# .github/workflows/persistent-proxy-e2e.yml
name: Persistent Proxy E2E

on:
  workflow_dispatch:
  pull_request:
    branches:
      - main
    paths:
      - "cmd/proxy/**"
      - "internal/proxyserver/**"
      - "internal/flows/cert.go"
      - "action.yml"

permissions:
  contents: read

jobs:
  persistent-proxy-e2e:
    name: Persistent Proxy E2E
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      SAFEDEP_API_KEY: ${{ secrets.SAFEDEP_CLOUD_API_KEY }}
      SAFEDEP_TENANT_ID: ${{ secrets.SAFEDEP_CLOUD_TENANT_DOMAIN}}
      PMG_CLOUD_ENABLED: "true"
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout Source
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "24"

      - name: Setup Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: "3.11"

      - name: Build PMG
        run: make

      - name: Add pmg to PATH
        run: echo "$GITHUB_WORKSPACE/bin" >> "$GITHUB_PATH"

      - name: Start proxy daemon
        run: pmg proxy start --daemon

      - name: Inject proxy env
        run: pmg proxy env >> "$GITHUB_ENV"

      - name: Run proxy E2E assertions
        uses: ./.github/actions/proxy-e2e-assertions

      - name: Stop proxy and verify it fails on the blocks
        if: always()
        shell: bash
        run: |
          if pmg proxy stop --fail-on-violation; then
            echo "ERROR: stop should have exited non-zero (packages were blocked)"
            exit 1
          fi
          echo "OK: stop correctly failed on the policy violation"