name: Tests

on:
  push:
    branches: [ main, master, develop ]
  pull_request:
    branches: [ main, master, develop ]

jobs:
  unit:
    name: Unit Tests
    runs-on: ubuntu-latest
    # Host-mode gitea runner (label `ubuntu-latest:host`) uses the host PHP
    # toolchain (currently 8.3). `shivammathur/setup-php` cannot provision
    # alternate PHP versions in host mode, so there is no 8.1/8.2/8.3 matrix.
    # (Restore one if the runner ever moves to container mode.)

    steps:
      - uses: actions/checkout@v4

      - name: Install dependencies
        run: composer install --no-interaction --prefer-dist

      - name: Run unit tests
        run: php vendor/bin/phpunit --configuration phpunit.xml --testdox

  integration:
    name: Integration Tests
    runs-on: ubuntu-latest
    # Host-mode runner: service containers are NOT started, so connect to the
    # host MariaDB at 127.0.0.1:3306 directly. The password comes from the repo
    # secret TMDO_TEST_DB_PASS (test DB `wp_wpdo_test` and user `dbo` already
    # exist on the host). The bootstrap also accepts the legacy WPDO_TEST_DB_*
    # names, so an existing secret of either name works.

    steps:
      - uses: actions/checkout@v4

      - name: Install dependencies
        run: composer install --no-interaction --prefer-dist

      # Preflight: a DB outage or a rotated secret would otherwise surface as an
      # opaque PHPUnit bootstrap error. Fail fast with an INFRA-vs-test
      # distinction so a red integration job is diagnosable.
      - name: DB preflight (host MariaDB reachable?)
        env:
          TMDO_TEST_DB_HOST: 127.0.0.1
          TMDO_TEST_DB_USER: dbo
          TMDO_TEST_DB_PASS: ${{ secrets.TMDO_TEST_DB_PASS }}
          TMDO_TEST_DB_NAME: wp_wpdo_test
        run: |
          php -r '
            mysqli_report(MYSQLI_REPORT_OFF);
            $c = @mysqli_connect(getenv("TMDO_TEST_DB_HOST"), getenv("TMDO_TEST_DB_USER"), getenv("TMDO_TEST_DB_PASS"), getenv("TMDO_TEST_DB_NAME"), 3306);
            if (!$c) {
                fwrite(STDERR, "::error::Integration DB unreachable at " . getenv("TMDO_TEST_DB_HOST") . ":3306 db=" . getenv("TMDO_TEST_DB_NAME") . " user=" . getenv("TMDO_TEST_DB_USER") . " — host MariaDB down or TMDO_TEST_DB_PASS secret stale/rotated. This is an INFRA failure, not a test failure: " . mysqli_connect_error() . "\n");
                exit(1);
            }
            echo "DB preflight OK: connected to " . getenv("TMDO_TEST_DB_NAME") . " on " . getenv("TMDO_TEST_DB_HOST") . "\n";
          '

      - name: Run integration tests
        env:
          TMDO_TEST_DB_HOST: 127.0.0.1
          TMDO_TEST_DB_USER: dbo
          TMDO_TEST_DB_PASS: ${{ secrets.TMDO_TEST_DB_PASS }}
          TMDO_TEST_DB_NAME: wp_wpdo_test
        run: php vendor/bin/phpunit --configuration phpunit-integration.xml --testdox

  lint:
    name: PHP Lint
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Check PHP syntax
        run: |
          find . -name "*.php" \
            ! -path "./vendor/*" \
            ! -path "./tests/*" \
            -print0 | xargs -0 -n1 php -l
          echo "PHP syntax OK"

  phpcs:
    name: PHPCS
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Install dependencies
        run: composer install --no-interaction --prefer-dist

      - name: Run PHPCS
        run: vendor/bin/phpcs --standard=phpcs.xml --report=checkstyle -q .

  phpstan:
    name: PHPStan
    runs-on: ubuntu-latest
    # A never ran static analysis in CI; the baseline is committed, so new code
    # is checked at level 6 while existing debt stays silent.

    steps:
      - uses: actions/checkout@v4

      - name: Install dependencies
        run: composer install --no-interaction --prefer-dist

      - name: Run PHPStan (level 6, baselined)
        run: vendor/bin/phpstan analyse --no-progress --error-format=github