name: Build check (reusable)

# `docker build` + in-image test check for ONE app domain, reused via
# `uses:` by pr-build.yml and the deploy-dev workflows -- the monorepo port of
# each app repo's build.yml. Still deliberately NOT a live boot+healthz check:
# that was tried in the split repos and repeatedly hit this runner's own
# environment quirks (bridge-IP reachability, non-unique $$, squatted host
# ports) without ever going reliably green. Image boot is verified by hand
# instead (docker run + alembic + /healthz 200 + a real /api/v2/place 200).
#
# Monorepo port: the domain (backend|frontend) arrives as a workflow_call
# input, and the build CONTEXT is that domain's subdirectory -- so each
# Dockerfile sees exactly the tree it saw when its domain was a repo root,
# byte-for-byte the same build as the split era.

on:
  workflow_call:
    inputs:
      domain:
        description: "App domain to build: backend | frontend"
        required: true
        type: string

jobs:
  build:
    runs-on: docker
    steps:
      - uses: actions/checkout@v4

      - name: Install Docker CLI
        run: |
          apt-get update -qq
          apt-get install -y -qq docker.io

      - name: Build
        run: docker build -t thermograph-${{ inputs.domain }}:ci ${{ inputs.domain }}/

      # Run the hermetic test tier INSIDE the image we just built (each image
      # ships tests/ + every runtime dep via COPY . /app/): the exact
      # interpreter/deps that ship, none of the runner-environment quirks that
      # sank the old host-side boot check. Backend runs its full (hermetic)
      # suite; frontend runs only its unit tier -- its integration tier
      # (frontend/tests/integration/, needs a live backend container) stays a
      # local `make`/scripts concern, see frontend/scripts/backend-for-tests.sh.
      # requirements-dev only layers pytest on top, so the install is tiny.
      # -u 0: the images' default user can't write to site-packages.
      # --entrypoint sh: backend's entrypoint is alembic-migrate + uvicorn --
      # without the override the test command is swallowed as entrypoint args
      # and the container just boots the server forever (harmless no-op for
      # frontend, which has no entrypoint). unset THERMOGRAPH_BASE: the images
      # bake the prod root-mount (/), which moves every route off the
      # /thermograph prefix the tests are written against.
      - name: Run tests in the built image
        run: |
          target=tests
          if [ "${{ inputs.domain }}" = "frontend" ]; then target=tests/unit; fi
          docker run --rm -u 0 --entrypoint sh thermograph-${{ inputs.domain }}:ci \
            -c "unset THERMOGRAPH_BASE; pip install -q --no-cache-dir pytest==8.4.1 && python -m pytest $target -q"