# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1

name: Backend

on:
  push:
    branches: [main]
    paths:
      - "apps/api/**"
      - "apps/api-tests/**"
      - "Directory.Build.props"
      - "Progmaweb.slnx"
      - "docs/api/**"
      - ".config/dotnet-tools.json"
      - ".github/workflows/backend.yml"
  pull_request:
    paths:
      - "apps/api/**"
      - "apps/api-tests/**"
      - "Directory.Build.props"
      - "Progmaweb.slnx"
      - "docs/api/**"
      - ".config/dotnet-tools.json"
      - ".github/workflows/backend.yml"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: backend-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # The PostgreSQL account store is tested against a real server of the major version production runs. The
    # container lives for this job only and accepts local connections without a password, so the workflow holds
    # no credential. Without the variable below the database tests would be skipped; a test fails the run then.
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_HOST_AUTH_METHOD: trust
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready --username postgres"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 20
    env:
      PROGMAWEB_TEST_POSTGRES: Host=127.0.0.1;Port=5432;Database=postgres;Username=postgres
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
        with:
          dotnet-version: 10.0.x
          cache: true
          cache-dependency-path: "**/*.csproj"
      - run: dotnet restore Progmaweb.slnx --locked-mode
      - run: dotnet build Progmaweb.slnx --configuration Release --no-restore
      - run: dotnet test --project apps/api-tests/Progmaweb.Api.Tests.csproj --configuration Release --no-build --coverlet --coverlet-output-format cobertura

      # Documentation gate. DocFX reads the API project and builds the
      # reference; an unresolved reference or a broken link is an error. The
      # coverage check then fails when a namespace, type or member of the
      # reference has no description, which DocFX itself does not report.
      - run: dotnet tool restore
      - run: dotnet docfx docs/api/docfx.json --warningsAsErrors
      - run: dotnet run docs/api/CheckDocumentation.cs -- docs/api

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: progmaweb-backend-coverage
          path: TestResults/coverage.cobertura.xml
          if-no-files-found: error
          retention-days: 1

  upload-coverage:
    needs: verify
    # Fork PR code is untrusted and must never receive an OIDC-capable job.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: progmaweb-backend-coverage
          path: coverage
      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          use_oidc: true
          files: coverage/coverage.cobertura.xml
          flags: progmaweb-backend
          fail_ci_if_error: true