name: Build check

# Proves the split Dockerfile actually builds (repo-split Stage 7b) -- NOT a
# live boot+healthz check anymore. That was tried and repeatedly hit this
# specific runner's own environment quirks (a sibling container's bridge IP
# is unreachable from the job container; $$ isn't unique across job
# containers; a fixed host port gets permanently squatted by a leftover
# the AppArmor bug won't let anything remove; boot time varies a lot under
# the runner's shared capacity=2 contention) without ever settling into a
# reliably green check. The image DOES boot correctly standalone --
# independently verified by hand: `docker run` + real alembic migrations +
# `/healthz` returning 200 + a real `/api/v2/place` 200. The full pytest
# suite DOES run here now -- inside the built image (see the test step below),
# which sidesteps those runner quirks entirely.

on:
  # Reusable (uses: ./.forgejo/workflows/build.yml) by pr-build.yml and
  # deploy-dev.yml for the dev-branch flow, AND still directly triggered on
  # push/PR to main (unchanged pre-existing behavior) plus dev (new -- so a
  # direct push to dev or a PR into dev gets this same check without relying
  # solely on the reusable call from the other two files).
  workflow_call: {}
  push:
    branches: [main, dev]
  pull_request:
    branches: [main, dev]

jobs:
  build:
    runs-on: docker
    steps:
      - uses: actions/checkout@v4

      - name: Install Docker CLI
        run: |
          apt-get update -qq
          apt-get install -y -qq docker.io

      - name: Build
        run: docker build -t thermograph-backend:ci .

      # The suite is hermetic (sqlite/tmpdir; no network), and the image already
      # contains tests/ + every runtime dep (COPY . /app/), so run pytest INSIDE
      # the image we just built: the exact interpreter/deps that ship, none of
      # the runner-environment quirks that sank the old host-side boot check.
      # requirements-dev.txt only layers pytest on top, so the install is tiny.
      # -u 0: the image's default user can't write to site-packages.
      # --entrypoint sh: the image's entrypoint is alembic-migrate + uvicorn;
      # without the override the test command is swallowed as entrypoint args
      # and the container just boots the server forever. unset THERMOGRAPH_BASE:
      # the image bakes the prod root-mount (/), which moves every route off the
      # /thermograph prefix the tests are written against -- requests would fall
      # through to the frontend-proxy catch-all and fail with ConnectError.
      - name: Run tests in the built image
        run: |
          docker run --rm -u 0 --entrypoint sh thermograph-backend:ci \
            -c "unset THERMOGRAPH_BASE; pip install -q --no-cache-dir pytest==8.4.1 && python -m pytest tests -q"