# SPDX-FileCopyrightText: 2026 Dillard Blom
# SPDX-License-Identifier: AGPL-3.0-or-later
name: CI

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  unit:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        php: ['8.2', '8.3', '8.4']
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php }}
          extensions: sodium, zip
          coverage: none
      - run: composer install --no-interaction --no-progress
      - run: vendor/bin/phpunit -c tests/phpunit.xml

  psalm:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: shivammathur/setup-php@v2
        with:
          php-version: '8.2'
          extensions: sodium, zip
          coverage: none
      - run: composer install --no-interaction --no-progress
      - run: composer psalm

  integration:
    # Full round trip (key, kit, location, backup, incremental, restore modes, database dump and
    # restore, retention, trash) on a fresh Nextcloud per version and database.
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        nextcloud: ['32', '33', '34', '35']
        database: ['sqlite', 'mariadb', 'pgsql']
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Round trip on Nextcloud ${{ matrix.nextcloud }} / ${{ matrix.database }}
        run: tests/integration/matrix.sh "${{ matrix.nextcloud }}" "${{ matrix.database }}"

  integration-targets:
    # Same round trip, but through the real S3 (s3mock) and SFTP backends instead of a local
    # path, so files_external's AmazonS3/SFTP backend and auth classes are actually exercised.
    # Backend correctness does not depend on the Nextcloud version or database, so this runs once.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Round trip against S3 and SFTP
        run: tests/integration/targets-matrix.sh

  integration-user:
    # Per-user backup/restore via user_migration (occ backup:user:backup / backup:user:restore),
    # an optional dependency installed from the app store. It calls user_migration's internal
    # UserMigrationService, whose API can change between Nextcloud versions, so this runs on every
    # supported version (not the database, which the main integration job already covers).
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        nextcloud: ['32', '33', '34', '35']
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Set up a fresh Nextcloud instance
        run: |
          docker run -d --name ngbu -e SQLITE_DATABASE=nextcloud -e NEXTCLOUD_ADMIN_USER=admin \
            -e NEXTCLOUD_ADMIN_PASSWORD=admin-user-roundtrip -e NEXTCLOUD_TRUSTED_DOMAINS=localhost \
            -v "$PWD:/var/www/html/custom_apps/ng_backup:ro" nextcloud:${{ matrix.nextcloud }}-apache
          for i in $(seq 1 90); do docker exec -u www-data ngbu php occ status 2>/dev/null | grep -q "installed: true" && break; sleep 4; done
          docker exec ngbu chown www-data:www-data /var/www/html/custom_apps
      - name: Per-user backup/restore round trip on Nextcloud ${{ matrix.nextcloud }}
        run: tests/integration/user-roundtrip.sh "docker exec -u www-data ngbu" /var/www/html/data

  # 35.0.0, not 35: the app store lists apps for a new point release only some time after it
  # is out, and this test installs Mail and Deck from it.
  integration-full-restore:
    # Disaster recovery (occ backup:restore:full) on a SECOND, fresh Nextcloud instance that
    # never saw the first one, sharing only the backup location. Does not depend on the database
    # beyond what the main integration job already covers, so this runs once, on one NC version.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Full restore round trip
        run: tests/integration/full-restore-roundtrip.sh 35.0.0-apache
      - name: Full restore round trip on PostgreSQL, with Mail (foreign keys) and a disabled app
        run: tests/integration/full-restore-roundtrip.sh 35.0.0-apache pgsql
      - name: Full restore round trip on MariaDB, with Mail (foreign keys) and a disabled app
        run: tests/integration/full-restore-roundtrip.sh 35.0.0-apache mysql
      - name: Full restore of a backup made by 1.0.0-rc.1 (no table structure) on PostgreSQL
        run: tests/integration/full-restore-roundtrip.sh 35.0.0-apache pgsql legacy
      - name: Full restore of a backup made by 1.0.0-rc.1 (no table structure) on MariaDB
        run: tests/integration/full-restore-roundtrip.sh 35.0.0-apache mysql legacy
      - name: Full restore over SFTP on PostgreSQL, reading packs ahead on several connections
        run: tests/integration/full-restore-roundtrip.sh 35.0.0-apache pgsql sftp