name: grade
on: [push]

# Production wiring (forgejo-runner on ghost):
#   - forgejo-runner v13 config: docker_host: automount -> the job container
#     gets the host docker socket, so `docker run` drives the host daemon
#   - the nested grade container mounts the secret + hidden tests straight from
#     the host (/opt/grade/grade.env, /opt/grade-hidden/...) — never in this
#     repo, no job-container options, no Actions secrets required
jobs:
  grade:
    runs-on: docker
    container:
      image: gitea/runner-images:ubuntu-22.04
    steps:
      - uses: https://data.forgejo.org/actions/checkout@v6
      - name: Probe workspace
        run: |
          echo "WS=$GITHUB_WORKSPACE" > /diag/probe.txt; ls -la "$GITHUB_WORKSPACE" >> /diag/probe.txt 2>&1; docker run --rm -v "$PWD":/probe -v /opt/grade/runner-diag:/diag gitea/runner-images:ubuntu-22.04 sh -c 'echo "PWD_IN_JOB=$PWD" >> /diag/probe.txt; ls /probe >> /diag/probe.txt'
      - name: Grade (blank fails, solved passes)
        run: |
          docker run --rm --network=none \
            -v "$PWD":/work \
            -v /opt/grade/grade.env:/run/secrets/grade.env:ro \
            -v /opt/grade-hidden/cs2060/record-manager:/hidden:ro \
            -v /opt/grade/runner-diag:/diag \
            grade-c:dev \
            sh -c 'set -a; . /run/secrets/grade.env; set +a; { echo "SECRET_LEN=${#GRADE_HMAC_SECRET}"; python3 /opt/grade/grade_cli.py run --student /work --hidden /hidden --course CS2060 --assignment record-manager --out /work/results.json; } 2>&1 | tee /diag/latest.log'
          echo "job-step exit=$?"