name: Model generation L3 (nightly + manual)

# Wave 11 / PR 11 — `code_ui_remote_model_generation_matrix.rs`
# is `#[ignore]` + `LIBRA_RUN_LIVE=1` gated. It cannot run in
# the regular `cargo test --all` PR job because it makes real
# DeepSeek API calls. This workflow runs on a nightly schedule
# and on manual dispatch, gated on the `DEEPSEEK_API_KEY`
# repository secret. If the secret is missing the job no-ops
# with a clear log message — repository forks without the
# secret can still merge changes that touch the matrix runner
# without this job tripping.
#
# Closure note (`docs/improvement/test.md` §10 落地完成判定 #2):
# this workflow is the "nightly CI 跑 `code_ui_remote_model_generation_matrix`
# 至少连续 5 天通过率 ≥ 90%" mechanism. The 5-day-90% threshold
# is satisfied by inspecting the workflow's recent run history
# (Actions tab → "Model generation L3 (nightly + manual)").

on:
  schedule:
    # Daily at 03:00 UTC. Trim or extend cadence as needed; the
    # roadmap closure criterion only asks for ≥90% over 5 days.
    - cron: "0 3 * * *"
  workflow_dispatch: {}

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

jobs:
  model-generation:
    name: code_ui_remote_model_generation_matrix
    runs-on: [self-hosted]
    timeout-minutes: 60

    env:
      CARGO_TERM_COLOR: always

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          submodules: recursive

      - name: Skip if DEEPSEEK_API_KEY is not configured
        id: gate
        env:
          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
        run: |
          if [ -z "${DEEPSEEK_API_KEY}" ]; then
            echo "::warning::DEEPSEEK_API_KEY secret is not configured for this repository; skipping model generation matrix."
            echo "skip=true" >> "${GITHUB_OUTPUT}"
          else
            echo "skip=false" >> "${GITHUB_OUTPUT}"
          fi

      - name: Install stable toolchain
        if: steps.gate.outputs.skip != 'true'
        run: |
          rustup toolchain install stable --profile minimal
          rustup default stable

      - name: Write .env.test from secrets
        if: steps.gate.outputs.skip != 'true'
        env:
          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
          DEEPSEEK_BASE_URL: ${{ secrets.DEEPSEEK_BASE_URL }}
        run: |
          cat > .env.test <<'ENVEOF'
          # Generated by .github/workflows/model-generation-nightly.yml
          # Do NOT commit. The workflow rewrites this on every run.
          LIBRA_CODE_TEST_PROVIDER=deepseek
          LIBRA_CODE_TEST_MODEL=deepseek-v4-flash
          ENVEOF
          # Append the secret-derived keys without echoing them
          # to the workflow log.
          printf 'DEEPSEEK_API_KEY=%s\n' "${DEEPSEEK_API_KEY}" >> .env.test
          if [ -n "${DEEPSEEK_BASE_URL}" ]; then
            printf 'DEEPSEEK_BASE_URL=%s\n' "${DEEPSEEK_BASE_URL}" >> .env.test
          fi

      - name: Run model_generation matrix
        if: steps.gate.outputs.skip != 'true'
        env:
          LIBRA_RUN_LIVE: "1"
          LIBRA_ENABLE_TEST_PROVIDER: "1"
        run: |
          cargo test --features test-provider \
            --test code_ui_remote_model_generation_matrix \
            -- --ignored --test-threads=1 --nocapture

      - name: Scrub .env.test
        if: always() && steps.gate.outputs.skip != 'true'
        run: rm -f .env.test
