name: SSH Source-Install E2E

# Work package 5 of docs/source-installation.md: run the Alpine/Ubuntu/Arch
# OpenSSH source-install E2E matrix (make test-ssh) in CI.
#
# Trust boundary. This job builds and runs privileged Docker containers from
# repository code (the distro fixtures execute the checked-out source), so it
# runs ONLY on trusted refs: pushes to the default branch (master) and manual
# workflow_dispatch. It deliberately does NOT trigger on pull_request: a PR
# can carry untrusted code into a privileged Docker environment, and Gitea's
# fork-PR read-only token clamp does not change what the containers can do on
# the runner host. The ordinary unit `make test` CI run (ci.yml) stays
# Docker-free and still covers pull requests.
#
# Runner requirement. The job inherits whatever Docker access `docker.yml`
# already relies on. The harness dials fixture SSH ports published on the
# Docker daemon loopback, so the runner must expose Docker with loopback port
# publishing reachable from the job; scripts/ci/test-ssh.sh fails fast when
# that is not the case.
#
# External network: fixture images (alpine from the reg.rsxx.ru mirror,
# ubuntu/arch overridable via RSMON_TEST_IMAGE_*), the pinned Go toolchain
# from go.dev, the public source repo from rocketgit.ru, and distro package
# repos are fetched live. Operators can pin a resolver for flaky CI DNS via
# the RSMON_TEST_DOCKER_DNS repository variable (comma-separated nameservers).

on:
  push:
    branches:
      - master
  workflow_dispatch:

# Per-ref scoping: master pushes cancel a superseded in-flight run on the same
# ref instead of stacking; a manual dispatch on another branch has its own
# group and never cancels the master run.
concurrency:
  group: test-ssh-${{ gitea.ref }}
  cancel-in-progress: true

# Least privilege: the job only needs to read the repository (actions/checkout
# and the harness's SSH-free operations). contents:read is supported by Gitea
# Actions (the GITEA_TOKEN scope for code/releases).
permissions:
  contents: read

jobs:
  test-ssh:
    name: Alpine/Ubuntu/Arch source-install E2E
    runs-on: ubuntu-latest
    timeout-minutes: 90
    env:
      # All empty by default (harness defaults / Docker embedded DNS).
      # Override in repo/organization variables:
      #   RSMON_TEST_IMAGE_ALPINE / _UBUNTU / _ARCH - pin a mirror or a
      #     specific distro snapshot for the fixture base image;
      #   RSMON_TEST_DOCKER_DNS - comma-separated nameservers applied as
      #     `docker run --dns ...` for flaky CI resolvers.
      RSMON_TEST_IMAGE_ALPINE: ${{ vars.RSMON_TEST_IMAGE_ALPINE }}
      RSMON_TEST_IMAGE_UBUNTU: ${{ vars.RSMON_TEST_IMAGE_UBUNTU }}
      RSMON_TEST_IMAGE_ARCH: ${{ vars.RSMON_TEST_IMAGE_ARCH }}
      RSMON_TEST_DOCKER_DNS: ${{ vars.RSMON_TEST_DOCKER_DNS }}
    steps:
      # Actions are pinned to immutable full commit SHAs (not moving tags).
      # Verified 2026-08-13 against the GitHub API that the commit the tag
      # points to is a commit object:
      #   actions/checkout@v4 -> 11d5960a326750d5838078e36cf38b85af677262
      #   actions/setup-go@v5 -> 40f1582b2485089dde7abd97c1529aa768e1baff
      # Other workflows (ci.yml, docker.yml) still use moving tags; see the
      # repo-wide convention note in docs/source-installation.md.
      - name: Check out code
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262

      - name: Set up Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
        with:
          go-version: '1.26.x'
          # Caches the Go module/build cache used to compile the harness test
          # binary. Safe: only public dependencies, no credentials.
          cache: true

      - name: Run Alpine/Ubuntu/Arch OpenSSH source-install E2E
        run: bash scripts/ci/test-ssh.sh

      # Belt-and-suspenders: the harness and test-ssh.sh already tear down
      # everything they create; this guarantees a killed job leaves no
      # rsmon-worker-test-* resources behind on the runner. Filters are
      # anchored to the harness's own prefix and image repository so cleanup
      # never touches a shared base image or unrelated resources.
      - name: Clean up leftover harness resources
        if: always()
        run: |
          docker ps -aq --filter "name=^rsmon-worker-test-" 2>/dev/null | xargs -r docker rm -f >/dev/null 2>&1 || true
          docker network ls -q --filter "name=^rsmon-worker-test-" 2>/dev/null | xargs -r docker network rm >/dev/null 2>&1 || true
          docker images -q --filter "reference=rsmon-worker-test/*" 2>/dev/null | xargs -r docker image rm -f >/dev/null 2>&1 || true