name: tests

on:
  push:
  pull_request:
  workflow_dispatch:

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/ruff-action@v3

  pytest:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      # tor lets the deterministic offline onion-keygen test run (it validates
      # the real production keygen path); that test needs no network.
      - run: sudo apt-get update && sudo apt-get install -y tor
      - run: pip install pytest pyyaml
      - run: make test

  tor-network-e2e:
    # The live onion round-trip depends on the public Tor network, so it is
    # informational (continue-on-error) rather than a blocking merge gate.
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: sudo apt-get update && sudo apt-get install -y tor
      - run: pip install pytest pyyaml
      - run: LIM_E2E_TOR=1 make test-tor PYTHON=python

  qemu-e2e-debian:
    # Full build -> boot -> LUKS-unlock in QEMU, deterministic via the direct
    # transport (debootstrap works on Ubuntu; no Tor). Heavy (root, loop,
    # cryptsetup, and TCG when the runner has no /dev/kvm).
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: sudo apt-get update && sudo apt-get install -y qemu-system-x86 debootstrap cryptsetup
      - run: pip install pytest pyyaml
      - run: make test-qemu-debian PYTHON=python