name: magicka-web-gates

# Phase H of plan2.md — the web CI gates.
#
# MERGE-BLOCKING gates live in merge-gates.yml (the merge_group-required job),
# which runs the protocol + socket + replay/visibility/resilience suite. This
# workflow provides the same Rust gates as fast PR/push feedback, plus the
# rendered-browser layer.
#
# The Rust gates (web-rust-gates) enforce, deterministically and without a
# browser:
#   * 1,000 simulated matches, 0 replay hash mismatches  (determinism.rs)
#   * 10,000 protocol fuzz cases, 0 server panics        (fuzz.rs)
#   * 100 end-to-end matches over real sockets           (e2e.rs, protocol-level)
#   * 0 hidden-state leaks                                (visibility.rs)
#   * disconnect/reconnect + timer edges                 (resilience.rs)
#
# The rendered-browser layer (rendered-browser-e2e) is EXTERNAL-BLOCKED: it
# cannot be merge-blocking until CI infrastructure with a real browser exists.
# Until then it runs advisory-only (continue-on-error) and uploads Playwright
# artifacts. It is NOT counted as satisfied coverage.

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  web-rust-gates:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
      - name: Protocol / server / game-runtime unit tests
        run: cargo test --release -p protocol -p game_runtime -p server -p web_assets -p web_client
      - name: Web CI gates (1k matches, 10k fuzz, 100 e2e, leak + resilience)
        run: cargo test --release -p web_tests

  # EXTERNAL-BLOCKED: rendered-browser end-to-end. A real browser is not
  # available in this CI, so this job is advisory only and never blocks merge.
  # It produces Playwright artifacts as evidence; it does not satisfy the
  # "rendered browser" coverage claim until CI infrastructure exists.
  rendered-browser-e2e:
    name: rendered-browser-e2e (ADVISORY — blocked on CI infra)
    runs-on: ubuntu-latest
    timeout-minutes: 30
    continue-on-error: true
    needs: web-rust-gates
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
      - name: Install Playwright (Chromium)
        working-directory: crates/web_tests/e2e
        continue-on-error: true
        run: |
          npm install
          npx playwright install --with-deps chromium
      - name: Rendered-browser E2E (advisory)
        working-directory: crates/web_tests/e2e
        continue-on-error: true
        run: npm test
      - name: Upload advisory Playwright report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report-advisory
          path: crates/web_tests/e2e/playwright-report
          if-no-files-found: ignore