name: Test Harbor Secrets

on:
  push:
    branches:
      - main

env:
  HARBOR_REGISTRY: harbor.pkartchner.com
  HARBOR_PROJECT: basil

jobs:
  test-secrets:
    name: Test Harbor Secret Access
    runs-on: ubuntu-latest
    steps:
      - name: Check if secrets exist
        run: |
          echo "=== Checking Harbor Secrets ==="

          if [ -z "${{ secrets.HARBOR_USERNAME }}" ]; then
            echo "❌ ERROR: HARBOR_USERNAME secret is NOT set"
          else
            echo "✅ HARBOR_USERNAME secret is set (length: ${#HARBOR_USERNAME})"
            echo "   First 3 chars: ${HARBOR_USERNAME:0:3}***"
          fi

          if [ -z "${{ secrets.HARBOR_PASSWORD }}" ]; then
            echo "❌ ERROR: HARBOR_PASSWORD secret is NOT set"
          else
            echo "✅ HARBOR_PASSWORD secret is set (length: ${#HARBOR_PASSWORD})"
          fi

          if [ -z "${{ secrets.WEBHOOK_URL }}" ]; then
            echo "❌ ERROR: WEBHOOK_URL secret is NOT set"
          else
            echo "✅ WEBHOOK_URL secret is set"
            echo "   Value: ${{ secrets.WEBHOOK_URL }}"
          fi

          if [ -z "${{ secrets.WEBHOOK_SECRET }}" ]; then
            echo "❌ ERROR: WEBHOOK_SECRET secret is NOT set"
          else
            echo "✅ WEBHOOK_SECRET secret is set (length: ${#WEBHOOK_SECRET})"
          fi
        env:
          HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
          HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}

      - name: Test Harbor connectivity
        run: |
          echo "=== Testing Harbor Registry Connectivity ==="
          echo "Registry: $HARBOR_REGISTRY"
          echo "Project: $HARBOR_PROJECT"

          # Test if Harbor is reachable
          if curl -k -s -o /dev/null -w "%{http_code}" https://$HARBOR_REGISTRY/api/v2.0/systeminfo | grep -q "200"; then
            echo "✅ Harbor registry is reachable"
          else
            echo "⚠️  Harbor registry returned non-200 status (might be auth required)"
          fi

      - name: Test Harbor API authentication
        run: |
          echo "=== Testing Harbor API Authentication ==="

          if [ -z "${{ secrets.HARBOR_USERNAME }}" ] || [ -z "${{ secrets.HARBOR_PASSWORD }}" ]; then
            echo "❌ Cannot test Harbor API - secrets not set"
            exit 1
          fi

          # Test authenticated API call to Harbor
          HTTP_CODE=$(curl -k -s -o /dev/null -w "%{http_code}" \
            -u "${{ secrets.HARBOR_USERNAME }}:${{ secrets.HARBOR_PASSWORD }}" \
            https://$HARBOR_REGISTRY/api/v2.0/projects)

          if [ "$HTTP_CODE" = "200" ]; then
            echo "✅ Harbor API authentication SUCCEEDED (HTTP $HTTP_CODE)"
          else
            echo "❌ Harbor API authentication FAILED (HTTP $HTTP_CODE)"
            echo "   This could mean credentials are incorrect or user lacks permissions"
            exit 1
          fi

      - name: Summary
        if: always()
        run: |
          echo "=================================="
          echo "Harbor Secrets Validation Complete"
          echo "=================================="
          echo ""
          echo "If all checks passed, the pipeline can build and push Docker images."
          echo "If any checks failed, verify the secrets in Settings → Actions → Secrets"