name: Validate Helm chart

on:
  push:
    paths:
      - infra/helm/**
      - .github/workflows/helm-chart.yml
  pull_request:
    paths:
      - infra/helm/**
      - .github/workflows/helm-chart.yml

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-helm@v4
        with:
          version: v3.17.3
      - name: Lint chart
        run: helm lint infra/helm/medical-chatbot
      - name: Render default and production manifests
        run: |
          helm template default infra/helm/medical-chatbot > /tmp/default.yaml

          # values-prod.yaml leaves the image tags empty on purpose: production
          # must run an immutable commit SHA, supplied per deploy. Rendering it
          # without one has to fail rather than fall back to a development tag,
          # so assert that failure here — otherwise the guard could rot into a
          # silent default and nobody would notice until a cutover.
          if helm template production infra/helm/medical-chatbot \
               --values infra/helm/medical-chatbot/values-prod.yaml \
               > /tmp/untagged.yaml 2>/tmp/untagged.err; then
            echo "::error::production render succeeded with no image tag; the immutable-tag guard is gone"
            exit 1
          fi
          grep -q 'image.tag must be set to an immutable tag' /tmp/untagged.err

          helm template production infra/helm/medical-chatbot \
            --values infra/helm/medical-chatbot/values-prod.yaml \
            --set aiService.image.tag="$GITHUB_SHA" \
            --set web.image.tag="$GITHUB_SHA" \
            > /tmp/production.yaml
          grep -q 'ANSWER_MODEL_ID: "qwen.qwen3-next-80b-a3b"' /tmp/production.yaml
          grep -q 'RERANK_ENABLED: "true"' /tmp/production.yaml
          grep -q 'checksum/runtime-config:' /tmp/production.yaml
          grep -q "image: \"ghcr.io/baovu2k4/vsf-duocthu-ai-service:$GITHUB_SHA\"" /tmp/production.yaml
          grep -q "image: \"ghcr.io/baovu2k4/vsf-duocthu-web:$GITHUB_SHA\"" /tmp/production.yaml

      # The practice cluster is only evidence for the production migration
      # while it renders the same behavioural contract as production, so both
      # of its releases are asserted here rather than trusted by review.
      - name: Render practice manifests
        run: |
          helm template medical-chatbot-app infra/helm/medical-chatbot \
            --values infra/helm/medical-chatbot/values-practice.yaml \
            > /tmp/practice-app.yaml
          helm template medical-chatbot-data infra/helm/medical-chatbot \
            --values infra/helm/medical-chatbot/values-practice-data.yaml \
            > /tmp/practice-data.yaml

          # A bare `grep -q` fails the step with no indication of which
          # assertion broke, and `set -e` ignores a status inverted with `!`,
          # so a `! grep -q` assertion can never fail at all. Both directions
          # go through helpers that name the pattern and exit explicitly.
          # `--` matters: a YAML list item pattern starts with `-`, which grep
          # would otherwise parse as an option bundle.
          expect() {
            if ! grep -q -- "$2" "$1"; then
              echo "::error::$1 is missing: $2"
              exit 1
            fi
          }
          refute() {
            if grep -q -- "$2" "$1"; then
              echo "::error::$1 must not contain: $2"
              exit 1
            fi
          }

          # Behavioural parity with the audited production runtime contract.
          expect /tmp/practice-app.yaml 'ANSWER_MODEL_ID: "qwen.qwen3-next-80b-a3b"'
          expect /tmp/practice-app.yaml 'ANSWER_PROVIDER: "bedrock-converse"'
          expect /tmp/practice-app.yaml 'EMBEDDING_PROVIDER: "cohere-v4"'
          expect /tmp/practice-app.yaml 'EMBEDDING_DIMENSIONS: "1024"'
          expect /tmp/practice-app.yaml 'EVIDENCE_MINIMUM_SCORE: "0.12"'
          expect /tmp/practice-app.yaml 'RERANK_ENABLED: "true"'
          expect /tmp/practice-app.yaml 'AWS_REGION: "us-east-1"'
          expect /tmp/practice-app.yaml 'checksum/runtime-config:'
          expect /tmp/practice-app.yaml '- host: "readytochat.realvuxbaro.me"'

          # The production hostname now lives on this cluster, routed and with
          # its own certificate secret -- kept separate from the rehearsal
          # hostname's so one renewal failure cannot take both names offline.
          expect /tmp/practice-app.yaml '- host: "realvuxbaro.me"'
          expect /tmp/practice-app.yaml 'secretName: realvuxbaro-tls'
          expect /tmp/practice-app.yaml 'secretName: readytochat-tls'

          # Grafana answers on that same public hostname. Anonymous access may
          # be open, but never as Admin, never with the login form disabled,
          # and its root URL must be the name users actually arrive on.
          expect /tmp/practice-app.yaml 'value: "https://realvuxbaro.me/grafana/"'
          refute /tmp/practice-app.yaml 'value: "Admin"'

          # grep is line-oriented, so read the value on the line after each
          # flag rather than trying to match the pair as one pattern.
          for check in "GF_AUTH_ANONYMOUS_ORG_ROLE:Viewer" "GF_AUTH_DISABLE_LOGIN_FORM:false"; do
            flag=${check%%:*}
            want=${check#*:}
            got=$(grep -A1 -- "$flag" /tmp/practice-app.yaml | grep -- 'value:' | tr -d ' "' | cut -d: -f2)
            if [ "$got" != "$want" ]; then
              echo "::error::$flag rendered as '$got', expected '$want'"
              exit 1
            fi
          done

          # The app release must own neither data StatefulSet: PostgreSQL and
          # Qdrant belong to the data release, so an app-side sync failure or
          # prune can never delete the corpus or the query history. Only those
          # two use volumeClaimTemplates — the observability PVCs are the app
          # release's own and are expected here.
          refute /tmp/practice-app.yaml 'volumeClaimTemplates'
          expect /tmp/practice-app.yaml 'medical-chatbot-data-medical-chatbot-qdrant'

          # ...and the data release must own nothing else.
          refute /tmp/practice-data.yaml 'medical-chatbot-data-medical-chatbot-ai-service'
          refute /tmp/practice-data.yaml 'kind: Ingress'
          expect /tmp/practice-data.yaml 'volumeClaimTemplates'