---
# C5 - Contexts: github.* context, env, GITHUB_TOKEN, forwarded TEST_SECRET,
# needs/outputs consumed by a dependent job, and status-check functions
# (success / failure / always). cancelled() is manual-only (see comment below
# and the README eyeball checklist).
#
# This is a REUSABLE workflow (on: workflow_call). The caller (c5 in
# 00-suite-runner.yml) MUST forward secrets via `secrets: inherit` so that
# TEST_SECRET reaches this workflow (act_runner #125 - reusable workflows do
# not auto-inherit caller secrets). GITHUB_TOKEN is auto-injected and needs no
# forwarding.
name: C5 - Contexts

on:
  workflow_call:

jobs:
  ctx-check:
    name: github/env/token/secrets/status-fns
    runs-on: ubuntu-24.04
    env:
      MY_VAR: "hello-env"
      GH_SHA: ${{ github.sha }}
      GH_REF: ${{ github.ref }}
      GH_RUN_ID: ${{ github.run_id }}
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      TEST_SECRET_VAL: ${{ secrets.TEST_SECRET }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: github context (sha, ref, run_id)
        run: |
          set -e
          source lib/assert.sh
          assert_match "$GH_SHA" '^[0-9a-f]{40}$' "github.sha is a commit hash"
          assert_match "$GH_REF" 'refs/' "github.ref non-empty"
          [ -n "$GH_RUN_ID" ] && assert_eq "has-run-id" "has-run-id" "github.run_id non-empty"

      - name: job env var round-trip
        run: |
          set -e
          source lib/assert.sh
          assert_eq "$MY_VAR" "hello-env" "env var round-trip"

      - name: GITHUB_TOKEN non-empty (auto-injected)
        run: |
          set -e
          source lib/assert.sh
          [ -n "$GH_TOKEN" ] && assert_eq "token-present" "token-present" "GITHUB_TOKEN non-empty"

      # T14 c5 caller MUST use secrets: inherit to forward TEST_SECRET (act_runner #125)
      - name: TEST_SECRET (forwarded by caller)
        run: |
          set -e
          source lib/assert.sh
          if [ -z "$TEST_SECRET_VAL" ]; then
            echo "SKIP: TEST_SECRET is empty - set repo secret TEST_SECRET=placeholder to enable this test"
          else
            assert_eq "$TEST_SECRET_VAL" "placeholder" "TEST_SECRET value matches"
          fi

      - name: success() default gate
        if: success()
        run: |
          set -e
          source lib/assert.sh
          assert_eq "success-ran" "success-ran" "success() default gate ran"

      # cancelled() is manual-only - see README eyeball checklist
      - name: always() triggered
        if: always()
        run: |
          set -e
          source lib/assert.sh
          assert_eq "always-ran" "always-ran" "always() triggered"

  # Tests continue-on-error at step level: trigger step fails but is
  # tolerated, and subsequent steps verify the outcome/conclusion split.
  # Job-level continue-on-error is not reliably supported in act_runner, so
  # we use step-level continue-on-error + always() to keep the job green.
  failure-test:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - name: trigger step failure (continue-on-error)
        id: trigger
        continue-on-error: true
        run: exit 1
      - name: verify outcome and conclusion
        if: always()
        run: |
          source lib/assert.sh
          assert_eq "${{ steps.trigger.outcome }}" "failure" "step outcome is failure"
          assert_eq "${{ steps.trigger.conclusion }}" "success" "step conclusion is success (tolerated)"
  producer:
    name: produce needs output
    runs-on: ubuntu-24.04
    outputs:
      myval: ${{ steps.set.outputs.my-output }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: set output
        id: set
        run: |
          source lib/assert.sh
          echo "my-output=from-producer" >> "$GITHUB_OUTPUT"

  consumer:
    name: consume needs output
    runs-on: ubuntu-24.04
    needs: producer
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: consume producer output
        run: |
          set -e
          source lib/assert.sh
          assert_eq "${{ needs.producer.outputs.myval }}" "from-producer" "needs output consumed"