name: grade
on: [push]

# Production wiring (gitea-runner on ghost, docker mode):
#   - job container = gitea/runner-images (has docker CLI) + the host docker
#     socket, so docker_grade.sh drives the host daemon exactly as designed
#   - hidden tests mount from the runner host (/opt/grade-hidden) — never in
#     this repo
#   - GRADE_HMAC_SECRET mounts from /opt/grade/grade.env on the runner host
jobs:
  grade:
    runs-on: ubuntu-latest
    container:
      image: gitea/runner-images:ubuntu-22.04
      options: >-
        -v /var/run/docker.sock:/var/run/docker.sock
        -v /opt/grade/grade.env:/run/secrets/grade.env:ro
        -v /opt/grade-hidden:/opt/grade-hidden:ro
    steps:
      - uses: actions/checkout@v4
      - name: Grade (blank fails, solved passes)
        run: |
          set -a; . /run/secrets/grade.env; set +a
          docker run --rm --network=none \
            -v "$PWD":/work \
            -v /opt/grade-hidden/cs2060/record-manager:/hidden:ro \
            -e GRADE_HMAC_SECRET \
            grade-c:dev \
            python3 /opt/grade/grade_cli.py run \
              --student /work --hidden /hidden \
              --course CS2060 --assignment record-manager \
              --out /work/results.json
          echo "--- signed result summary ---"
          head -c 400 results.json