name: test / integration / docs
on:
  pull_request:
    branches: [main]
    paths:
      - "showcase/shell-docs/src/content/**"
      - "showcase/shell-docs/model-allowlist.json"
      - "scripts/validate-doc-model-names.ts"
      - "scripts/doc-tests/**"
      - ".github/workflows/test_integration-docs.yml"
  push:
    branches: [main]
    paths:
      - "showcase/shell-docs/src/content/**"
      - "showcase/shell-docs/model-allowlist.json"
      - "scripts/validate-doc-model-names.ts"
      - "scripts/doc-tests/**"
      - ".github/workflows/test_integration-docs.yml"

# Least-privilege by default. Individual jobs/steps can widen when needed.
permissions:
  contents: read

jobs:
  validate-model-names:
    runs-on: depot-ubuntu-24.04-4
    timeout-minutes: 15
    permissions:
      contents: read
      # id-token: write is required for Depot OIDC auth (runs-on: depot-ubuntu-*).
      id-token: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm tsx scripts/validate-doc-model-names.ts

  doc-tests:
    runs-on: depot-ubuntu-24.04-4
    timeout-minutes: 15
    needs: validate-model-names
    permissions:
      contents: read
      # id-token: write is required for Depot OIDC auth (runs-on: depot-ubuntu-*).
      id-token: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: pnpm
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.12"
      - run: pnpm install --frozen-lockfile
      - name: Start aimock
        run: |
          # aimock is pinned as a workspace dependency (@copilotkit/showcase-scripts)
          # and installed from the frozen lockfile above — no ad-hoc `npm install -g`.
          # The `llmock` bin is aimock's fixtures-based CLI (the package also ships an
          # `aimock` bin, which is the newer config-only CLI that does NOT accept
          # --fixtures). Invoke the workspace-installed bin directly from the repo
          # root so the root-relative --fixtures path resolves correctly (a
          # `pnpm --filter exec` would run inside showcase/scripts and break the path).
          nohup ./showcase/scripts/node_modules/.bin/llmock --fixtures scripts/doc-tests/fixtures --validate-on-load > /tmp/aimock.log 2>&1 &
          for i in $(seq 1 60); do
            if curl -sf http://localhost:4010/health; then
              echo "aimock ready"
              exit 0
            fi
            sleep 1
          done
          echo "aimock failed to start. Logs:"
          cat /tmp/aimock.log
          exit 1
      - run: pnpm tsx scripts/doc-tests/extract.ts
      - run: pnpm tsx scripts/doc-tests/run.ts