name: CI/CD
# 三机流水线(NAS 分层验证 + VPS 单独 dispatch):
#   push master → test → nas-deploy(推 NAS 后端+前端+restart) → nas-verify(API健康+数据可读)
#   VPS 部署走单独 vps-deploy.yml(workflow_dispatch 人工 UI 点 / agent API dispatch),不再这里自动推。
# Runner: 复用 online mac-mini-arm64 (label macos-arm64), host executor 跑 Mac shell。
# 关键: ①不用 actions/checkout(国内 EOF),改 git fetch Gitea ②HOME=/Users/chufeng ③git config --local http.proxy ""
on:
  push:
    branches: [master]
  workflow_dispatch: {}

jobs:
  test:
    runs-on: macos-arm64
    env:
      HOME: /Users/chufeng
    steps:
      - name: checkout (直连 Gitea, git fetch 绕过 github action)
        env:
          TOKEN: ${{ github.token }}
        run: |
          git init .
          git config --local http.proxy ""
          git config --local https.proxy ""
          git remote add origin "http://oauth2:${TOKEN}@192.168.2.154:3000/${GITHUB_REPOSITORY}.git"
          git fetch --depth 1 origin "${GITHUB_SHA}"
          git checkout FETCH_HEAD
      - name: enforce commit label ([vps]/[nas] 必打, merge 豁免)
        if: github.event_name == 'push'
        run: |
          set -e
          BEFORE=${{ github.event.before }}
          AFTER=${{ github.event.after }}
          if [[ "$BEFORE" =~ ^0+$ ]]; then
            git fetch origin "$AFTER" --depth 20
            RANGE="HEAD~20..HEAD"
          else
            git fetch origin "$BEFORE" "$AFTER" --depth 50
            RANGE="${BEFORE}..${AFTER}"
          fi
          # 缺标签 = 既无 [vps]/[nas] 且非 Merge 开头
          MISSING=$(git log --format=%s "$RANGE" | grep -vE '\[(vps|nas)\]|^Merge' || true)
          if [ -n "$MISSING" ]; then
            echo "❌ 以下 commit 缺 [vps]/[nas] 环境标签:"
            echo "$MISSING"
            echo ""
            echo "规范: <type>(<scope>): <desc> [vps]   # VPS 也中招, 要推 prod"
            echo "      <type>(<scope>): <desc> [nas]   # NAS/docker 专属, VPS 不中招"
            echo "详见 docs/vps-impact-map.md"
            exit 1
          fi
          echo "✅ 本次 push commit 标签齐全"
      - name: pytest 冒烟 (venv310 数据层核心)
        run: |
          PY=/Users/chufeng/.openclaw/sanguo_projects/sanguo_vnpy_v2/venv310/bin/python
          PYTHONPATH="$GITHUB_WORKSPACE" $PY -m pytest tests/data_platform -q

  # ---------- NAS 部署(后端代码 + 前端 dist + restart 容器) ----------
  nas-deploy:
    needs: test
    runs-on: macos-arm64
    env:
      HOME: /Users/chufeng
    steps:
      - name: checkout
        env:
          TOKEN: ${{ github.token }}
        run: |
          git init .
          git config --local http.proxy ""
          git config --local https.proxy ""
          git remote add origin "http://oauth2:${TOKEN}@192.168.2.154:3000/${GITHUB_REPOSITORY}.git"
          git fetch --depth 1 origin "${GITHUB_SHA}"
          git checkout FETCH_HEAD
      - name: 推后端代码到 NAS (promote --target nas, 不推 VPS)
        run: bash scripts/nas_sync/promote.sh --target nas
      - name: build 前端 + 部署 dist 到 NAS
        run: |
          export PATH="/opt/homebrew/bin:$PATH"
          cd frontend
          npm ci
          npm run build
          cd ..
          rsync -az --delete frontend/dist/ sanguo-nas:/volume1/homes/admin/.sanguo_projects/sanguo_vnpy_v2/frontend/dist/
      - name: restart NAS 容器(加载新后端代码) + 等 web 就绪
        run: |
          ssh sanguo-nas '/var/packages/Docker/target/usr/bin/docker restart sanguo_vnpy_v2'
          for i in $(seq 1 30); do
            curl -sf http://192.168.2.154:8000/ -o /dev/null && { echo "web ready"; exit 0; }
            sleep 2
          done
          echo "web 未就绪超时"; exit 1

  # ---------- NAS 验证(API 健康 + 数据可读,秒级 gate) ----------
  nas-verify:
    needs: nas-deploy
    runs-on: macos-arm64
    env:
      HOME: /Users/chufeng
    steps:
      - name: checkout (check-vps-needed 需 git log + scripts/ci 脚本)
        env:
          TOKEN: ${{ github.token }}
        run: |
          git init .
          git config --local http.proxy ""
          git config --local https.proxy ""
          git remote add origin "http://oauth2:${TOKEN}@192.168.2.154:3000/${GITHUB_REPOSITORY}.git"
          git fetch --depth 1 origin "${GITHUB_SHA}"
          git checkout FETCH_HEAD
      - name: NAS web API 健康(login + strategy/list 200 非空)
        run: |
          BASE=http://192.168.2.154:8000
          token=$(curl -s -X POST $BASE/api/v1/auth/login -H "Content-Type: application/json" \
            -d '{"username":"admin","password":"Ccf7561523*"}' \
            | python3 -c "import json,sys;print(json.load(sys.stdin).get('token',''))")
          [ -n "$token" ] || { echo "❌ login 失败"; exit 1; }
          echo "✅ login OK"
          code=$(curl -s -o /tmp/sl.json -w "%{http_code}" $BASE/api/v1/strategy/list -H "Authorization: Bearer $token")
          [ "$code" = "200" ] || { echo "❌ strategy/list HTTP $code"; exit 1; }
          [ -s /tmp/sl.json ] || { echo "❌ strategy/list 空响应"; exit 1; }
          echo "✅ strategy/list 200 非空, 后端路由通"
          # /health 存活探针(Docker HEALTHCHECK 依赖;漏部署→容器恒unhealthy,本次回归即此)
          code=$(curl -s -o /dev/null -w "%{http_code}" $BASE/health)
          [ "$code" = "200" ] || { echo "❌ /health HTTP $code (容器会unhealthy)"; exit 1; }
          echo "✅ /health 200, 存活探针通"
      - name: NAS 副本数据可读(dbbardata)
        run: |
          ssh sanguo-nas "python3 -c 'import sqlite3
          c=sqlite3.connect(\"/volume1/stock/sanguo_vnpy_v2/data_backup/quant_trading.db\")
          n=c.execute(\"SELECT COUNT(*) FROM dbbardata WHERE symbol=?\",(\"600519\",)).fetchone()[0]
          print(\"dbbardata 600519 rows:\", n)
          exit(0 if n>0 else 1)'"
      - name: check-vps-needed (vps-deployed tag 对比 + 待推 issue 信号)
        env:
          GTOKEN: ${{ github.token }}
        run: |
          set -e
          git fetch origin "$GITHUB_SHA" --depth 100 2>/dev/null || true
          git fetch origin refs/tags/vps-deployed:refs/tags/vps-deployed 2>/dev/null || true
          if git rev-parse --verify vps-deployed >/dev/null 2>&1; then
            RANGE="$(git rev-parse vps-deployed)..HEAD"
          else
            RANGE="HEAD~50..HEAD"
            echo "⚠️ vps-deployed tag 不存在(首次/未推过 VPS), 查最近 50 commit"
          fi
          export VPS_LOG="$(git log --format='%h %s' "$RANGE" --grep='\[vps\]' || true)"
          echo "::notice::NAS 验证通过 ✅ 。含 [vps] 则开 [待推VPS] issue(人工/agent 推 vps-deploy.yml)"
          python3 scripts/ci/vps_pending_check.py

  # 注: VPS 部署已拆到 .gitea/workflows/vps-deploy.yml (workflow_dispatch 人工/agent 触发)