name: webrtc-e2e

# Live WebRTC realness check against the shipped patched binary.
#
# Manual (workflow_dispatch) on purpose: it needs a firefox-N binary that
# carries the WebRTC fixes (synthetic srflx in genuine nICEr form + the
# default-route fallback behind a proxy). Run it after publishing such a
# binary — it is the release gate for "WebRTC looks real behind a proxy".
# Until that binary ships, test_not_blocked_behind_tcp_only_socks is EXPECTED
# to fail (the old binary is fully blocked behind a SOCKS proxy), which is the
# whole point of the gate.
#
# No smartproxy / credentials: the "behind a proxy" condition is faked by an
# in-process TCP-only SOCKS5 server (refuses UDP ASSOCIATE) and the egress IP
# is injected as an RFC 5737 TEST-NET address. Fully self-contained.

on:
  workflow_dispatch:

jobs:
  webrtc-e2e:
    name: webrtc realness (ubuntu, py3.12)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python 3.12
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip

      - name: Install package + dev extras
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Fetch the patched Firefox binary
        run: python -m invisible_playwright fetch

      - name: Resolve binary path
        run: echo "STEALTHFOX_E2E_BINARY=$(python -m invisible_playwright path)" >> "$GITHUB_ENV"

      - name: Run WebRTC realness e2e (xvfb for the headless Firefox)
        run: |
          sudo apt-get update && sudo apt-get install -y xvfb
          xvfb-run -a pytest tests/test_webrtc_realness.py -m e2e -o addopts="" -v -rs