## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## AI-Assisted

## Mock-API tests for the github-org-* tools and the dm-* policy
## wrappers. Runs the suite in ci/ against canned fixtures from
## ci/fixtures/ - no real GitHub access. Intended to catch regressions
## in arg parsing, validator behavior, mock-dispatch routing,
## rate-limit retry math, and the audit / dry-run output shape.

name: github-org tools (mock-API tests)

on:
  ## Run on the relaxed schedule for now while the suite is still
  ## evolving. Tighten to "tags only + workflow_dispatch" once the
  ## suite is considered stable - see the commented `tags-only` block
  ## below for the eventual default.
  push:
    branches:
      - master
      - 'claude/**'
    paths:
      ## Only run when github-related code or CI assets change.
      ## Wildcard the dm-github-* family so new tools (e.g. metadata-
      ## sync) don't need a path-filter update each time. Same for
      ## the libexec data/lib bsh files.
      - 'usr/bin/github-org-*'
      - 'usr/bin/dm-github-*'
      - 'usr/libexec/developer-meta-files/*.bsh'
      - 'ci/**'
      - '.github/workflows/local-org-tools-mock-tests.yml'
  pull_request:
    paths:
      - 'usr/bin/github-org-*'
      - 'usr/bin/dm-github-*'
      - 'usr/libexec/developer-meta-files/*.bsh'
      - 'ci/**'
      - '.github/workflows/local-org-tools-mock-tests.yml'
  workflow_dispatch:

  ## Eventual default - run only on tag pushes (release candidates) +
  ## manual dispatch above. Uncomment and remove the push/pull_request
  ## blocks above once the suite is stable.
  # push:
  #   tags:
  #     - '*'

## Defensive minimum-permissions block. This workflow only reads the
## checked-out source and runs tests against local fixtures - it never
## reaches the real GitHub API.
permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  mock-tests:
    name: mock-API tests
    runs-on: ubuntu-latest
    timeout-minutes: 15
    container:
      image: debian:trixie
    steps:
      - name: Checkout developer-meta-files
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - name: Install genmkfile + helper-scripts + self
        uses: ./.github/actions/install-deps
        with:
          apt-packages: ca-certificates curl jq git sudo build-essential dctrl-tools python3 python3-yaml shellcheck safe-rm
          install-self: 'true'

      - name: Smoke test sanitize-string
        run: sanitize-string -- nolimit "smoke test"

      - name: Run mock-API test suite
        run: ./ci/test-github-org-tools.sh

      - name: Emit step summary
        if: always()
        ## Minimal panel surfacing pass/fail + which event triggered
        ## the run. Template-substituted values routed through env:
        ## per #87 (avoid CodeQL inline-${{...}}-in-run: flag).
        env:
          JOB_STATUS: ${{ job.status }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          ./ci/step-summary-emit.sh \
            --tool 'github-org tools (mock-API tests)' \
            --column-header field \
            --row "outcome=${JOB_STATUS}" \
            --row "trigger=${EVENT_NAME}"

      ## The live unauth smoke probe used to live here. It moved to
      ## .github/workflows/local-org-policy-live-probe.yml because
      ## it is a real-API call,
      ## logically distinct from the mock-API test suite this
      ## workflow runs. See agents/bash-style-guide.md "workflow YAML
      ## and ci scripts share a prefix".
