.uploadCount(); n != 0 {
			t.Errorf("uploads = %d, want 0", n)
		}
		if log := ciStep(e, runID, "pipeline setup").Log; !strings.Contains(log, "overlaps clone_project_to") {
			t.Errorf("setup log = %q", log)
		}
	})

	t.Run("a cache path above the clone directory is rejected", func(t *testing.T) {
		m.reset()
		sha := ciSeedToml(e, `
image = "debian:latest"
clone_project_to = "/ci/build/project"
cache = ["/ci/build"]

[on]
manual = true

[[steps]]
name = "hello"
run_sh = "echo hi"
`)
		runID := ciTrigger(e, admin, sha, nil)
		if got := ciWaitForRun(e, runID); got != "failure" {
			t.Fatalf("status = %q", got)
		}
		if n := m.uploadCount(); n != 0 {
			t.Errorf("uploads = %d, want 0", n)
		}
	})

	t.Run("a relative clone_project_to is rejected", func(t *testing.T) {
		m.reset()
		sha := ciSeedToml(e, `
image = "debian:latest"
work_dir = "/ci/build"
clone_project_to = "project"

[on]
manual = true

[[steps]]
name = "hello"
run_sh = "echo hi"
`)
		runID := ciTrigger(e, admin, sha, nil)
		if got := ciWaitForRun(e, runID); got != "failure" {
			t.Fatalf("status = %q", got)
		}
		if log := ciStep(e, runID, "pipeline setup").Log; !strings.Contains(log, "must be an absolute path") {
			t.Errorf("setup log = %q", log)
		}
	})

	t.Run("the upload carries the requested commit", func(t *testing.T) {
		m.reset()
		runID := trigger()
		if got := ciWaitForRun(e, runID); got != "success" {
			t.Fatalf("status = %q", got)
		}
		ups := m.uploadsInto(t, "/ci/build/project")
		if len(ups) == 0 {
			t.Fatal("no upload into the clone directory")
		}
		// The archive is extracted at / and carries the clone directory as
		// its prefix. It must hold the CI config at the triggered commit,
		// and no .git. A dropped commit argument would still produce a
		// valid tar.
		if ups[0].path != "/" {
			t.Errorf("upload path = %q, want /", ups[0].path)
		}
		names := tarEntryNames(t, ups[0].body)
		if !contains(names, "ci/build/project/.hearthforge-ci.toml") {
			t.Errorf("entries = %v", names)
		}
		for _, n := range names {
			// git archive adds a pax header carrying the commit id.
			if n == "pax_global_header" {
				continue
			}
			if strings.Contains(n, ".git/") || !strings.HasPrefix(n, "ci/build/project/") {
				t.Errorf("unexpected entry %q", n)
			}
		}
		// git archive writes uid 0, so the files belong to root in the
		// container.
		for _, h := range tarHeaders(t, ups[0].body) {
			if h.uid != 0 {
				t.Errorf("entry %q has uid %d", h.name, h.uid)
			}
		}
	})
}

// ── copy from another image ──────────────────────────────────────────────

const ciCopyTOML = `
image = "debian:latest"

[on]
manual = true

[[copy]]
image = "docker.io/oven/bun:1.4.0-alpine"
from = "/usr/local/bin/bun"
to = "/usr/local/bin"

[[steps]]
name = "hello"
run_sh = "bun --version"
`

func TestCICopyFromAnotherImage(t *testing.T) {
	e, m, admin := ciEnv(t)

	t.Run("pulls the source image and uploads its files", func(t *testing.T) {
		sha := ciSeedToml(e, ciCopyTOML)
		m.reset()
		m.queueExec(execResp{output: "1.4.0\n"}) // the step

		runID := ciTrigger(e, admin, sha, nil)
		if got := ciWaitForRun(e, runID); got != "success" {
			t.Fatalf("status = %q", got)
		}
		if !contains(m.pulledImages(), "docker.io/oven/bun") {
			t.Errorf("pulls = %v", m.pulledImages())
		}
		if !contains(m.uploadedPaths(), "/usr/local/bin") || len(m.uploadsInto(t, "/usr/local")) == 0 {
			t.Errorf("uploads = %v", m.uploadedPaths())
		}
	})
}

// ── always and warn_on_fail ──────────────────────────────────────────────

const ciFlagsTOML = `
image = "debian:latest"

[on]
manual = true

[[steps]]
name = "lint"
run_sh = "make lint"
warn_on_fail = true

[[steps]]
name = "build"
run_sh = "make"

[[steps]]
name = "cleanup"
run_sh = "rm -rf /scratch"
always = true
`

func TestCIAlwaysAndWarnOnFail(t *testing.T) {
	e, m, admin := ciEnv(t)

	run := func(sha string) int64 {
		runID := ciTrigger(e, admin, sha, nil)
		ciWaitForRun(e, runID)
		return runID
	}

	t.Run("warn_on_fail marks the step and lets the run continue", func(t *testing.T) {
		sha := ciSeedToml(e, ciFlagsTOML)
		m.reset()
		m.queueExec(execResp{output: "style nit\n", exitCode: 1}) // lint
		m.queueExec(execResp{output: "built\n"})                  // build
		m.queueExec(execResp{})                                   // cleanup

		runID := run(sha)

		lint := ciStep(e, runID, "lint")
		if lint.Status != "warning" {
			t.Errorf("lint status = %q", lint.Status)
		}
		if !strings.Contains(lint.Log, "style nit") {
			t.Errorf("lint log = %q", lint.Log)
		}
		if got := ciStep(e, runID, "build").Status; got != "success" {
			t.Errorf("build status = %q", got)
		}
		if got := ciRunStatus(e, runID); got != "warning" {
			t.Errorf("run status = %q", got)
		}
	})

	t.Run("always runs after a failure, other steps stay skipped", func(t *testing.T) {
		sha := ciSeedToml(e, ciFlagsTOML)
		m.reset()
		m.queueExec(execResp{output: "ok\n"})                // lint
		m.queueExec(execResp{output: "boom\n", exitCode: 1}) // build fails
		m.queueExec(execResp{output: "cleaned\n"})           // cleanup, always

		runID := run(sha)

		if got := ciStep(e, runID, "build").Status; got != "failure" {
			t.Errorf("build status = %q", got)
		}
		cleanup := ciStep(e, runID, "cleanup")
		if cleanup.Status != "success" {
			t.Errorf("cleanup status = %q", cleanup.Status)
		}
		if !strings.Contains(cleanup.Log, "cleaned") {
			t.Errorf("cleanup log = %q", cleanup.Log)
		}
		if got := ciRunStatus(e, runID); got != "failure" {
			t.Errorf("run status = %q", got)
		}
	})

	t.Run("a failing always step keeps the run failed", func(t *testing.T) {
		sha := ciSeedToml(e, ciFlagsTOML)
		m.reset()
		m.queueExec(execResp{output: "ok\n"})                // lint
		m.queueExec(execResp{output: "boom\n", exitCode: 1}) // build fails
		m.queueExec(execResp{output: "no\n", exitCode: 1})   // cleanup also fails

		runID := run(sha)

		if got := ciStep(e, runID, "cleanup").Status; got != "failure" {
			t.Errorf("cleanup status = %q", got)
		}
		if got := ciRunStatus(e, runID); got != "failure" {
			t.Errorf("run status = %q", got)
		}
	})
}

// ── duplicate step names ─────────────────────────────────────────────────

const ciDupesTOML = `
image = "debian:latest"

[on]
manual = true

[[steps]]
name = "check"
run_sh = "echo one"

[[steps]]
name = "check"
run_sh = "echo two"
`

func TestCIDuplicateStepNames(t *testing.T) {
	e, m, admin := ciEnv(t)

	t.Run("each occurrence gets its own row, in file order", func(t *testing.T) {
		sha := ciSeedToml(e, ciDupesTOML)
		m.reset()
		m.queueExec(execResp{output: "one\n"})
		m.queueExec(execResp{output: "two\n"})

		runID := ciTrigger(e, admin, sha, nil)
		if got := ciWaitForRun(e, runID); got != "success" {
			t.Fatalf("status = %q", got)
		}
		rows := ciSteps(e, runID, "check")
		if len(rows) != 2 {
			t.Fatalf("rows = %d", len(rows))
		}
		if !strings.Contains(rows[0].Log, "one") || !strings.Contains(rows[1].Log, "two") {
			t.Errorf("logs = %q, %q", rows[0].Log, rows[1].Log)
		}
		for _, r := range rows {
			if r.Status != "success" {
				t.Errorf("status = %q", r.Status)
			}
		}
	})

	t.Run("the second occurrence can fail on its own", func(t *testing.T) {
		sha := ciSeedToml(e, ciDupesTOML)
		m.reset()
		m.queueExec(execResp{output: "one\n"})
		m.queueExec(execResp{output: "boom\n", exitCode: 1})

		runID := ciTrigger(e, admin, sha, nil)
		if got := ciWaitForRun(e, runID); got != "failure" {
			t.Fatalf("status = %q", got)
		}
		rows := ciSteps(e, runID, "check")
		got := []string{}
		for _, r := range rows {
			got = append(got, r.Status)
		}
		if !eqStrings(got, []string{"success", "failure"}) {
			t.Errorf("statuses = %v", got)
		}
	})
}

// ── timeouts override warn_on_fail ───────────────────────────────────────

const ciTimeoutTOML = `
image = "debian:latest"

[on]
manual = true

[[steps]]
name = "lint"
run_sh = "make lint"
warn_on_fail = true
timeout = 1

[[steps]]
name = "build"
run_sh = "make"
`

func TestCITimeoutsOverrideWarnOnFail(t *testing.T) {
	e, m, admin := ciEnv(t)

	t.Run("a timed-out warn_on_fail step fails the run", func(t *testing.T) {
		sha := ciSeedToml(e, ciTimeoutTOML)
		m.reset()
		m.queueExec(execResp{delay: 3 * time.Second})

		runID := ciTrigger(e, admin, sha, nil)
		if got := ciWaitForRun(e, runID, 30*time.Second); got != "failure" {
			t.Fatalf("status = %q", got)
		}
		// A timeout destroys the container, so nothing after it can run.
		// Reporting that as a warning would hide a dead pipeline.
		lint := ciStep(e, runID, "lint")
		if lint.Status != "failure" {
			t.Errorf("lint status = %q", lint.Status)
		}
		if !strings.Contains(lint.Log, "timed out") {
			t.Errorf("lint log = %q", lint.Log)
		}
	})
}

// ── clear failures are recorded ──────────────────────────────────────────

const ciClearTOML = `
image = "debian:latest"
work_dir = "/ci/build"
clone_project_to = "/ci/build/project"

[on]
manual = true

[[steps]]
name = "first"
run_sh = "false"

[[steps]]
name = "second"
always = true
clear = true
run_sh = "echo hi"
`

func TestCIClearFailuresAreRecorded(t *testing.T) {
	e, m, admin := ciEnv(t)

	t.Run("a clear failure lands on the step, not the console", func(t *testing.T) {
		sha := ciSeedToml(e, ciClearTOML)
		m.reset()
		m.queueExec(execResp{output: "boom\n", exitCode: 1})            // first, fails
		m.queueExec(execResp{output: "rm: device busy\n", exitCode: 1}) // clear

		runID := ciTrigger(e, admin, sha, nil)
		if got := ciWaitForRun(e, runID); got != "failure" {
			t.Fatalf("status = %q", got)
		}
		second := ciStep(e, runID, "second")
		if second.Status != "failure" {
			t.Errorf("second status = %q", second.Status)
		}
		if !strings.Contains(second.Log, "Failed to reset") ||
			!strings.Contains(second.Log, "device busy") {
			t.Errorf("second log = %q", second.Log)
		}
	})

	t.Run("a clear step re-extracts the checkout", func(t *testing.T) {
		sha := ciSeedToml(e, ciClearTOML)
		m.reset()
		m.queueExec(execResp{output: "ok\n"}) // first
		m.queueExec(execResp{})               // clear: rm -rf
		m.queueExec(execResp{output: "hi\n"}) // second

		runID := ciTrigger(e, admin, sha, nil)
		if got := ciWaitForRun(e, runID); got != "success" {
			t.Fatalf("status = %q", got)
		}
		if n := len(m.uploadsInto(t, "/ci/build/project")); n != 2 {
			t.Errorf("uploads into the clone directory = %d, want 2", n)
		}
		if strings.Contains(m.allCommandText(), "git") {
			t.Errorf("commands = %v", m.commands())
		}
	})

	t.Run("clear removes and recreates the directory in one exec", func(t *testing.T) {
		// `rm -rf` can delete the container's WorkingDir. A second exec would
		// then fail to chdir before its command starts.
		sha := ciSeedToml(e, `
image = "debian:latest"
work_dir = "/ci/build"
clone_project_to = "/ci/build"

[on]
manual = true

[[steps]]
name = "first"
run_sh = "true"

[[steps]]
name = "second"
clear = true
run_sh = "echo hi"
`)
		m.reset()
		runID := ciTrigger(e, admin, sha, nil)
		if got := ciWaitForRun(e, runID); got != "success" {
			t.Fatalf("status = %q", got)
		}
		var removals []string
		for _, c := range m.commands() {
			if joined := strings.Join(c, " "); strings.Contains(joined, "rm -rf") {
				removals = append(removals, joined)
			}
		}
		if len(removals) != 1 {
			t.Fatalf("rm -rf execs = %v", removals)
		}
		if !strings.Contains(removals[0], "mkdir -p") {
			t.Errorf("removal exec = %q", removals[0])
		}
	})
}

// ── cache volumes ────────────────────────────────────────────────────────

const ciCacheTOML = `
image = "debian:latest"
cache = ["/ci/cache/target", "/ci/cache/registry"]

[on]
manual = true
push = ["main", "some-feature"]

[[steps]]
name = "hello"
run_sh = "echo hi"
`

func TestCICacheVolumes(t *testing.T) {
	e, m, admin := ciEnv(t)

	run := func(sha, branch string) int64 {
		var runID int64
		if branch == "main" {
			runID = ciTrigger(e, admin, sha, nil)
		} else {
			runID = ciPushRun(e, sha, branch)
		}
		ciWaitForRun(e, runID)
		return runID
	}

	t.Run("two cache paths sharing a prefix get distinct volumes", func(t *testing.T) {
		sha := ciSeedToml(e, ciCacheTOML)
		m.reset()
		run(sha, "main")

		vols := m.createdVolumes()
		if len(vols) != 2 {
			t.Fatalf("volumes = %v", vols)
		}
		if vols[0].name == vols[1].name {
			t.Error("both cache paths share one volume")
		}
		// The path is otherwise unrecoverable from a digest.
		got := []string{
			vols[0].labels["com.hearthforge.cache-path"],
			vols[1].labels["com.hearthforge.cache-path"],
		}
		if !eqStrings(got, []string{"/ci/cache/target", "/ci/cache/registry"}) {
			t.Errorf("cache-path labels = %v", got)
		}
	})

	t.Run("a volume the config no longer names is pruned", func(t *testing.T) {
		sha := ciSeedToml(e, ciCacheTOML)
		m.reset()
		m.setVolumesOnHost("hearthforge-ci-cache-leftover-from-an-old-config")

		run(sha, "main")

		if got := m.deletedVolumes(); !eqStrings(got,
			[]string{"hearthforge-ci-cache-leftover-from-an-old-config"}) {
			t.Errorf("deleted = %v", got)
		}
	})

	t.Run("volumes still in the config survive", func(t *testing.T) {
		sha := ciSeedToml(e, ciCacheTOML)
		m.reset()
		// Prime the host list with the names this config creates.
		run(sha, "main")
		var inUse []string
		for _, v := range m.createdVolumes() {
			inUse = append(inUse, v.name)
		}

		m.reset()
		m.setVolumesOnHost(inUse...)
		run(sha, "main")

		if got := m.deletedVolumes(); len(got) != 0 {
			t.Errorf("deleted = %v", got)
		}
	})

	t.Run("a run off the default branch prunes nothing", func(t *testing.T) {
		sha := ciSeedToml(e, ciCacheTOML)
		m.reset()
		m.setVolumesOnHost("hearthforge-ci-cache-belongs-to-the-default-branch")

		// The config is read per commit, so pruning from a feature branch
		// would delete the default branch's caches.
		run(sha, "some-feature")

		if got := m.deletedVolumes(); len(got) != 0 {
			t.Errorf("deleted = %v", got)
		}
	})
}

// ── cache size caps ──────────────────────────────────────────────────────

const ciCappedTOML = `
image = "debian:latest"
cache = [{ path = "/ci/cache/target", max_size = "1g" }, "/ci/cache/registry"]

[on]
manual = true

[[steps]]
name = "hello"
run_sh = "echo hi"
`

func TestCICacheSizeCaps(t *testing.T) {
	e, m, admin := ciEnv(t)

	run := func(sha string) int64 {
		runID := ciTrigger(e, admin, sha, nil)
		ciWaitForRun(e, runID)
		return runID
	}

	// names returns the volume names the config produces, in declaration
	// order.
	names := func(sha string) (string, string) {
		m.reset()
		run(sha)
		vols := m.createdVolumes()
		if len(vols) != 2 {
			t.Fatalf("volumes = %v", vols)
		}
		return vols[0].name, vols[1].name
	}

	const gib = int64(1024 * 1024 * 1024)

	t.Run("an oversized cache is dropped and reported on the run", func(t *testing.T) {
		sha := ciSeedToml(e, ciCappedTOML)
		target, registry := names(sha)

		m.reset()
		m.setVolumesOnHost(target, registry)
		m.setVolumeUsage(map[string]ciVolumeUsage{
			target:   {Size: 2 * gib},
			registry: {Size: 9 * gib},
		})
		runID := run(sha)

		// Only the capped one goes, however large the uncapped one grows.
		if got := m.deletedVolumes(); !eqStrings(got, []string{target}) {
			t.Fatalf("deleted = %v", got)
		}
		log := ciStep(e, runID, "cache").Log
		if !strings.Contains(log, "/ci/cache/target") || !strings.Contains(log, "2.0G") {
			t.Errorf("cache step log = %q", log)
		}
	})

	t.Run("a cache under its cap survives", func(t *testing.T) {
		sha := ciSeedToml(e, ciCappedTOML)
		target, registry := names(sha)

		m.reset()
		m.setVolumesOnHost(target, registry)
		m.setVolumeUsage(map[string]ciVolumeUsage{target: {Size: 100}})
		run(sha)

		if got := m.deletedVolumes(); len(got) != 0 {
			t.Errorf("deleted = %v", got)
		}
	})

	t.Run("a cache a concurrent run holds is left alone", func(t *testing.T) {
		sha := ciSeedToml(e, ciCappedTOML)
		target, registry := names(sha)

		m.reset()
		m.setVolumesOnHost(target, registry)
		m.setVolumeUsage(map[string]ciVolumeUsage{target: {Size: 9 * gib, RefCount: 1}})
		run(sha)

		if got := m.deletedVolumes(); len(got) != 0 {
			t.Errorf("deleted = %v", got)
		}
	})

	t.Run("an unmeasured cache is never dropped", func(t *testing.T) {
		sha := ciSeedToml(e, ciCappedTOML)
		target, registry := names(sha)

		m.reset()
		m.setVolumesOnHost(target, registry)
		// Docker reports -1 for a size it has not computed.
		m.setVolumeUsage(map[string]ciVolumeUsage{target: {Size: -1}})
		runID := run(sha)

		if got := m.deletedVolumes(); len(got) != 0 {
			t.Errorf("deleted = %v", got)
		}
		if steps := ciSteps(e, runID, "cache"); len(steps) != 0 {
			t.Errorf("cache step = %v", steps)
		}
	})
}

// ── host-built archives ─────────────────────────────────────────────────

const ciArchiveTOML = `
image = "debian:latest"
work_dir = "/ci"

[on]
manual = true

[[steps]]
name = "build"
run_sh = "echo building"
publish_tar = ["/ci/dist"]
publish_gzip = ["/ci/dist"]
publish_zstd = ["/ci/dist"]
publish_zip = ["/ci/dist"]
`

// TestCIArchivesBuiltOnHost checks that publish_* archives are built from
// the engine's tar stream. The mock runs no tar, gzip, zstd or zip, so any
// exec for them would fail the test.
func TestCIArchivesBuiltOnHost(t *testing.T) {
	e, m, admin := ciEnv(t)
	m.queueExec(execResp{output: "building\n"})
	sha := ciSeedToml(e, ciArchiveTOML)
	runID := ciTrigger(e, admin, sha, nil)
	if got := ciWaitForRun(e, runID); got != "success" {
		t.Fatalf("status = %q", got)
	}
	for _, c := range m.commands() {
		if len(c) > 0 && (c[0] == "tar" || c[0] == "zip") {
			t.Errorf("archive tool run in the container: %v", c)
		}
	}

	artifacts := map[string]int64{}
	rows, err := e.DB.QueryContext(context.Background(),
		`SELECT id, filename FROM ci_artifacts WHERE run_id = ?`, runID)
	if err != nil {
		t.Fatal(err)
	}
	for rows.Next() {
		var id int64
		var name string
		if err := rows.Scan(&id, &name); err != nil {
			t.Fatal(err)
		}
		artifacts[name] = id
	}
	rows.Close()
	if len(artifacts) != 4 {
		t.Fatalf("artifacts = %v", artifacts)
	}
	download := func(name string) []byte {
		t.Helper()
		id, ok := artifacts[name]
		if !ok {
			t.Fatalf("artifact %s missing from %v", name, artifacts)
		}
		return admin.get(ciRunPath(runID) + "/artifacts/" + strconv.FormatInt(id, 10)).mustStatus(200).Body
	}
	// The mock answers every archive request with one file "dist" holding
	// artifact-content-123.
	checkTar := func(name string, r io.Reader) {
		t.Helper()
		tr := tar.NewReader(r)
		h, err := tr.Next()
		if err != nil || h.Name != "dist" {
			t.Fatalf("%s: first entry %v, err %v", name, h, err)
		}
		data, _ := io.ReadAll(tr)
		if string(data) != "artifact-content-123" {
			t.Errorf("%s: content = %q", name, data)
		}
	}

	t.Run("tar", func(t *testing.T) {
		checkTar("dist.tar", bytes.NewReader(download("dist.tar")))
	})
	t.Run("gzip", func(t *testing.T) {
		gz, err := gzip.NewReader(bytes.NewReader(download("dist.tar.gz")))
		if err != nil {
			t.Fatal(err)
		}
		checkTar("dist.tar.gz", gz)
	})
	t.Run("zstd", func(t *testing.T) {
		dec, err := zstd.NewReader(bytes.NewReader(download("dist.tar.zst")))
		if err != nil {
			t.Fatal(err)
		}
		defer dec.Close()
		checkTar("dist.tar.zst", dec)
	})
	t.Run("zip", func(t *testing.T) {
		data := download("dist.zip")
		zr, err := zip.NewReader(bytes.NewReader(data), int64(len(data)))
		if err != nil {
			t.Fatal(err)
		}
		if len(zr.File) != 1 || zr.File[0].Name != "dist" {
			t.Fatalf("zip entries = %v", zr.File)
		}
		f, _ := zr.File[0].Open()
		body, _ := io.ReadAll(f)
		if string(body) != "artifact-content-123" {
			t.Errorf("zip content = %q", body)
		}
	})
}