name: web-pr

# Every Stable claim the web platform makes is backed by a job here. The lanes are split by what
# they need rather than by what they test: the cross-container matrix needs three source sets, the
# proxy contract needs Docker, and the load gate needs a machine that is not also compiling. A
# single job running everything would attribute every failure to "the web tests".

on:
  workflow_dispatch:
  pull_request:
    paths:
      - 'src/adapter/inbound/web/**'
      - 'src/application-core/src/**/operation/**'
      - 'src/application-core/src/**/idempotency/**'
      - 'src/adapter/outbound/persistence-jpa/src/**/operation/**'
      - 'docs/web/**'
      - '.github/workflows/web-pr.yml'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  web-unit-and-architecture:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Run the web unit, module-boundary and architecture suites
        working-directory: src
        run: >-
          ./gradlew
          :adapter:inbound:web:test
          :application-core:test
          verifyCleanArchitectureDependencies
          --no-daemon
          --stacktrace

  # The parity gate depends on all three recording lanes and fails when one is missing, so it runs
  # them itself rather than trusting a previous job to have left the recordings behind.
  web-cross-stack-parity:
    runs-on: ubuntu-latest
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Compare the wire contract across Tomcat, Jetty and Reactor Netty
        working-directory: src
        run: >-
          ./gradlew
          :adapter:inbound:web:webCrossStackParityTest
          --no-daemon
          --stacktrace
      - name: Publish the parity recordings
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact@v4.6.2
        with:
          name: web-contract-parity
          path: src/adapter/inbound/web/build/web-contract-parity/
          if-no-files-found: error

  # Docker-gated, and the lane fails rather than skipping when the runtime is missing. A proxy
  # contract that quietly passes without a proxy has been certifying nothing since whenever the
  # container runtime last broke.
  web-nginx-proxy-contract:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Run the proxy, prefix and spoofing contract behind a real Nginx
        working-directory: src
        run: >-
          ./gradlew
          :adapter:inbound:web:webNginxProxyTest
          --no-daemon
          --stacktrace