name: Test

# Pull requests run this workflow directly. Pushes to master and v*.*.* tags run
# it as the gate of docker-publish.yml (workflow_call), so the suite runs exactly
# once per event and an image is never published without it.
on:
  pull_request:
    branches: [ "master" ]
  workflow_call:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  shellcheck:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install shellcheck
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq shellcheck

      # The image scripts declare #!/bin/sh but use a few bash constructs that
      # busybox ash happens to accept. Cleaning that up is a separate change,
      # so this step reports but does not block.
      - name: Run shellcheck on the image scripts
        run: |
          shellcheck --severity=warning backup.sh check.sh entry.sh build.sh run.sh \
            || echo "::warning::shellcheck reported findings in the image scripts, see the log above"

  # Python suite (pytest) plus container-structure-test. Tools are pinned in
  # mise.toml, Python dependencies in uv.lock.
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install tools from mise.toml
        uses: jdx/mise-action@v3

      - name: Lint
        run: task lint

      - name: Run test suites
        run: task test

      # Guards the guard: if someone waters the suite down until a broken
      # backup no longer fails it, this step turns red.
      - name: Verify the suite detects a broken backup
        run: task test:sabotage