# Self-Healing CI Pipeline (T-13, P-005 Compliant)
#
# Features:
# - Zero-tolerance: zero warnings, zero errors, zero failing tests
# - Self-healing: auto-fixes lint/format issues, commits fixes, re-verifies
# - Verify-all gate: final job checks ALL jobs passed before merge
# - Parallel Python + Frontend testing
# - Security scanning (Bandit, npm audit)
# - Full verification report on every PR
#
# Architecture:
# - Phase 1: Parallel jobs (Python, Frontend, Security, Docker)
# - Phase 2: Verification gate (ensures all Phase 1 jobs passed)

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: write
  pull-requests: write
  checks: write

env:
  PYTHON_VERSION: "3.12"
  NODE_VERSION: "22"

jobs:
  # ═══════════════════════════════════════════════════════════════════
  # Phase 1: Python Jobs
  # ═══════════════════════════════════════════════════════════════════

  python-typecheck:
    name: Python Type Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install package with dev deps
        run: pip install -e ".[dev]"

      - name: MyPy type check
        run: |
          mypy llmhosts/ --ignore-missing-imports 2>&1 | tee /tmp/mypy.txt
          EXIT_CODE=${PIPESTATUS[0]}

          if [ $EXIT_CODE -ne 0 ]; then
            echo "::error::Type check failed with errors:"
            cat /tmp/mypy.txt
            exit 1
          fi

          # Check for warnings (if mypy is configured to show them)
          if grep -qi "warning" /tmp/mypy.txt; then
            echo "::warning::Type check produced warnings:"
            grep -i "warning" /tmp/mypy.txt
          fi

          echo "::notice::Python type check passed"

  python-lint:
    name: Python Lint (Self-Healing)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.head_ref || github.ref_name }}
          token: ${{ secrets.GITHUB_TOKEN }}

      - uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install ruff
        run: pip install ruff

      - name: Ruff check (first pass)
        id: ruff_check_first
        continue-on-error: true
        run: ruff check --output-format=github . 2>&1 | tee /tmp/ruff-check-first.txt

      - name: Ruff format check (first pass)
        id: ruff_format_first
        continue-on-error: true
        run: ruff format --check . 2>&1 | tee /tmp/ruff-format-first.txt

      - name: Auto-fix lint and format errors
        id: autofix
        if: steps.ruff_check_first.outcome == 'failure' || steps.ruff_format_first.outcome == 'failure'
        run: |
          echo "::warning::Ruff check or format failed. Attempting auto-fix..."

          # Auto-fix lint errors
          ruff check --fix . 2>&1 | tee /tmp/ruff-fix.txt || true

          # Auto-format code
          ruff format . 2>&1 | tee /tmp/ruff-format-fix.txt || true

          # Re-check lint
          ruff check --output-format=github . 2>&1 | tee /tmp/ruff-check-recheck.txt
          LINT_EXIT=$?

          # Re-check format
          ruff format --check . 2>&1 | tee /tmp/ruff-format-recheck.txt
          FORMAT_EXIT=$?

          if [ $LINT_EXIT -eq 0 ] && [ $FORMAT_EXIT -eq 0 ]; then
            echo "auto_fixed=true" >> $GITHUB_OUTPUT
            echo "::notice::Ruff auto-fixed successfully"
          else
            echo "auto_fixed=false" >> $GITHUB_OUTPUT
            echo "::error::Ruff auto-fix could not resolve all issues:"
            if [ $LINT_EXIT -ne 0 ]; then
              echo "::error::Lint issues remaining:"
              cat /tmp/ruff-check-recheck.txt
            fi
            if [ $FORMAT_EXIT -ne 0 ]; then
              echo "::error::Format issues remaining:"
              cat /tmp/ruff-format-recheck.txt
            fi
            exit 1
          fi

      - name: Commit auto-fixes
        if: steps.autofix.outputs.auto_fixed == 'true' && github.event_name == 'pull_request'
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add -A
          if ! git diff --staged --quiet; then
            git commit -m "fix(python): auto-fix lint/format errors [skip ci]

            Auto-fixed by self-healing CI pipeline.
            See T-13 (Verify Before Done) and P-005 (Self-Healing CI/CD)."
            git push
          fi

      - name: Verify lint clean
        if: steps.ruff_check_first.outcome == 'success' && steps.ruff_format_first.outcome == 'success'
        run: echo "::notice::Python lint passed on first run — zero warnings, zero errors"

  python-test:
    name: Python Tests
    runs-on: ubuntu-latest
    needs: [python-typecheck]
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install package with dev deps
        run: pip install -e ".[dev]"

      - name: Run pytest with coverage
        run: |
          pytest tests/ -v --tb=short --cov=llmhosts --cov-report=term-missing 2>&1 | tee /tmp/pytest.txt
          EXIT_CODE=${PIPESTATUS[0]}

          if [ $EXIT_CODE -ne 0 ]; then
            echo ""
            echo "::error::Tests failed. Full output above."
            echo "::error::Fix all failing tests before merge (T-08, T-13)."
            exit 1
          fi

          echo "::notice::All Python tests passed"

      - name: Upload test output on failure
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: python-test-output
          path: /tmp/pytest.txt
          retention-days: 7

  python-security:
    name: Python Security Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install bandit
        run: pip install bandit

      - name: Bandit security scan
        run: |
          bandit -r llmhosts/ -f json -o bandit-report.json || true
          bandit -r llmhosts/ -ll 2>&1 | tee /tmp/bandit.txt
          EXIT_CODE=${PIPESTATUS[0]}

          if [ $EXIT_CODE -ne 0 ]; then
            echo "::error::Security issues found:"
            cat /tmp/bandit.txt
            exit 1
          fi

          echo "::notice::Python security scan clean"

  # ═══════════════════════════════════════════════════════════════════
  # Phase 1: Frontend Jobs
  # ═══════════════════════════════════════════════════════════════════

  frontend-typecheck:
    name: Frontend Type Check
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: TypeScript strict check
        run: |
          npx tsc --noEmit 2>&1 | tee /tmp/tsc.txt
          EXIT_CODE=${PIPESTATUS[0]}

          if [ $EXIT_CODE -ne 0 ]; then
            echo "::error::Type check failed with errors:"
            cat /tmp/tsc.txt
            exit 1
          fi

          # Verify zero warnings in output
          if grep -qi "warning" /tmp/tsc.txt; then
            echo "::warning::Type check produced warnings:"
            grep -i "warning" /tmp/tsc.txt
          fi

          echo "::notice::Frontend type check passed with zero errors"

  frontend-lint:
    name: Frontend Lint (Self-Healing)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.head_ref || github.ref_name }}
          token: ${{ secrets.GITHUB_TOKEN }}

      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: ESLint check (first pass)
        id: eslint_first
        continue-on-error: true
        run: npm run lint 2>&1 | tee /tmp/eslint-first.txt

      - name: Auto-fix lint errors
        id: autofix
        if: steps.eslint_first.outcome == 'failure'
        run: |
          echo "::warning::ESLint failed. Attempting auto-fix..."

          # Auto-fix with ESLint (Next.js uses flat config)
          npx eslint . --fix 2>&1 | tee /tmp/eslint-fix.txt || true

          # Re-check after fix
          npm run lint 2>&1 | tee /tmp/eslint-recheck.txt
          RECHECK_EXIT=$?

          if [ $RECHECK_EXIT -eq 0 ]; then
            echo "auto_fixed=true" >> $GITHUB_OUTPUT
            echo "::notice::ESLint auto-fixed successfully"
          else
            echo "auto_fixed=false" >> $GITHUB_OUTPUT
            echo "::error::ESLint auto-fix could not resolve all issues:"
            cat /tmp/eslint-recheck.txt
            exit 1
          fi

      - name: Commit auto-fixes
        if: steps.autofix.outputs.auto_fixed == 'true' && github.event_name == 'pull_request'
        run: |
          cd ..  # Go to repo root
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add -A
          if ! git diff --staged --quiet; then
            git commit -m "fix(frontend): auto-fix lint errors [skip ci]

            Auto-fixed by self-healing CI pipeline.
            See T-13 (Verify Before Done) and P-005 (Self-Healing CI/CD)."
            git push
          fi

      - name: Verify lint clean
        if: steps.eslint_first.outcome == 'success'
        run: echo "::notice::Frontend lint passed on first run — zero warnings, zero errors"

  frontend-test:
    name: Frontend Tests
    runs-on: ubuntu-latest
    needs: [frontend-typecheck]
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Run tests with coverage
        run: |
          npm run test:coverage -- --reporter=verbose 2>&1 | tee /tmp/vitest.txt
          EXIT_CODE=${PIPESTATUS[0]}

          if [ $EXIT_CODE -ne 0 ]; then
            echo ""
            echo "::error::Tests failed. Full output above."
            echo "::error::Fix all failing tests before merge (T-08, T-13)."
            exit 1
          fi

          echo "::notice::All frontend tests passed"

      - name: Upload test output on failure
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: frontend-test-output
          path: frontend/tmp/vitest.txt
          retention-days: 7

  frontend-build:
    name: Frontend Build
    runs-on: ubuntu-latest
    needs: [frontend-typecheck, frontend-lint]
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Build (zero-warning policy)
        env:
          SKIP_ENV_VALIDATION: true
        run: |
          npm run build 2>&1 | tee /tmp/build.txt
          BUILD_EXIT=${PIPESTATUS[0]}

          if [ $BUILD_EXIT -ne 0 ]; then
            echo "::error::Build failed."
            cat /tmp/build.txt
            exit 1
          fi

          # Zero-warning enforcement
          WARNING_COUNT=$(grep -ci "warning" /tmp/build.txt || echo "0")
          if [ "$WARNING_COUNT" -gt 0 ]; then
            echo "::error::Build produced $WARNING_COUNT warning(s). Zero-warning policy enforced (T-03):"
            grep -i "warning" /tmp/build.txt
            exit 1
          fi

          echo "::notice::Build succeeded with zero warnings"

  frontend-security:
    name: Frontend Security Scan
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Dependency Audit
        run: |
          npm audit --audit-level=high --omit=dev 2>&1 | tee /tmp/audit.txt
          AUDIT_EXIT=${PIPESTATUS[0]}

          if [ $AUDIT_EXIT -ne 0 ]; then
            echo "::error::Dependency audit found critical/high vulnerabilities:"
            cat /tmp/audit.txt
            exit 1
          fi

          echo "::notice::Dependency audit clean — zero critical/high vulnerabilities"

  # ═══════════════════════════════════════════════════════════════════
  # Phase 1: Lighthouse CI (Core Web Vitals)
  # ═══════════════════════════════════════════════════════════════════

  lighthouse:
    name: Lighthouse CI
    runs-on: ubuntu-latest
    needs: [frontend-build]
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Build Next.js
        env:
          SKIP_ENV_VALIDATION: true
        run: npm run build

      - name: Run Lighthouse CI
        env:
          LHCI_GITHUB_APP_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          npx @lhci/cli autorun 2>&1 | tee /tmp/lhci.txt
          EXIT_CODE=${PIPESTATUS[0]}

          if [ $EXIT_CODE -ne 0 ]; then
            echo "::warning::Lighthouse CI reported issues (non-blocking):"
            cat /tmp/lhci.txt
          else
            echo "::notice::Lighthouse CI passed — Core Web Vitals within budget"
          fi

          # Always exit 0 — Lighthouse is advisory, not blocking
          exit 0

  # ═══════════════════════════════════════════════════════════════════
  # Phase 1: Docker Build
  # ═══════════════════════════════════════════════════════════════════

  docker-build:
    name: Docker Build
    runs-on: ubuntu-latest
    needs: [python-lint, frontend-lint]
    steps:
      - uses: actions/checkout@v6

      - name: Build dev image
        run: docker build -f Dockerfile.dev -t llmhostcom-dev:ci .

      - name: Verify tools in container
        run: |
          docker run --rm --entrypoint "" llmhostcom-dev:ci bash -c '
            python --version &&
            node --version &&
            gh --version &&
            git --version &&
            ruff --version &&
            pytest --version
          '

      - name: Build production image
        run: docker build -f Dockerfile -t llmhosts:ci .

      - name: Verify production image
        run: |
          docker run --rm llmhosts:ci --version

  # ═══════════════════════════════════════════════════════════════════
  # Phase 1: E2E CLI (TestPyPI install + server + /v1/chat/completions)
  # Runs in Docker per project rules. Issue #133.
  # ═══════════════════════════════════════════════════════════════════

  e2e-cli:
    name: E2E CLI
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install and test CLI (local)
        run: |
          pip install -e ".[dev]" -q
          chmod +x tests/e2e/cli_install.sh
          LLMHOSTS_API_KEY=sk-test-dummy-e2e E2E_PORT=18765 ./tests/e2e/cli_install.sh

  # ═══════════════════════════════════════════════════════════════════
  # Phase 1: Frontend E2E Tests
  # ═══════════════════════════════════════════════════════════════════

  e2e-frontend:
    name: Frontend E2E Tests
    runs-on: ubuntu-latest
    needs: [frontend-build]
    timeout-minutes: 15
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Install Playwright browsers
        run: npx playwright install --with-deps chromium

      - name: Set up test database
        run: |
          npx prisma generate
          npx prisma migrate deploy
          npm run db:seed
        env:
          DATABASE_URL: "file:./prisma/test.db"
          SEED_USER_EMAIL: ${{ secrets.SEED_USER_EMAIL }}
          SEED_USER_PASSWORD: ${{ secrets.SEED_USER_PASSWORD }}

      - name: "Run Playwright E2E (CI smoke: security + accessibility)"
        run: npm run test:e2e:ci
        env:
          PLAYWRIGHT_BASE_URL: "http://localhost:3000"
          SEED_USER_EMAIL: ${{ secrets.SEED_USER_EMAIL }}
          SEED_USER_PASSWORD: ${{ secrets.SEED_USER_PASSWORD }}
          DATABASE_URL: "file:./prisma/test.db"
          SKIP_ENV_VALIDATION: "true"
          NEXTAUTH_SECRET: "ci-test-secret-not-for-production"
          NEXTAUTH_URL: "http://localhost:3000"

      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: playwright-report
          path: frontend/playwright-report/
          retention-days: 7

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: playwright-results
          path: frontend/test-results/
          retention-days: 7

  # ═══════════════════════════════════════════════════════════════════
  # Phase 1: Secret Scanning
  # ═══════════════════════════════════════════════════════════════════

  secret-scan:
    name: Secret Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: GitLeaks scan
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # ═══════════════════════════════════════════════════════════════════
  # Phase 2: VERIFICATION GATE
  # This job checks ALL other jobs passed.
  # It produces the final verification report.
  # ═══════════════════════════════════════════════════════════════════

  verify-all:
    name: ✅ Verification Gate (T-13, P-005)
    runs-on: ubuntu-latest
    needs:
      - python-typecheck
      - python-lint
      - python-test
      - python-security
      - frontend-typecheck
      - frontend-lint
      - frontend-test
      - frontend-build
      - frontend-security
      - docker-build
      - e2e-cli
      - e2e-frontend
      - secret-scan
    if: always()
    steps:
      - name: Generate verification report
        run: |
          echo "## 🔍 Verification Report" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**T-13 (Verify Before Done) & P-005 (Self-Healing CI/CD) Compliance**" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY

          ALL_PASS=true

          # Python checks
          for JOB in python-typecheck python-lint python-test python-security; do
            case $JOB in
              python-typecheck) RESULT="${{ needs.python-typecheck.result }}" ;;
              python-lint) RESULT="${{ needs.python-lint.result }}" ;;
              python-test) RESULT="${{ needs.python-test.result }}" ;;
              python-security) RESULT="${{ needs.python-security.result }}" ;;
            esac

            if [ "$RESULT" = "success" ] || [ "$RESULT" = "skipped" ]; then
              echo "| 🐍 $JOB | ✅ $RESULT |" >> $GITHUB_STEP_SUMMARY
            else
              echo "| 🐍 $JOB | ❌ $RESULT |" >> $GITHUB_STEP_SUMMARY
              ALL_PASS=false
            fi
          done

          # Frontend checks
          for JOB in frontend-typecheck frontend-lint frontend-test frontend-build frontend-security; do
            case $JOB in
              frontend-typecheck) RESULT="${{ needs.frontend-typecheck.result }}" ;;
              frontend-lint) RESULT="${{ needs.frontend-lint.result }}" ;;
              frontend-test) RESULT="${{ needs.frontend-test.result }}" ;;
              frontend-build) RESULT="${{ needs.frontend-build.result }}" ;;
              frontend-security) RESULT="${{ needs.frontend-security.result }}" ;;
            esac

            if [ "$RESULT" = "success" ] || [ "$RESULT" = "skipped" ]; then
              echo "| ⚛️ $JOB | ✅ $RESULT |" >> $GITHUB_STEP_SUMMARY
            else
              echo "| ⚛️ $JOB | ❌ $RESULT |" >> $GITHUB_STEP_SUMMARY
              ALL_PASS=false
            fi
          done

          # Infrastructure checks
          DOCKER_RESULT="${{ needs.docker-build.result }}"
          E2E_CLI_RESULT="${{ needs.e2e-cli.result }}"
          SECRET_RESULT="${{ needs.secret-scan.result }}"

          if [ "$DOCKER_RESULT" = "success" ] || [ "$DOCKER_RESULT" = "skipped" ]; then
            echo "| 🐳 docker-build | ✅ $DOCKER_RESULT |" >> $GITHUB_STEP_SUMMARY
          else
            echo "| 🐳 docker-build | ❌ $DOCKER_RESULT |" >> $GITHUB_STEP_SUMMARY
            ALL_PASS=false
          fi

          # e2e-cli requires llmhosts on TestPyPI; non-blocking until then
          if [ "$E2E_CLI_RESULT" = "success" ] || [ "$E2E_CLI_RESULT" = "skipped" ]; then
            echo "| 📦 e2e-cli | ✅ $E2E_CLI_RESULT |" >> $GITHUB_STEP_SUMMARY
          else
            echo "| 📦 e2e-cli | ⚠️ $E2E_CLI_RESULT (non-blocking until TestPyPI publish) |" >> $GITHUB_STEP_SUMMARY
          fi

          if [ "$SECRET_RESULT" = "success" ] || [ "$SECRET_RESULT" = "skipped" ]; then
            echo "| 🔒 secret-scan | ✅ $SECRET_RESULT |" >> $GITHUB_STEP_SUMMARY
          else
            echo "| 🔒 secret-scan | ❌ $SECRET_RESULT |" >> $GITHUB_STEP_SUMMARY
            ALL_PASS=false
          fi

          E2E_FRONTEND_RESULT="${{ needs.e2e-frontend.result }}"
          if [ "$E2E_FRONTEND_RESULT" = "success" ] || [ "$E2E_FRONTEND_RESULT" = "skipped" ]; then
            echo "| 🎭 e2e-frontend | ✅ $E2E_FRONTEND_RESULT |" >> $GITHUB_STEP_SUMMARY
          else
            echo "| 🎭 e2e-frontend | ⚠️ $E2E_FRONTEND_RESULT (non-blocking until CI secrets configured) |" >> $GITHUB_STEP_SUMMARY
          fi

          echo "" >> $GITHUB_STEP_SUMMARY

          if [ "$ALL_PASS" = "true" ]; then
            echo "**Result: ✅ All checks passed. Merge-ready.**" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "**Self-Healing Actions Taken:** Check individual job logs for auto-fixes." >> $GITHUB_STEP_SUMMARY
            echo "::notice::All CI checks passed. PR is verified and merge-ready."
          else
            echo "**Result: ❌ One or more checks failed. Fix required.**" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "Review failed jobs above. Self-healing may have committed fixes — pull latest changes." >> $GITHUB_STEP_SUMMARY
            echo "::error::Verification gate failed. Fix all issues before merge."
            exit 1
          fi
