name: Test

# Pull requests run this workflow directly. Pushes to master and v*.*.* tags run
# it as the gate of docker-publish.yml (workflow_call), so the suite runs exactly
# once per event and an image is never published without it.
on:
  pull_request:
    branches: [ "master" ]
  workflow_call:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  shellcheck:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install shellcheck
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq shellcheck

      # The test scripts are new, so they are held to a clean bill of health.
      - name: Run shellcheck on the test scripts
        run: shellcheck --severity=warning test/*.sh

      # The image scripts declare #!/bin/sh but use a few bash constructs that
      # busybox ash happens to accept. Cleaning that up is a separate change,
      # so this step reports but does not block.
      - name: Run shellcheck on the image scripts
        run: |
          shellcheck --severity=warning backup.sh check.sh entry.sh build.sh run.sh \
            || echo "::warning::shellcheck reported findings in the image scripts, see the log above"

  test:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Build test image
        run: docker build -t restic-backup-docker:test .

      # container-structure-test is not installed: test/run.sh falls back to
      # the official tool image, which keeps CI and local runs identical.
      - name: Run test suites
        run: bash test/run.sh --no-build

      # Guards the guard: if someone waters the suites down until a broken
      # backup no longer fails them, this step turns red.
      - name: Verify the suite detects a broken backup
        run: bash test/run.sh --sabotage