test.yml

name: Test image

on:
  push:
    paths:
      - Dockerfile
      - src/**
      - conf/nginx-site.conf
      - .github/workflows/test.yml
      - .github/scripts/test-animation.js
  pull_request:
    paths:
      - Dockerfile
      - src/**
      - conf/nginx-site.conf
      - .github/workflows/test.yml
      - .github/scripts/test-animation.js
  workflow_dispatch:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7.0.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4.3.0

      - name: Build image
        uses: docker/build-push-action@v7.3.0
        with:
          context: .
          file: ./Dockerfile
          load: true
          tags: docker-starwars:test
          cache-from: type=gha,scope=test
          cache-to: type=gha,mode=max,scope=test

      - name: Start container
        run: docker run -d --name starwars -p 8080:8080 docker-starwars:test

      - name: Wait for container to be healthy
        run: |
          for i in $(seq 1 30); do
            docker exec starwars curl -fsS http://localhost:8080/healthz && exit 0
            sleep 1
          done
          docker logs starwars
          exit 1

      - name: Check root path returns 200
        run: |
          status=$(curl -sS -o /dev/null -w '%{http_code}' http://localhost:8080/)
          [ "$status" = "200" ]

      - name: Check index page structure
        run: |
          set -eu
          html=$(curl -fsS http://localhost:8080/)
          echo "$html" | grep -q '<title>STAR WARS ASCIIMATION - Main Page</title>'
          echo "$html" | grep -q '<pre id="screen">'
          echo "$html" | grep -q '<div id="buttons">'
          echo "$html" | grep -q 'onclick="Play()"'
          echo "$html" | grep -q 'onclick="Stop()"'

      - name: Check static assets are served
        run: |
          set -eu
          headers=$(curl -sS -o /dev/null -D - http://localhost:8080/asciimation/starwars.jpg)
          echo "$headers" | grep -qE '^HTTP/[0-9.]+ 200'
          echo "$headers" | grep -qi '^content-type: *image/jpeg'

      - name: Check gzip compression is applied to index.html
        run: |
          headers=$(curl -sS -H 'Accept-Encoding: gzip' -o /dev/null -D - http://localhost:8080/)
          echo "$headers" | grep -qi '^content-encoding: *gzip'

      - name: Check security headers are present
        run: |
          set -eu
          headers=$(curl -sS -o /dev/null -D - http://localhost:8080/)
          echo "$headers" | grep -qi '^x-content-type-options: *nosniff'
          echo "$headers" | grep -qi '^x-frame-options: *deny'
          echo "$headers" | grep -qi '^referrer-policy: *no-referrer'
          echo "$headers" | grep -qi '^content-security-policy:'

      - name: Check an unknown path still falls back to the animation page
        run: |
          set -eu
          status=$(curl -sS -o /dev/null -w '%{http_code}' http://localhost:8080/some/random/path)
          [ "$status" = "404" ]
          html=$(curl -sS http://localhost:8080/some/random/path)
          echo "$html" | grep -q '<pre id="screen">'

      - name: Check removed legacy applet mirror files stay removed
        run: |
          set -eu
          for path in asciimation/SwPlay.html asciimation/JJPlay.html asciimation/SwPlay.jar asciimation/jjplay.jar; do
            status=$(curl -sS -o /dev/null -w '%{http_code}' "http://localhost:8080/$path")
            [ "$status" = "404" ] || { echo "::error::$path unexpectedly returned $status"; exit 1; }
          done

      - name: Check container runs as non-root
        run: |
          docker exec starwars whoami | grep -qv root
          docker exec starwars id | grep -q 'uid=101'

      - name: Check no sudo access
        run: docker exec starwars which sudo && exit 1 || true

      - name: Check no world-writable files
        run: |
          count=$(docker exec starwars find /usr/share/nginx/html -type f -perm /o+w | wc -l)
          [ "$count" -eq 0 ]

      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version: 24

      - name: Install Playwright package
        run: |
          npm init -y >/dev/null
          # Pinned exact version - the cache key below is keyed on this
          # version, and an unpinned install could silently resolve a
          # newer release whose browser binaries no longer match a
          # stale cache.
          npm install --no-save playwright@1.61.1

      - name: Cache Playwright browsers
        id: playwright-cache
        uses: actions/cache@v6.1.0
        with:
          path: ~/.cache/ms-playwright
          key: playwright-browsers-${{ runner.os }}-1.61.1

      - name: Install Playwright OS dependencies
        run: npx playwright install-deps chromium

      - name: Install Playwright browsers
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        run: npx playwright install chromium

      - name: Verify asciimation plays and transport controls work
        run: node .github/scripts/test-animation.js http://localhost:8080

      - name: Stop container
        if: always()
        run: docker rm -f starwars || true