name: Native Qualification

# Dispatch-only diagnostic campaigns for native browser integrations: owned
# Windows cookie extraction and Windows launch/credential diagnostics. They
# exercise real browsers and OS services,
# so they are qualification evidence, not PR gates; they used to live in
# windows-free-tests.yml, where their red dispatch runs read as a red PR lane.
#
# One `mode` per dispatch; every job runs only for its own mode:
#   gh workflow run native-qualification.yml --ref <branch> -f mode=cookie-native

on:
  workflow_dispatch:
    inputs:
      mode:
        description: Which native campaign to run
        type: choice
        required: true
        options:
          - cookie-native
          - windows-native-diagnostics

concurrency:
  group: native-qualification-${{ github.ref }}-${{ inputs.mode }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  cookie-native-qualification:
    if: inputs.mode == 'cookie-native'
    runs-on: windows-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
        with:
          bun-version: 1.4.2
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24.18.0
      - name: Install pinned dependencies
        run: bun install --frozen-lockfile
      - name: Build the qualified Node server inputs
        run: bash browse/scripts/build-node-server.sh
        shell: bash
      - name: Qualify owned native cookie extraction
        run: ./.github/scripts/run-cookie-native-qualification.ps1 -OutputRoot "$env:RUNNER_TEMP"
      - name: Preserve qualification evidence
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
        with:
          name: cookie-native-qualification
          path: ${{ runner.temp }}/cookie-native-qualification-*/
          if-no-files-found: error

  windows-native-diagnostics:
    if: inputs.mode == 'windows-native-diagnostics'
    runs-on: windows-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
        with:
          bun-version: 1.4.2
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24.18.0
      - name: Configure git identity (required by tests that init temp repos)
        run: |
          git config --global user.email "windows-ci@gstack.test"
          git config --global user.name "Windows CI"
          git config --global init.defaultBranch main
        shell: bash
      - name: Install pinned dependencies
        run: bun install --frozen-lockfile
      - name: Build server-node.mjs (required by Windows browse path)
        run: bash browse/scripts/build-node-server.sh
        shell: bash
      - name: Install Chromium for the Node worker smoke
        run: bunx playwright install chromium
      - name: Run focused native launch and credential diagnostics
        shell: bash
        run: |
          set -o pipefail
          status=0
          bun test browse/test/cookie-import-native-job.test.ts --test-name-pattern 'native Windows launch diagnostics|a locked real Edge profile|real Edge synthetic profile' 2>&1 | tee "$RUNNER_TEMP/gstack-free-test-native-diagnostics.log" || status=1
          bun test browse/test/cookie-credential-deadline.test.ts browse/test/cookie-import-node.test.ts browse/test/bun-polyfill.test.ts 2>&1 | tee "$RUNNER_TEMP/gstack-free-test-credential-diagnostics.log" || status=1
          exit "$status"
      - name: Upload diagnostic logs
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
        with:
          name: windows-native-diagnostics
          path: ${{ runner.temp }}/gstack-free-test-*.log
          if-no-files-found: ignore