woodpecker integration

spec/factories/ci_repositories.rb

@@ -0,0 +1,17 @@
+FactoryBot.define do
+  factory :ci_repository, class: "WarpEngine::CiRepository" do
+    sequence(:woodpecker_repo_id) { |n| n }
+    repo_owner { "testorg" }
+    sequence(:repo_name) { |n| "game-#{n}" }
+    platform { "tic80" }
+    active { true }
+
+    trait :with_software do
+      association :software
+    end
+
+    trait :inactive do
+      active { false }
+    end
+  end
+end

spec/models/ci_repository_spec.rb

@@ -0,0 +1,57 @@
+require "rails_helper"
+
+RSpec.describe WarpEngine::CiRepository do
+  describe "validations" do
+    subject { build(:ci_repository) }
+
+    it { is_expected.to validate_presence_of(:woodpecker_repo_id) }
+    it { is_expected.to validate_uniqueness_of(:woodpecker_repo_id) }
+    it { is_expected.to validate_presence_of(:repo_owner) }
+    it { is_expected.to validate_presence_of(:repo_name) }
+    it { is_expected.to validate_presence_of(:platform) }
+
+    it "rejects unsupported platforms" do
+      repo = build(:ci_repository, platform: "amiga")
+      expect(repo).not_to be_valid
+      expect(repo.errors[:platform]).to be_present
+    end
+
+    WarpEngine::PlatformLink::SUPPORTED_PLATFORMS.each do |p|
+      it "accepts #{p}" do
+        repo = build(:ci_repository, platform: p)
+        expect(repo).to be_valid
+      end
+    end
+  end
+
+  describe "#full_name" do
+    it "returns owner/name" do
+      repo = build(:ci_repository, repo_owner: "games", repo_name: "mygame")
+      expect(repo.full_name).to eq("games/mygame")
+    end
+  end
+
+  describe "default_scope" do
+    it "excludes soft-deleted records" do
+      repo = create(:ci_repository)
+      repo.update_column(:deleted_at, Time.current)
+
+      expect(described_class.all).not_to include(repo)
+      expect(described_class.unscoped).to include(repo)
+    end
+  end
+
+  describe ".active" do
+    it "returns only active repos" do
+      active = create(:ci_repository, active: true)
+      inactive = create(:ci_repository, active: false)
+
+      expect(described_class.active).to include(active)
+      expect(described_class.active).not_to include(inactive)
+    end
+  end
+
+  describe "associations" do
+    it { is_expected.to belong_to(:software).optional }
+  end
+end

spec/requests/ci_controller_spec.rb

@@ -0,0 +1,71 @@
+require "rails_helper"
+
+RSpec.describe "CI API", type: :request do
+  before do
+    allow(WarpEngine.config).to receive(:woodpecker_url).and_return("https://ci.test")
+    allow(WarpEngine.config).to receive(:woodpecker_api_token).and_return("wp-token")
+    allow(WarpEngine.config).to receive(:update_secret).and_return("s3cret")
+  end
+
+  describe "GET /api/ci/repos" do
+    it "returns active repos" do
+      repo = create(:ci_repository, repo_name: "mygame", platform: "tic80")
+
+      get "/api/ci/repos"
+
+      expect(response).to have_http_status(:ok)
+      json = JSON.parse(response.body)
+      expect(json.size).to eq(1)
+      expect(json.first["repo_name"]).to eq("mygame")
+    end
+
+    it "returns 503 when woodpecker not configured" do
+      allow(WarpEngine.config).to receive(:woodpecker_url).and_return(nil)
+
+      get "/api/ci/repos"
+
+      expect(response).to have_http_status(:service_unavailable)
+    end
+  end
+
+  describe "GET /api/ci/repos/:id/status" do
+    it "returns repo with pipeline status" do
+      repo = create(:ci_repository, repo_owner: "org", repo_name: "game")
+      client = instance_double(WarpEngine::WoodpeckerClient)
+      allow(WarpEngine::WoodpeckerClient).to receive(:new).and_return(client)
+      allow(client).to receive(:get_pipeline)
+        .and_return({ "number" => 1, "status" => "success" })
+
+      get "/api/ci/repos/#{repo.id}/status"
+
+      expect(response).to have_http_status(:ok)
+      json = JSON.parse(response.body)
+      expect(json["repo"]["repo_name"]).to eq("game")
+    end
+  end
+
+  describe "POST /api/ci/repos/:id/trigger" do
+    it "requires authentication" do
+      repo = create(:ci_repository)
+
+      post "/api/ci/repos/#{repo.id}/trigger"
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+
+    it "triggers a pipeline with valid secret" do
+      repo = create(:ci_repository, repo_owner: "org", repo_name: "game")
+      client = instance_double(WarpEngine::WoodpeckerClient)
+      allow(WarpEngine::WoodpeckerClient).to receive(:new).and_return(client)
+      allow(client).to receive(:trigger_pipeline)
+        .and_return({ "number" => 7, "status" => "pending" })
+
+      post "/api/ci/repos/#{repo.id}/trigger",
+           headers: { "X-Update-Secret" => "s3cret" }
+
+      expect(response).to have_http_status(:ok)
+      json = JSON.parse(response.body)
+      expect(json["triggered"]).to be true
+    end
+  end
+end

spec/services/ci_pipeline_service_spec.rb

@@ -0,0 +1,53 @@
+require "rails_helper"
+
+RSpec.describe WarpEngine::CiPipelineService do
+  let(:client) { instance_double(WarpEngine::WoodpeckerClient) }
+  let(:service) { described_class.new(client: client) }
+
+  describe "#dashboard" do
+    it "returns latest pipeline for each active repo" do
+      repo = create(:ci_repository, repo_owner: "org", repo_name: "game")
+      pipeline = { "number" => 5, "status" => "success", "created_at" => "2026-08-06T12:00:00Z" }
+      allow(client).to receive(:latest_pipeline).with("org", "game").and_return(pipeline)
+
+      entries = service.dashboard
+
+      expect(entries.size).to eq(1)
+      expect(entries.first[:pipeline]["status"]).to eq("success")
+      expect(repo.reload.last_pipeline_status).to eq("success")
+    end
+
+    it "handles API errors gracefully per repo" do
+      create(:ci_repository, repo_owner: "org", repo_name: "broken")
+      allow(client).to receive(:latest_pipeline)
+        .and_raise(WarpEngine::WoodpeckerClient::ApiError.new("fail", status: 500))
+
+      entries = service.dashboard
+
+      expect(entries.size).to eq(1)
+      expect(entries.first[:pipeline]).to be_nil
+    end
+  end
+
+  describe "#trigger" do
+    it "delegates to client" do
+      repo = build(:ci_repository, repo_owner: "org", repo_name: "game")
+      allow(client).to receive(:trigger_pipeline).and_return({ "number" => 6 })
+
+      result = service.trigger(repo, branch: "main")
+
+      expect(result["number"]).to eq(6)
+      expect(client).to have_received(:trigger_pipeline).with("org", "game", branch: "main")
+    end
+  end
+
+  describe "#list_pipelines" do
+    it "returns paginated pipelines" do
+      repo = build(:ci_repository, repo_owner: "org", repo_name: "game")
+      pipelines = [{ "number" => 1 }, { "number" => 2 }]
+      allow(client).to receive(:list_pipelines).with("org", "game", page: 1).and_return(pipelines)
+
+      expect(service.list_pipelines(repo)).to eq(pipelines)
+    end
+  end
+end

spec/services/ci_repo_sync_service_spec.rb

@@ -0,0 +1,81 @@
+require "rails_helper"
+
+RSpec.describe WarpEngine::CiRepoSyncService do
+  let(:client) { instance_double(WarpEngine::WoodpeckerClient) }
+  let(:service) { described_class.new(client: client) }
+
+  describe "#sync_all" do
+    it "creates new CiRepository records from Woodpecker" do
+      allow(client).to receive(:list_repos).and_return([
+        { "id" => 1, "name" => "mygame", "owner" => "org", "active" => true }
+      ])
+
+      result = service.sync_all
+
+      expect(result[:created].size).to eq(1)
+      repo = result[:created].first
+      expect(repo.repo_name).to eq("mygame")
+      expect(repo.repo_owner).to eq("org")
+      expect(repo.active).to be true
+    end
+
+    it "updates existing records" do
+      existing = create(:ci_repository, woodpecker_repo_id: 1, repo_name: "old", platform: "tic80")
+      allow(client).to receive(:list_repos).and_return([
+        { "id" => 1, "name" => "newname", "owner" => "org", "active" => true }
+      ])
+
+      result = service.sync_all
+
+      expect(result[:updated].size).to eq(1)
+      expect(existing.reload.repo_name).to eq("newname")
+    end
+
+    it "deactivates repos missing from Woodpecker" do
+      orphan = create(:ci_repository, woodpecker_repo_id: 99, active: true)
+      allow(client).to receive(:list_repos).and_return([])
+
+      result = service.sync_all
+
+      expect(result[:deactivated]).to include(orphan)
+      expect(orphan.reload.active).to be false
+    end
+
+    it "auto-detects platform from matching Software" do
+      create(:software, name: "mygame", platform: "godot")
+      allow(client).to receive(:list_repos).and_return([
+        { "id" => 1, "name" => "mygame", "owner" => "org", "active" => true }
+      ])
+
+      result = service.sync_all
+
+      expect(result[:created].first.platform).to eq("godot")
+      expect(result[:created].first.software).to be_present
+    end
+  end
+
+  describe "#activate" do
+    it "calls client and syncs the repo" do
+      allow(client).to receive(:activate_repo).with(42)
+      allow(client).to receive(:get_repo).with(42).and_return(
+        { "id" => 42, "name" => "game", "owner" => "org", "active" => true }
+      )
+
+      repo = service.activate(42)
+
+      expect(repo.woodpecker_repo_id).to eq(42)
+      expect(repo.active).to be true
+    end
+  end
+
+  describe "#deactivate" do
+    it "calls client and marks repo inactive" do
+      repo = create(:ci_repository, woodpecker_repo_id: 42, active: true)
+      allow(client).to receive(:deactivate_repo).with(42)
+
+      service.deactivate(42)
+
+      expect(repo.reload.active).to be false
+    end
+  end
+end

spec/services/ci_secret_sync_service_spec.rb

@@ -0,0 +1,131 @@
+require "rails_helper"
+
+RSpec.describe WarpEngine::CiSecretSyncService do
+  let(:client) { instance_double(WarpEngine::WoodpeckerClient) }
+  let(:service) { described_class.new(client: client) }
+
+  before do
+    allow(WarpEngine.config).to receive(:application_token_source).and_return(:database)
+    allow(WarpEngine.config).to receive(:application_token_owner_class).and_return("TestOwner")
+  end
+
+  describe "#provision" do
+    it "creates secrets on repos that don't have one" do
+      repo = create(:ci_repository)
+      allow(client).to receive(:list_secrets).with(repo.woodpecker_repo_id).and_return([])
+      allow(client).to receive(:create_secret)
+
+      result = service.provision("plaintoken", repos: [ repo ])
+
+      expect(result[:synced]).to eq([ repo ])
+      expect(client).to have_received(:create_secret).with(
+        repo.woodpecker_repo_id, name: "application_token", value: "plaintoken"
+      )
+    end
+
+    it "updates secrets on repos that already have one" do
+      repo = create(:ci_repository)
+      allow(client).to receive(:list_secrets).with(repo.woodpecker_repo_id)
+        .and_return([ { "name" => "application_token" } ])
+      allow(client).to receive(:update_secret)
+
+      result = service.provision("newtoken", repos: [ repo ])
+
+      expect(result[:synced]).to eq([ repo ])
+      expect(client).to have_received(:update_secret).with(
+        repo.woodpecker_repo_id, "application_token", value: "newtoken"
+      )
+    end
+
+    it "records failed repos without raising" do
+      repo = create(:ci_repository)
+      allow(client).to receive(:list_secrets).and_raise(
+        WarpEngine::WoodpeckerClient::ConnectionError, "unreachable"
+      )
+
+      result = service.provision("tok", repos: [ repo ])
+
+      expect(result[:synced]).to be_empty
+      expect(result[:failed].size).to eq(1)
+    end
+  end
+
+  describe "#deprovision" do
+    it "deletes secrets from all relevant repos" do
+      token = create(:application_token)
+      sw = create(:software, name: "game1", owner: token.owner)
+      repo = create(:ci_repository, :with_software, software: sw)
+
+      allow(client).to receive(:delete_secret)
+
+      service.deprovision(token)
+
+      expect(client).to have_received(:delete_secret).with(repo.woodpecker_repo_id, "application_token")
+    end
+  end
+
+  describe "#rotate" do
+    it "creates new token, provisions, revokes old" do
+      token = create(:application_token)
+      sw = create(:software, name: "game1", owner: token.owner)
+      repo = create(:ci_repository, :with_software, software: sw)
+
+      allow(client).to receive(:list_secrets).and_return([])
+      allow(client).to receive(:create_secret)
+
+      result = service.rotate(token)
+
+      expect(result[:rotated]).to be true
+      expect(result[:new_token]).to be_a(WarpEngine::ApplicationToken)
+      expect(token.reload.deleted_at).to be_present
+    end
+
+    it "rolls back if all repos fail" do
+      token = create(:application_token)
+      sw = create(:software, name: "game1", owner: token.owner)
+      create(:ci_repository, :with_software, software: sw)
+
+      allow(client).to receive(:list_secrets).and_raise(
+        WarpEngine::WoodpeckerClient::ConnectionError, "down"
+      )
+
+      result = service.rotate(token)
+
+      expect(result[:rotated]).to be false
+      expect(token.reload.deleted_at).to be_nil
+    end
+
+    it "returns no-op when no repos exist" do
+      token = create(:application_token)
+
+      result = service.rotate(token)
+
+      expect(result[:rotated]).to be false
+      expect(result[:reason]).to eq("no repos")
+    end
+  end
+
+  describe "#repos_for_token" do
+    it "returns all active repos for unrestricted tokens" do
+      token = create(:application_token, :unrestricted)
+      repo1 = create(:ci_repository)
+      create(:ci_repository, :inactive)
+
+      repos = service.repos_for_token(token)
+
+      expect(repos).to eq([ repo1 ])
+    end
+
+    it "returns only owner's repos for scoped tokens" do
+      token = create(:application_token)
+      own_sw = create(:software, name: "mine", owner: token.owner)
+      other_sw = create(:software, name: "theirs", owner: create(:test_owner))
+      own_repo = create(:ci_repository, :with_software, software: own_sw)
+      create(:ci_repository, :with_software, software: other_sw)
+
+      repos = service.repos_for_token(token)
+
+      expect(repos).to eq([ own_repo ])
+    end
+  end
+end

spec/services/woodpecker_client_spec.rb

@@ -0,0 +1,119 @@
+require "rails_helper"
+require "webmock/rspec"
+
+RSpec.describe WarpEngine::WoodpeckerClient do
+  let(:base_url) { "https://ci.example.test" }
+  let(:token) { "wp-test-token" }
+  let(:client) { described_class.new(base_url: base_url, token: token) }
+
+  def stub_wp(method, path, status: 200, body: nil, request_body: nil)
+    stub = stub_request(method, "#{base_url}#{path}")
+      .with(headers: { "Authorization" => "Bearer #{token}", "Accept" => "application/json" })
+    stub = stub.with(body: request_body) if request_body
+    stub.to_return(status: status, body: body&.to_json, headers: { "Content-Type" => "application/json" })
+  end
+
+  describe "repos" do
+    it "lists repos" do
+      repos = [{ "id" => 1, "name" => "game1" }]
+      stub_wp(:get, "/api/repos", body: repos)
+
+      expect(client.list_repos).to eq(repos)
+    end
+
+    it "gets a repo" do
+      repo = { "id" => 42, "name" => "mygame" }
+      stub_wp(:get, "/api/repos/42", body: repo)
+
+      expect(client.get_repo(42)).to eq(repo)
+    end
+
+    it "deactivates a repo" do
+      stub_wp(:delete, "/api/repos/42", status: 204)
+
+      expect(client.deactivate_repo(42)).to be_nil
+    end
+  end
+
+  describe "secrets" do
+    it "lists secrets" do
+      secrets = [{ "name" => "application_token" }]
+      stub_wp(:get, "/api/repos/1/secrets", body: secrets)
+
+      expect(client.list_secrets(1)).to eq(secrets)
+    end
+
+    it "creates a secret" do
+      stub_wp(:post, "/api/repos/1/secrets", status: 200, body: { "name" => "application_token" })
+
+      result = client.create_secret(1, name: "application_token", value: "secret123")
+      expect(result["name"]).to eq("application_token")
+    end
+
+    it "updates a secret" do
+      stub_wp(:patch, "/api/repos/1/secrets/application_token", status: 200, body: { "name" => "application_token" })
+
+      result = client.update_secret(1, "application_token", value: "newsecret")
+      expect(result["name"]).to eq("application_token")
+    end
+
+    it "deletes a secret" do
+      stub_wp(:delete, "/api/repos/1/secrets/application_token", status: 204)
+
+      expect(client.delete_secret(1, "application_token")).to be_nil
+    end
+  end
+
+  describe "pipelines" do
+    it "lists pipelines" do
+      pipelines = [{ "number" => 1, "status" => "success" }]
+      stub_wp(:get, "/api/repos/org/game/pipelines?page=1&perPage=25", body: pipelines)
+
+      expect(client.list_pipelines("org", "game")).to eq(pipelines)
+    end
+
+    it "gets latest pipeline" do
+      pipeline = { "number" => 5, "status" => "running" }
+      stub_wp(:get, "/api/repos/org/game/pipelines/latest", body: pipeline)
+
+      expect(client.latest_pipeline("org", "game")).to eq(pipeline)
+    end
+
+    it "triggers a pipeline" do
+      pipeline = { "number" => 6, "status" => "pending" }
+      stub_wp(:post, "/api/repos/org/game/pipelines", body: pipeline)
+
+      expect(client.trigger_pipeline("org", "game", branch: "main")).to eq(pipeline)
+    end
+  end
+
+  describe "error handling" do
+    it "raises ApiError on 404" do
+      stub_wp(:get, "/api/repos/999", status: 404, body: { "error" => "not found" })
+
+      expect { client.get_repo(999) }.to raise_error(WarpEngine::WoodpeckerClient::ApiError) { |e|
+        expect(e.status).to eq(404)
+      }
+    end
+
+    it "raises ApiError on 500" do
+      stub_wp(:get, "/api/repos", status: 500, body: { "error" => "internal" })
+
+      expect { client.list_repos }.to raise_error(WarpEngine::WoodpeckerClient::ApiError) { |e|
+        expect(e.status).to eq(500)
+      }
+    end
+
+    it "raises ConnectionError on connection refused" do
+      stub_request(:get, "#{base_url}/api/repos").to_raise(Errno::ECONNREFUSED)
+
+      expect { client.list_repos }.to raise_error(WarpEngine::WoodpeckerClient::ConnectionError)
+    end
+
+    it "raises ConnectionError on timeout" do
+      stub_request(:get, "#{base_url}/api/repos").to_timeout
+
+      expect { client.list_repos }.to raise_error(WarpEngine::WoodpeckerClient::ConnectionError)
+    end
+  end
+end