name: CLI E2E

on:
  push:
    branches: [main]
  pull_request:
    paths:
      - "backend/**"
      - "test/cli/**"
      - ".github/workflows/cli-e2e.yml"

permissions:
  contents: read

jobs:
  # Primary tier: the cross-platform Go E2E suite (build tag `e2e`) runs the real
  # `ao` binary against isolated state on every OS GitHub hosts. These runners
  # are the "VMs" — the only place that exercises the OS-specific process-detach
  # paths (unix Setsid vs Windows CREATE_NEW_PROCESS_GROUP) and os.UserConfigDir
  # resolution. The suite builds its own binary and self-allocates a free port.
  native:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        working-directory: backend
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: "1.25"
          cache: false

      - name: CLI E2E (native)
        run: go test -tags e2e -v ./internal/cli/...

  # Secondary hardening tier: prove that a freshly installed binary works on a
  # clean machine with no Go toolchain and no developer state. The Dockerfile
  # installs `ao` on PATH in a slim image and runs test/cli/install-check.sh.
  # --init gives a real PID-1 reaper so the daemon the check starts is reaped
  # after `stop` instead of lingering as a zombie.
  container:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build fresh-install image
        run: docker build -f test/cli/Dockerfile -t ao-cli-smoke .

      - name: Fresh-install check (container)
        run: docker run --rm --init ao-cli-smoke