name: grade
on: [push]

# Production wiring (forgejo-runner on ghost):
#   - the job container IS the grade image (grade-c:dev on the host daemon),
#     so the harness runs directly — no nested docker, no node-dependent actions
#   - the workflow clones the repo itself with Forgejo's built-in token
#     (GITHUB_TOKEN / FORGEJO_TOKEN) — the automatic token has read access
#   - runner.yaml mounts /opt/grade-hidden + /opt/grade/grade.env into every
#     job container (host paths, never in this repo)
jobs:
  grade:
    runs-on: docker
    container:
      image: grade-c:dev
    steps:
      - name: Grade (blank fails, solved passes)
        run: |
          rm -rf /tmp/work && mkdir -p /tmp/work && cd /tmp/work
          git clone -q --depth 1 "https://x:${GITHUB_TOKEN:-$FORGEJO_TOKEN}@git.trevon.dev/${GITHUB_REPOSITORY}.git" .
          set -a; . /run/secrets/grade.env; set +a
          python3 /opt/grade/grade_cli.py run \
            --student . --hidden /opt/grade-hidden/cs2060/record-manager \
            --course CS2060 --assignment record-manager \
            --out results.json 2>&1 | tee /opt/grade/runner-diag/latest.log
          python3 -c "import json; d=json.load(open('results.json'))['result']; print('VERDICT ok=', d['ok'], 'public=', d['tests']['public'], 'hidden=', d['tests']['hidden'])"