name: Verify container release contracts

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  verify:
    runs-on: ubuntu-latest
    services:
      timescaledb:
        image: timescale/timescaledb@sha256:252a443e2936039b83dd8da1373d01e59e932d1054fa6adf1bc061f1d56ae60a
        env:
          POSTGRES_DB: portfolio_hub
          POSTGRES_USER: portfolio_hub_user
          POSTGRES_PASSWORD: change-me
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U portfolio_hub_user -d portfolio_hub"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 12
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.11"
      - run: python -m pip install "uv==0.11.14"
      - run: uv sync --extra dev --locked
      - run: uv run python -m pytest -q
      - name: Verify corporate-action atomicity and guarded recovery in PostgreSQL
        env:
          POSTGRES_PASSWORD: change-me
        run: |
          export PORTFOLIOHUB_TEST_POSTGRES_DSN="postgresql://portfolio_hub_user:${POSTGRES_PASSWORD}@127.0.0.1:5432/postgres"
          uv run python -m pytest -q tests/test_corporate_action_atomic_recovery_postgres.py tests/test_service_token_rename_postgres.py
      - name: Honest scoped lint for release additions
        run: uv run ruff check --select F,I app/db/migrations.py scripts/image_release.py scripts/ruff_ratchet.py tests/release
      - name: Reject Ruff findings introduced by v0.3.0 or later patches
        run: |
          uv run python scripts/ruff_ratchet.py --base v0.2.1
          uv run python scripts/ruff_ratchet.py --base v0.3.0
          uv run python scripts/ruff_ratchet.py --base v0.3.1
      - name: Validate container contracts without registry writes
        run: uv run python -m pytest -q tests/release
      - name: Build and smoke exact pull-request or main source image
        run: |
          uv run python -c 'from app.db.migrations import migration_inventory; print("\n".join(migration_inventory()))' > migration-inventory.txt
          printf '%s\n' 'PORTFOLIO_HUB_SECRET_CANARY_DO_NOT_SHIP' > .env.ci-canary
          RELEASE_VERSION="v$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
          docker build --platform linux/amd64 --provenance=false \
            --build-arg "SOURCE_COMMIT=${GITHUB_SHA}" --build-arg "RELEASE_VERSION=${RELEASE_VERSION}" \
            --tag "portfolio-hub-ci:${GITHUB_SHA}" .
          uv run python scripts/image_release.py smoke --image "portfolio-hub-ci:${GITHUB_SHA}" --inventory migration-inventory.txt --timeout 180
          docker save --output portfolio-hub-image.tar "portfolio-hub-ci:${GITHUB_SHA}"
          uv run python scripts/image_release.py scan --image "portfolio-hub-ci:${GITHUB_SHA}" --archive portfolio-hub-image.tar