on:
  push:

jobs:
  pre-job:
    runs-on: docker
    container:
      image: data.forgejo.org/oci/node:22-bookworm
    outputs:
      dynamic: "${{ steps.dynamic-step.outputs.dynamic }}"
    steps:
      - id: dynamic-step
        run: echo "dynamic=dynamic output" >> $FORGEJO_OUTPUT

  layer-1:
    needs: [pre-job]
    uses: ./.forgejo/workflows/reusable-layer-1.yml
    with:
      input1: top-level-input1
      input3: ${{ needs.pre-job.outputs.dynamic }}
    secrets:
      secret1: AAAA
      secret2: BBBB1234

  verify:
    needs: [layer-1]
    runs-on: docker
    container:
      image: data.forgejo.org/oci/node:22-bookworm
      volumes:
        - /srv/example:/srv/example
    steps:
      - name: verify test config secret
        run: |
          set -x
          # SECRET3 is set on the repo, but not passed into `reusable-layer-1.yml` so that we can test secrets don't
          # leak into the workflow if they're not explicitly defined. This check verifies that the test environment has
          # that secret, otherwise the test assertions that it isn't present within the workflow would be meaningless.
          test "CCCC" = "${{ secrets.secret3 }}"
      - name: verify callee-[0-4] completed
        run: |
          set -x
          test -f /srv/example/callee-1
          test -f /srv/example/callee-2
          test -f /srv/example/callee-3
          test -f /srv/example/callee-4
      - name: verify workflow outputs
        run: |
          set -x
          test "callee-1-output" = "${{ needs.layer-1.outputs.output1 }}"
          test "callee-2-output" = "${{ needs.layer-1.outputs.output2 }}"
          test "callee-3-output" = "${{ needs.layer-1.outputs.output3 }}"
          test "callee-4-output" = "${{ needs.layer-1.outputs.output4 }}"