name: Verify Frame Flow
on:
  push:
  pull_request:
  workflow_dispatch:
    inputs:
      deploy_action:
        description: Production action (deploy requires explicit enabled Variable)
        type: choice
        options: [plan, bootstrap, deploy, rollback]
        default: plan
jobs:
  verify:
    # The NAS Docker runner must never execute code from external forks.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    env:
      DOCKER_PIP_INDEX_URL: ${{ vars.DOCKER_PIP_INDEX_URL }}
      DOCKER_PIP_FALLBACK_INDEX_URL: ${{ vars.DOCKER_PIP_FALLBACK_INDEX_URL }}
      CI_PIP_INDEX_URL: ${{ vars.CI_PIP_INDEX_URL }}
      CI_PIP_FALLBACK_INDEX_URL: ${{ vars.CI_PIP_FALLBACK_INDEX_URL }}
      DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }}
      DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }}
    steps:
      - uses: https://tea.pigway.com/way/frame-flow-ci-actions/checkout@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v4
      - uses: https://tea.pigway.com/way/frame-flow-ci-actions/setup-python@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v5
        with:
          python-version: '3.14'
      - name: Install CI dependencies with index diagnostics and fallback
        run: python scripts/ci-install.py
      - run: python -m ruff check pigway_frame_flow tests scripts
      - run: python -m ruff format --check pigway_frame_flow tests scripts
      - run: python -m mypy pigway_frame_flow
      - run: python -m pytest -q
      - name: Complete vulnerability audit with bounded network retries
        run: python scripts/ci-audit.py
      - name: Isolated Docker build, smoke and restart verification
        run: |
          . ./deploy/build-cn.env
          python scripts/ci-compose-verify.py
      - name: Cleanup isolated Docker resources
        if: always()
        run: |
          if [ -n "${FRAME_FLOW_CI_COMPOSE:-}" ] && [ -f "$FRAME_FLOW_CI_COMPOSE" ]; then
            python scripts/ci-compose-verify.py --cleanup
          fi

  deploy:
    needs: verify
    if: success() && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
    runs-on: ubuntu-latest
    concurrency:
      group: frame-flow-production
      cancel-in-progress: false
    env:
      CD_ACTION: ${{ github.event.inputs.deploy_action }}
      PROD_DEPLOY_ENABLED: ${{ vars.PROD_DEPLOY_ENABLED }}
      PROD_PROJECT: ${{ vars.PROD_PROJECT }}
      PROD_CONTAINER: ${{ vars.PROD_CONTAINER }}
      PROD_IMAGE_REPO: ${{ vars.PROD_IMAGE_REPO }}
      PROD_DATA_DIR: ${{ secrets.PROD_DATA_DIR }}
      PROD_CONFIG_DIR: ${{ secrets.PROD_CONFIG_DIR }}
      PROD_PHOTOS_DIR: ${{ secrets.PROD_PHOTOS_DIR }}
      SYNOLOGY_PHOTOS_URL: ${{ secrets.SYNOLOGY_PHOTOS_URL }}
      SYNOLOGY_PHOTOS_CERT_SHA256: ${{ secrets.SYNOLOGY_PHOTOS_CERT_SHA256 }}
      PROD_WEB_BIND: ${{ secrets.PROD_WEB_BIND }}
      PROD_WEB_PORT: ${{ vars.PROD_WEB_PORT }}
      PROD_STATE_VOLUME: ${{ vars.PROD_STATE_VOLUME }}
      PROD_MOCK: ${{ vars.PROD_MOCK }}
      PROD_WRITE_ENABLED: ${{ vars.PROD_WRITE_ENABLED }}
      DOCKER_PIP_INDEX_URL: ${{ vars.DOCKER_PIP_INDEX_URL }}
      DOCKER_PIP_FALLBACK_INDEX_URL: ${{ vars.DOCKER_PIP_FALLBACK_INDEX_URL }}
      CI_PIP_INDEX_URL: ${{ vars.CI_PIP_INDEX_URL }}
      CI_PIP_FALLBACK_INDEX_URL: ${{ vars.CI_PIP_FALLBACK_INDEX_URL }}
      DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }}
      DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }}
    steps:
      - uses: https://tea.pigway.com/way/frame-flow-ci-actions/checkout@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v4
      - uses: https://tea.pigway.com/way/frame-flow-ci-actions/setup-python@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v5
        with:
          python-version: '3.14'
      - name: Install deploy tooling
        run: python scripts/ci-install.py
      - name: Plan or deploy production (default is plan)
        env:
          PRODUCTION_ENV: ${{ secrets.PRODUCTION_ENV }}
        run: |
          . ./deploy/build-cn.env
          python scripts/production-deploy.py
      - name: Recover interrupted production deployment
        if: always()
        env:
          CD_ACTION: recover
        run: |
          if [ -n "${FRAME_FLOW_DEPLOY_OWNER:-}" ]; then
            python scripts/production-deploy.py
          fi