---
# C5 - Contexts: github.* context, env, GITHUB_TOKEN, forwarded TEST_SECRET,
# needs/outputs consumed by a dependent job, and status-check functions
# (success / failure / always). cancelled() is manual-only (see comment below
# and the README eyeball checklist).
#
# This is a REUSABLE workflow (on: workflow_call). The caller (c5 in
# 00-suite-runner.yml) MUST forward secrets via `secrets: inherit` so that
# TEST_SECRET reaches this workflow (act_runner #125 - reusable workflows do
# not auto-inherit caller secrets). GITHUB_TOKEN is auto-injected and needs no
# forwarding.
name: C5 - Contexts

on:
  workflow_call:

jobs:
  ctx-check:
    name: github/env/token/secrets/status-fns
    runs-on: ubuntu-latest
    env:
      MY_VAR: "hello-env"
      GH_SHA: ${{ github.sha }}
      GH_REF: ${{ github.ref }}
      GH_RUN_ID: ${{ github.run_id }}
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      TEST_SECRET_VAL: ${{ secrets.TEST_SECRET }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: github context (sha, ref, run_id)
        run: |
          set -e
          source lib/assert.sh
          assert_match "$GH_SHA" '^[0-9a-f]{40}$' "github.sha is a commit hash"
          assert_match "$GH_REF" 'refs/' "github.ref non-empty"
          [ -n "$GH_RUN_ID" ] && assert_eq "has-run-id" "has-run-id" "github.run_id non-empty"

      - name: job env var round-trip
        run: |
          set -e
          source lib/assert.sh
          assert_eq "$MY_VAR" "hello-env" "env var round-trip"

      - name: GITHUB_TOKEN non-empty (auto-injected)
        run: |
          set -e
          source lib/assert.sh
          [ -n "$GITHUB_TOKEN" ] && assert_eq "token-present" "token-present" "GITHUB_TOKEN non-empty"

      # T14 c5 caller MUST use secrets: inherit to forward TEST_SECRET (act_runner #125)
      - name: TEST_SECRET (forwarded by caller)
        run: |
          set -e
          source lib/assert.sh
          if [ -z "$TEST_SECRET_VAL" ]; then
            echo "TEST_SECRET is empty - either caller did not forward (T14 c5 must use secrets: inherit) or repo secret is unset"
            assert_eq "secret-missing" "secret-present" "TEST_SECRET should be forwarded and set"
          else
            assert_eq "$TEST_SECRET_VAL" "placeholder" "TEST_SECRET value matches"
          fi

      - name: success() default gate
        if: success()
        run: |
          set -e
          source lib/assert.sh
          assert_eq "success-ran" "success-ran" "success() default gate ran"

      # cancelled() is manual-only - see README eyeball checklist
      - name: always() triggered
        if: always()
        run: |
          set -e
          source lib/assert.sh
          assert_eq "always-ran" "always-ran" "always() triggered"

  # Properly tests failure() by letting a step fail without continue-on-error.
  # Job-level continue-on-error: true tolerates the expected failure so the
  # caller (c5) and aggregate see success.
  failure-test:
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: trigger job failure (no continue-on-error)
        run: exit 1
      - name: failure() triggered
        if: failure()
        run: |
          source lib/assert.sh
          assert_eq "failure-ran" "failure-ran" "failure() triggered after unguarded step failure"

  producer:
    name: produce needs output
    runs-on: ubuntu-latest
    outputs:
      myval: ${{ steps.set.outputs.my-output }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: set output
        id: set
        run: |
          source lib/assert.sh
          echo "my-output=from-producer" >> "$GITHUB_OUTPUT"

  consumer:
    name: consume needs output
    runs-on: ubuntu-latest
    needs: producer
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: consume producer output
        run: |
          set -e
          source lib/assert.sh
          assert_eq "${{ needs.producer.outputs.myval }}" "from-producer" "needs output consumed"