name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

# Self-hosted runner — see docs/runbooks/ci.md for the runner setup.
# `uses:` are absolute, tag-pinned URLs (CLAUDE.md §8.7 / §15).

# Each job calls a `make` target — the same one developers run locally
# (`make ci`). The Makefile is the single source of truth; see docs/runbooks/ci.md.

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: https://github.com/actions/checkout@v4
      - uses: https://github.com/actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'
      - run: make lint

  build:
    runs-on: ubuntu-latest
    steps:
      - uses: https://github.com/actions/checkout@v4
      - uses: https://github.com/actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'
      - run: make build

  unit:
    runs-on: ubuntu-latest
    steps:
      - uses: https://github.com/actions/checkout@v4
      - uses: https://github.com/actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'
      - run: make unit

  mutation:
    runs-on: ubuntu-latest
    steps:
      - uses: https://github.com/actions/checkout@v4
      - uses: https://github.com/actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'
      - run: make mutation
      # Publish the Stryker HTML report. `if: always()` uploads it even when the
      # ratchet fails — that is exactly when you want to inspect the survivors.
      # Glob handles Stryker's non-deterministic StrykerOutput/<timestamp>/ dir.
      # Pinned to @v3 deliberately: @v4 refuses to run on Gitea (GHES guard) —
      # see docs/runbooks/gitea-actions-gotchas.md §4.
      - uses: https://github.com/actions/upload-artifact@v3
        if: always()
        with:
          name: acl-mutation-report
          path: services/acl/StrykerOutput/**/reports/mutation-report.html
          if-no-files-found: warn

  compose-smoke:
    runs-on: ubuntu-latest
    steps:
      - uses: https://github.com/actions/checkout@v4
      - run: make smoke
      - name: dump container logs on failure
        if: failure()
        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=80 oz-init openzaak nrc-init nrc-web flowable-init keycloak acl bff 2>&1 || true
      - name: tear down on failure
        if: failure()
        run: docker compose -f infra/docker-compose.yml down --volumes 2>&1 || true