name: validate

on:
  push:
    branches: [main]
  pull_request:

jobs:
  validate:
    runs-on: ubuntu-latest
    env:
      # Dummy values so `compose config` doesn't fail on the `:?required` guards.
      ALLOY_HOSTNAME: ci
      REMOTECFG_URL:  https://example.com
      REMOTECFG_ID:   ci
      REMOTECFG_USER: "1"
      PROM_URL:       https://example.com
      PROM_USER:      "1"
      LOKI_URL:       https://example.com
      LOKI_USER:      "1"
      GRAFANA_TOKEN:  x
    steps:
      - uses: actions/checkout@v4

      - name: Validate compose YAML + env interpolation
        run: docker compose config -q

      - name: Extract embedded Alloy config
        uses: mikefarah/yq@v4
        with:
          cmd: yq '.configs.alloy_config.content' docker-compose.yml > config.alloy

      - name: Validate Alloy config syntax
        run: |
          docker run --rm -v "$PWD/config.alloy:/config.alloy:ro" \
            grafana/alloy:v1.10.0 fmt /config.alloy > /dev/null

      - name: Validate Alloy config semantics (parse + load components)
        # `fmt` is syntax-only; this catches bad component refs, wrong arg
        # types, and unknown component types by booting alloy and reading
        # the load log. Component runtime errors against dummy paths /
        # endpoints are tolerated (level=error, level=warn) — only fail on
        # config-level errors that prevent the graph from being built.
        run: |
          # /var/log/journal may not exist on the GHA runner; create empty
          # dir so loki.source.journal can at least open it.
          mkdir -p /tmp/empty-journal
          docker run -d --name alloy-test --privileged \
            -e ALLOY_HOSTNAME -e REMOTECFG_URL -e REMOTECFG_ID -e REMOTECFG_USER \
            -e PROM_URL -e PROM_USER -e LOKI_URL -e LOKI_USER -e GRAFANA_TOKEN \
            -v "$PWD/config.alloy:/etc/alloy/config.alloy:ro" \
            -v /proc:/rootproc:ro -v /sys:/sys:ro -v /:/rootfs:ro \
            -v /var/run/docker.sock:/var/run/docker.sock \
            -v /var/lib/docker:/var/lib/docker:ro \
            -v /tmp/empty-journal:/var/log/journal:ro \
            -v /etc/machine-id:/etc/machine-id:ro \
            grafana/alloy:v1.10.0 \
            run --server.http.listen-addr=127.0.0.1:12345 --disable-reporting /etc/alloy/config.alloy
          sleep 10
          docker logs alloy-test 2>&1 | tee /tmp/alloy.log
          state=$(docker inspect -f '{{.State.Status}}' alloy-test 2>/dev/null || echo missing)
          docker rm -f alloy-test >/dev/null 2>&1 || true
          if grep -Eq "could not (parse|load|build)|unknown component|component .* not registered|undefined reference|syntax error|expected .* found|cannot evaluate" /tmp/alloy.log; then
            echo "::error::config-level error detected in alloy logs"
            exit 1
          fi
          if [ "$state" != "running" ]; then
            echo "::warning::alloy exited (state=$state) but no config-error pattern matched — treating as runtime failure (tolerated)"
          fi