ci.yml

name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always
  AETHER_DASHBOARD_BUILD: ${{ github.run_id }}-${{ github.sha }}

jobs:
  dashboard:
    name: Dashboard build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: web/dashboard/package-lock.json
      - name: Build embedded dashboard
        working-directory: web/dashboard
        run: |
          npm ci
          npm run check:hex-surfaces
          npm run test
          npm run validate:schema
          AETHER_DASHBOARD_BUILD="${{ env.AETHER_DASHBOARD_BUILD }}" npm run build
      - uses: actions/upload-artifact@v4
        with:
          name: dashboard-dist
          path: web/dashboard/dist
          retention-days: 3

  test:
    name: Test
    runs-on: ubuntu-latest
    needs: dashboard
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: dashboard-dist
          path: web/dashboard/dist
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: web/dashboard/package-lock.json
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - name: Validate example specs
        run: |
          for f in examples/demo-webserver.yaml examples/workload-full-featured.yaml examples/workload-k8s-advanced.yaml examples/labs/kubevirt/workload.yaml examples/labs/kubernetes/workload.yaml; do
            cargo run --quiet -- --spec "$f" validate
          done
          chmod +x scripts/validate-schema-examples.sh
          AETHER_BIN=./target/debug/aether scripts/validate-schema-examples.sh
      - name: Run tests
        env:
          AETHER_DASHBOARD_BUILD: ${{ env.AETHER_DASHBOARD_BUILD }}
        run: cargo test --verbose
      - name: Check formatting
        run: cargo fmt -- --check
      - name: Run clippy
        env:
          AETHER_DASHBOARD_BUILD: ${{ env.AETHER_DASHBOARD_BUILD }}
        run: cargo clippy --all-targets --all-features -- -D warnings

  build:
    name: Build
    runs-on: ${{ matrix.os }}
    needs: dashboard
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: macos-latest
            target: x86_64-apple-darwin
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: dashboard-dist
          path: web/dashboard/dist
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          target: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2
      - name: Build
        env:
          AETHER_DASHBOARD_BUILD: ${{ env.AETHER_DASHBOARD_BUILD }}
        run: cargo build --release --target ${{ matrix.target }}
      - uses: actions/upload-artifact@v4
        with:
          name: aether-${{ matrix.target }}
          path: target/${{ matrix.target }}/release/aether

  labs-e2e:
    name: Labs validate & dry-run
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Build aether
        run: cargo build --release
      - name: KubeVirt labs
        run: chmod +x scripts/labs-e2e.sh && AETHER_BIN=./target/release/aether scripts/labs-e2e.sh

  migration-dry-run-e2e:
    name: Migration dry-run E2E
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Build aether
        run: cargo build --release
      - name: Demo migration validate + dry-run
        run: chmod +x scripts/migration-dry-run-e2e.sh && AETHER_BIN=./target/release/aether scripts/migration-dry-run-e2e.sh

  k8s-live-e2e:
    name: Kubernetes live E2E (kind)
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Build aether
        run: cargo build --release
      - name: Create kind cluster and run live lab
        run: |
          curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.26.0/kind-linux-amd64
          chmod +x ./kind
          sudo mv ./kind /usr/local/bin/kind
          chmod +x scripts/k8s-labs-e2e.sh
          AETHER_BIN=./target/release/aether \
            AETHER_LABS_LIVE=1 \
            AETHER_K8S_KIND_SETUP=1 \
            scripts/k8s-labs-e2e.sh

  reference-cluster-live:
    name: Reference cluster live (optional)
    runs-on: ubuntu-latest
    continue-on-error: true
    needs: test
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Build aether
        run: cargo build --release
      - name: Live KubeVirt smoke when kubeconfig is configured
        run: |
          chmod +x scripts/labs-live-smoke.sh
          if [ -n "${KUBECONFIG:-}" ] || [ -f "${HOME}/.kube/config" ]; then
            AETHER_BIN=./target/release/aether AETHER_LABS_LIVE=1 scripts/labs-live-smoke.sh
          else
            echo "Skipping live reference cluster (no kubeconfig in CI runner)"
          fi

  dashboard-e2e:
    name: Dashboard E2E
    runs-on: ubuntu-latest
    needs: [dashboard, test]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: dashboard-dist
          path: web/dashboard/dist
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: web/dashboard/package-lock.json
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Build aether binary
        env:
          AETHER_DASHBOARD_BUILD: ${{ env.AETHER_DASHBOARD_BUILD }}
        run: cargo build --release
      - name: Install Playwright
        working-directory: web/dashboard
        run: |
          npm ci
          npx playwright install chromium --with-deps
      - name: Run observability API smoke
        run: |
          chmod +x scripts/k8s-api-smoke.sh
          ../../target/release/aether serve --host 127.0.0.1 --port 5090 &
          SERVER_PID=$!
          for i in $(seq 1 30); do curl -sf http://127.0.0.1:5090/health && break; sleep 1; done
          AETHER_API=http://127.0.0.1:5090 scripts/k8s-api-smoke.sh
          kill $SERVER_PID || true
      - name: Reference cluster E2E (offline)
        run: |
          chmod +x scripts/reference-cluster-e2e.sh scripts/labs-e2e.sh
          AETHER_BIN=./target/release/aether scripts/reference-cluster-e2e.sh
      - name: Run Playwright smoke
        working-directory: web/dashboard
        env:
          AETHER_E2E_SKIP_SERVER: "1"
          AETHER_E2E_BASE_URL: http://127.0.0.1:5090
        run: |
          ../../target/release/aether serve --host 127.0.0.1 --port 5090 &
          SERVER_PID=$!
          for i in $(seq 1 30); do curl -sf http://127.0.0.1:5090/health && break; sleep 1; done
          npm run test:e2e
          kill $SERVER_PID || true
      - name: Run Playwright mock IdP auth
        working-directory: web/dashboard
        env:
          AETHER_E2E_SKIP_SERVER: "1"
          AETHER_E2E_BASE_URL: http://127.0.0.1:5090
          AETHER_MOCK_IDP: "1"
        run: |
          AETHER_MOCK_IDP=1 AETHER_SESSION_SECRET=mock-idp-dev-session-key-32chars \
            ../../target/release/aether serve --host 127.0.0.1 --port 5090 &
          SERVER_PID=$!
          for i in $(seq 1 30); do curl -sf http://127.0.0.1:5090/health && break; sleep 1; done
          npm run test:e2e -- tests/mock-idp-auth.spec.ts
          kill $SERVER_PID || true
      - name: Run Playwright phases 2131–2180 (mock IdP)
        working-directory: web/dashboard
        env:
          AETHER_E2E_SKIP_SERVER: "1"
          AETHER_E2E_BASE_URL: http://127.0.0.1:5090
          AETHER_MOCK_IDP: "1"
        run: |
          AETHER_MOCK_IDP=1 AETHER_SESSION_SECRET=mock-idp-dev-session-key-32chars \
            ../../target/release/aether serve --host 127.0.0.1 --port 5090 &
          SERVER_PID=$!
          for i in $(seq 1 30); do curl -sf http://127.0.0.1:5090/health && break; sleep 1; done
          npm run test:e2e -- tests/phases-2131-2180-features.spec.ts
          kill $SERVER_PID || true
      - name: Run Playwright phases 2181–2230 (mock IdP)
        working-directory: web/dashboard
        env:
          AETHER_E2E_SKIP_SERVER: "1"
          AETHER_E2E_BASE_URL: http://127.0.0.1:5090
          AETHER_MOCK_IDP: "1"
        run: |
          AETHER_MOCK_IDP=1 AETHER_SESSION_SECRET=mock-idp-dev-session-key-32chars \
            ../../target/release/aether serve --host 127.0.0.1 --port 5090 &
          SERVER_PID=$!
          for i in $(seq 1 30); do curl -sf http://127.0.0.1:5090/health && break; sleep 1; done
          npm run test:e2e -- tests/phases-2181-2230-features.spec.ts
          kill $SERVER_PID || true
      - name: Run Playwright identity SSO (mock IdP)
        working-directory: web/dashboard
        env:
          AETHER_E2E_SKIP_SERVER: "1"
          AETHER_E2E_BASE_URL: http://127.0.0.1:5090
          AETHER_MOCK_IDP: "1"
        run: |
          AETHER_MOCK_IDP=1 AETHER_SESSION_SECRET=mock-idp-dev-session-key-32chars \
            ../../target/release/aether serve --host 127.0.0.1 --port 5090 &
          SERVER_PID=$!
          for i in $(seq 1 30); do curl -sf http://127.0.0.1:5090/health && break; sleep 1; done
          npm run test:e2e -- tests/identity-sso.spec.ts
          kill $SERVER_PID || true
      - name: Run Playwright phases 2231–2280
        working-directory: web/dashboard
        env:
          AETHER_E2E_SKIP_SERVER: "1"
          AETHER_E2E_BASE_URL: http://127.0.0.1:5090
        run: |
          ../../target/release/aether serve --host 127.0.0.1 --port 5090 &
          SERVER_PID=$!
          for i in $(seq 1 30); do curl -sf http://127.0.0.1:5090/health && break; sleep 1; done
          npm run test:e2e -- tests/phases-2231-2280-features.spec.ts
          kill $SERVER_PID || true
      - name: Run Playwright phases 2281–2330
        working-directory: web/dashboard
        env:
          AETHER_E2E_SKIP_SERVER: "1"
          AETHER_E2E_BASE_URL: http://127.0.0.1:5090
        run: |
          ../../target/release/aether serve --host 127.0.0.1 --port 5090 &
          SERVER_PID=$!
          for i in $(seq 1 30); do curl -sf http://127.0.0.1:5090/health && break; sleep 1; done
          npm run test:e2e -- tests/phases-2281-2330-features.spec.ts
          kill $SERVER_PID || true

  dashboard-exec-e2e:
    name: Dashboard exec E2E (kind)
    runs-on: ubuntu-latest
    continue-on-error: true
    needs: [dashboard, test]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: dashboard-dist
          path: web/dashboard/dist
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: web/dashboard/package-lock.json
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Install kind
        run: |
          curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.26.0/kind-linux-amd64
          chmod +x ./kind
          sudo mv ./kind /usr/local/bin/kind
      - name: Kind Playwright fixture
        env:
          AETHER_E2E_KIND: "1"
        run: |
          chmod +x scripts/kind-playwright-fixture.sh
          scripts/kind-playwright-fixture.sh
      - name: Build aether
        env:
          AETHER_DASHBOARD_BUILD: ${{ env.AETHER_DASHBOARD_BUILD }}
        run: cargo build --release
      - name: Run cluster exec + port-forward Playwright tests
        working-directory: web/dashboard
        env:
          AETHER_E2E_SKIP_SERVER: "1"
          AETHER_E2E_BASE_URL: http://127.0.0.1:5090
          AETHER_E2E_KIND: "1"
        run: |
          npm ci
          npx playwright install chromium --with-deps
          ../../target/release/aether serve --host 127.0.0.1 --port 5090 &
          SERVER_PID=$!
          for i in $(seq 1 30); do curl -sf http://127.0.0.1:5090/health && break; sleep 1; done
          npm run test:e2e -- tests/cluster-exec-terminal.spec.ts
          kill $SERVER_PID || true

  staging-e2e:
    name: Staging E2E (optional)
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch'
    needs: [test]
    steps:
      - uses: actions/checkout@v4
      - name: Run smoke tier on staging host
        env:
          AETHER_STAGING_HOST: ${{ secrets.AETHER_STAGING_HOST }}
          AETHER_REMOTE_USER: ${{ secrets.AETHER_REMOTE_USER }}
        run: |
          set -euo pipefail
          if [ -z "${AETHER_STAGING_HOST:-}" ]; then
            echo "::notice::AETHER_STAGING_HOST secret not set — skipping staging E2E."
            exit 0
          fi
          USER="${AETHER_REMOTE_USER:-sus}"
          chmod +x scripts/test-all-features-remote.sh scripts/post-deploy-verify.sh \
            scripts/lib/post-deploy-auth.sh
          AETHER_TEST_TIERS=smoke ./scripts/test-all-features-remote.sh "${AETHER_STAGING_HOST}" "${USER}"

  coverage:
    name: Code Coverage
    runs-on: ubuntu-latest
    needs: dashboard
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: dashboard-dist
          path: web/dashboard/dist
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Install tarpaulin
        run: cargo install cargo-tarpaulin
      - name: Generate coverage
        env:
          AETHER_DASHBOARD_BUILD: ${{ env.AETHER_DASHBOARD_BUILD }}
        run: cargo tarpaulin --verbose --all-features --workspace --timeout 120 --out Xml
      - uses: codecov/codecov-action@v4
        with:
          files: ./cobertura.xml
          fail_ci_if_error: false

  security:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-audit
        run: cargo install cargo-audit
      - name: Run security audit
        run: cargo audit