name: C7 - services

# C7 verifies the services: block (postgres:16 + redis:7 with healthchecks) and a
# container: job (node:20). Connectivity to each service is asserted AFTER the
# runner-gated healthcheck passes; the healthcheck is the source of truth for
# "started". The container job proves the repo is mounted and assertions work
# inside a non-host image. Docker must be available on the runner. Service
# healthchecks may be flaky on resource-constrained runners; that is expected and
# surfaced as a clear job failure rather than a silent pass.

on:
  workflow_call:

jobs:
  services-test:
    name: services (postgres + redis, healthcheck-gated)
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: testdb
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
      redis:
        image: redis:7
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    steps:
      - uses: actions/checkout@v4
      - name: Assert postgres and redis reachable after healthcheck
        # The runner blocks step execution until every service healthcheck passes,
        # so by the time this step runs the services are confirmed started. We then
        # prove the job can actually reach them over localhost.
        run: |
          source lib/assert.sh
          pg_isready -h localhost -U postgres
          assert_eq "pg-ok" "pg-ok" "postgres reachable"
          assert_eq "$(redis-cli -h localhost ping)" "PONG" "redis reachable"

  container-test:
    name: container (node:20, bash present)
    runs-on: ubuntu-latest
    container: node:20
    steps:
      - uses: actions/checkout@v4
      - name: Assert repo accessible and assertions work inside container
        run: |
          source lib/assert.sh
          assert_exists lib/assert.sh "assert.sh reachable inside container"
          assert_eq "container-ok" "container-ok" "assertion works inside container"