name: E2E Tests

on:
  workflow_call:
    secrets:
      AZURE_CLIENT_ID:
        required: false
      AZURE_TENANT_ID:
        required: false
      AZURE_SUBSCRIPTION_ID:
        required: false
      PLAYWRIGHT_SERVICE_URL:
        required: false
      # Add other secrets if necessary
  workflow_dispatch:

env:
  TELEMETRY_DISABLED: 1
  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
  TURBO_TEAM: ${{ vars.TURBO_TEAM }}

permissions:
  id-token: write
  contents: read
  actions: read
  checks: write

jobs:
  build:
    name: Run E2E Tests
    runs-on: ubuntu-latest
    timeout-minutes: 60
    services:
      postgres:
        image: pgvector/pgvector:pg17
        env:
          POSTGRES_DB: postgres
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
        ports:
          - 5432:5432
        options: >-
          --health-cmd="pg_isready -U testuser"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
        with:
          egress-policy: audit

      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
      - uses: ./.github/actions/dangerous-git-checkout

      - name: Setup Node.js 20.x
        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3.8.2
        with:
          node-version: 20.x

      - name: Install pnpm
        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0

      - name: Install dependencies
        run: pnpm install --config.platform=linux --config.architecture=x64
        shell: bash

      - name: create .env
        run: cp .env.example .env
        shell: bash

      - name: Fill ENCRYPTION_KEY, ENTERPRISE_LICENSE_KEY and E2E_TESTING in .env
        run: |
          RANDOM_KEY=$(openssl rand -hex 32)
          sed -i "s/ENCRYPTION_KEY=.*/ENCRYPTION_KEY=${RANDOM_KEY}/" .env
          sed -i "s/CRON_SECRET=.*/CRON_SECRET=${RANDOM_KEY}/" .env
          sed -i "s/NEXTAUTH_SECRET=.*/NEXTAUTH_SECRET=${RANDOM_KEY}/" .env
          sed -i "s/ENTERPRISE_LICENSE_KEY=.*/ENTERPRISE_LICENSE_KEY=${RANDOM_KEY}/" .env
          echo "" >> .env
          echo "E2E_TESTING=1" >> .env
        shell: bash

      - name: Build App
        run: |
          pnpm build --filter=@formbricks/web...

      - name: Apply Prisma Migrations
        run: |
          # pnpm prisma migrate deploy
          pnpm db:migrate:dev

      - name: Run App
        run: |
          NODE_ENV=test pnpm start --filter=@formbricks/web | tee app.log 2>&1 &
          sleep 10  # Optional: gives some buffer for the app to start
          for attempt in {1..10}; do
            if [ $(curl -o /dev/null -s -w "%{http_code}" http://localhost:3000/health) -eq 200 ]; then
              echo "Application is ready."
              break
            fi
            if [ $attempt -eq 10 ]; then
              echo "Application failed to start in time."
              exit 1
            fi
            echo "Still waiting for the application to be ready..."
            sleep 10
          done

      - name: Install Playwright
        run: pnpm exec playwright install --with-deps

      - name: Set Azure Secret Variables
        run: |
          if [[ -n "${{ secrets.AZURE_CLIENT_ID }}" && -n "${{ secrets.AZURE_TENANT_ID }}" && -n "${{ secrets.AZURE_SUBSCRIPTION_ID }}" ]]; then
            echo "AZURE_ENABLED=true" >> $GITHUB_ENV
          else
            echo "AZURE_ENABLED=false" >> $GITHUB_ENV
          fi

      - name: Azure login
        if: env.AZURE_ENABLED == 'true'
        uses: azure/login@a65d910e8af852a8061c627c456678983e180302 # v2.2.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Run E2E Tests (Azure)
        if: env.AZURE_ENABLED == 'true'
        env:
          PLAYWRIGHT_SERVICE_URL: ${{ secrets.PLAYWRIGHT_SERVICE_URL }}
        run: |
          pnpm test-e2e:azure

      - name: Run E2E Tests (Local)
        if: env.AZURE_ENABLED == 'false'
        run: |
          pnpm test:e2e

      - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        if: always()
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 30

      - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        if: failure()
        with:
          name: app-logs
          path: app.log

      - name: Output App Logs
        if: failure()
        run: cat app.log