name: Reusable Quality

on:
  workflow_call:
    inputs:
      ref:
        description: Exact commit SHA to validate
        required: true
        type: string
      upload_frontend:
        description: Upload the built frontend for release jobs
        required: false
        default: false
        type: boolean
      run_backend:
        description: Run backend quality checks
        required: false
        default: true
        type: boolean
      run_frontend:
        description: Run frontend quality checks
        required: false
        default: true
        type: boolean

permissions:
  contents: read

jobs:
  backend:
    if: inputs.run_backend
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      CARGO_TERM_COLOR: always
      CPR_TEST_DATABASE_URL: postgres://codex_proxy:codex_proxy@127.0.0.1:5432/codex_proxy
      CPR_TEST_REDIS_URL: redis://127.0.0.1:6379
    services:
      postgres:
        image: postgres:18-bookworm@sha256:d9c83446333daec3f0588cc709adb80c26090b7f9f0f7ec8d43c243385d79818
        env:
          POSTGRES_DB: codex_proxy
          POSTGRES_USER: codex_proxy
          POSTGRES_PASSWORD: codex_proxy
          POSTGRES_INITDB_ARGS: --auth-local=scram-sha-256 --auth-host=scram-sha-256
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U codex_proxy -d codex_proxy"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
      redis:
        image: redis:8-alpine@sha256:9d317178eceac8454a2284a9e6df2466b93c745529947f0cd42a0fa9609d7005
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ inputs.ref }}

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@1a3a6d54512beeaffd394f8d516ca16f2c506a20 # 1.97
        with:
          components: rustfmt,clippy

      - name: Cache Rust
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          workspaces: backend -> target

      - name: Rust format
        working-directory: backend
        run: cargo fmt --check

      - name: Rust clippy
        working-directory: backend
        run: cargo clippy --all-targets --all-features --locked -- -D warnings

      - name: Configure PostgreSQL and Redis test authentication
        shell: bash
        run: |
          set -euo pipefail
          postgres_password="$(openssl rand -hex 24)"
          redis_password="$(openssl rand -hex 24)"
          echo "::add-mask::$postgres_password"
          echo "::add-mask::$redis_password"
          docker exec --env PGPASSWORD=codex_proxy "${{ job.services.postgres.id }}" psql \
            --username=codex_proxy --dbname=codex_proxy \
            --set=ON_ERROR_STOP=1 \
            --command="ALTER USER codex_proxy WITH PASSWORD '${postgres_password}'" >/dev/null
          docker exec --env PGPASSWORD="$postgres_password" "${{ job.services.postgres.id }}" psql \
            --username=codex_proxy --dbname=codex_proxy \
            --set=ON_ERROR_STOP=1 --command='SELECT 1' >/dev/null
          redis-cli -h 127.0.0.1 -p 6379 CONFIG SET requirepass "$redis_password" >/dev/null
          redis-cli --no-auth-warning -h 127.0.0.1 -p 6379 -a "$redis_password" ping >/dev/null
          {
            echo "CPR_TEST_DATABASE_URL=postgres://codex_proxy:${postgres_password}@127.0.0.1:5432/codex_proxy"
            echo "CPR_TEST_REDIS_URL=redis://:${redis_password}@127.0.0.1:6379"
          } >> "$GITHUB_ENV"

      - name: Rust tests
        working-directory: backend
        run: cargo test --test main --locked

  frontend:
    if: inputs.run_frontend
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      CI: 'true'
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ inputs.ref }}

      - name: Setup pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          version: 11.7.0

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: frontend/pnpm-lock.yaml

      - name: Install frontend dependencies
        run: pnpm --dir frontend install --frozen-lockfile

      - name: Frontend format
        run: pnpm --dir frontend format:check

      - name: Frontend build
        run: pnpm --dir frontend build

      - name: Upload frontend artifact
        if: inputs.upload_frontend
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: frontend-dist
          path: frontend/dist
          if-no-files-found: error
          retention-days: 1

  workflow-lint:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ inputs.ref }}

      - name: Lint GitHub Actions workflows
        run: >-
          docker run --rm
          --volume "$PWD:/repo"
          --workdir /repo
          rhysd/actionlint:1.7.7@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9
          -color
          .github/workflows/*.yml