name: ci

on:
  push:
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Format check
        run: cargo fmt -- --check
      - name: Test
        run: cargo test
      - name: Build release
        run: cargo build --release
      - name: Docker SSH benchmark gate
        run: sh scripts/ci-docker-ssh-bench.sh

  fuzz-smoke:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install nightly toolchain
        id: nightly
        continue-on-error: true
        uses: dtolnay/rust-toolchain@nightly
      - name: Install cargo-fuzz
        id: install
        if: steps.nightly.outcome == 'success'
        continue-on-error: true
        run: cargo install cargo-fuzz --locked
      - name: Run fuzz targets briefly
        if: steps.nightly.outcome == 'success' && steps.install.outcome == 'success'
        run: |
          set -e
          for target in \
            packet_decode \
            from_body \
            authorized_keys \
            known_hosts \
            handshake_structs \
            attach_ticket; do
            echo "== fuzzing $target =="
            cargo +nightly fuzz run --fuzz-dir fuzz "$target" -- \
              -max_total_time=20 -rss_limit_mb=4096
          done
      - name: Note when fuzzing was skipped
        if: steps.nightly.outcome != 'success' || steps.install.outcome != 'success'
        run: echo "cargo-fuzz / nightly toolchain unavailable; skipped fuzz smoke run."

  remote-bench:
    runs-on: ubuntu-latest
    env:
      DOSH_BENCH_HOST: ${{ secrets.DOSH_BENCH_HOST }}
      DOSH_BENCH_USER: ${{ secrets.DOSH_BENCH_USER }}
      DOSH_BENCH_SSH_KEY: ${{ secrets.DOSH_BENCH_SSH_KEY }}
      DOSH_BENCH_SSH_PORT: ${{ secrets.DOSH_BENCH_SSH_PORT }}
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Check remote benchmark configuration
        id: config
        run: |
          if [ -n "$DOSH_BENCH_HOST" ] && [ -n "$DOSH_BENCH_USER" ] && [ -n "$DOSH_BENCH_SSH_KEY" ]; then
            echo "configured=true" >> "$GITHUB_OUTPUT"
          else
            echo "configured=false" >> "$GITHUB_OUTPUT"
            echo "Skipping remote benchmark; configure DOSH_BENCH_HOST, DOSH_BENCH_USER, and DOSH_BENCH_SSH_KEY secrets to enable it."
          fi
      - name: Build release
        if: steps.config.outputs.configured == 'true'
        run: cargo build --release
      - name: Configure SSH key
        if: steps.config.outputs.configured == 'true'
        run: |
          port="${DOSH_BENCH_SSH_PORT:-22}"
          mkdir -p ~/.ssh
          printf '%s\n' "$DOSH_BENCH_SSH_KEY" > ~/.ssh/dosh_bench
          chmod 600 ~/.ssh/dosh_bench
          ssh-keyscan -p "$port" "$DOSH_BENCH_HOST" >> ~/.ssh/known_hosts
      - name: Copy binaries
        if: steps.config.outputs.configured == 'true'
        run: |
          port="${DOSH_BENCH_SSH_PORT:-22}"
          scp -P "$port" -i ~/.ssh/dosh_bench \
            target/release/dosh-server target/release/dosh-auth \
            "$DOSH_BENCH_USER@$DOSH_BENCH_HOST:/tmp/"
      - name: Start remote server
        if: steps.config.outputs.configured == 'true'
        run: |
          port="${DOSH_BENCH_SSH_PORT:-22}"
          ssh -p "$port" -i ~/.ssh/dosh_bench "$DOSH_BENCH_USER@$DOSH_BENCH_HOST" \
            'mkdir -p ~/.local/bin && install -m 0755 /tmp/dosh-server /tmp/dosh-auth ~/.local/bin/ && pkill -f "dosh-server serve" || true; nohup ~/.local/bin/dosh-server serve >/tmp/dosh-server-ci.log 2>&1 &'
          sleep 1
      - name: Run remote benchmark
        if: steps.config.outputs.configured == 'true'
        run: |
          port="${DOSH_BENCH_SSH_PORT:-22}"
          target/release/dosh-bench \
            --server "$DOSH_BENCH_USER@$DOSH_BENCH_HOST" \
            --ssh-port "$port" \
            --ssh-key ~/.ssh/dosh_bench \
            --ssh-auth-command "~/.local/bin/dosh-auth" \
            --iterations 3