name: ci-quality-gates

# The pull-request gate. Everything here blocks a merge.
#
# The job list used to include `gate-matrix-lint`, which ran .github/scripts/verify-gate-matrix.sh
# against .github/ci-gate-matrix.yml: a 1,025-line register of all 107 CI controls, checked for
# consistency against the Gradle task graph and this workflow by a 568-line shell script, which was
# itself checked by contract tests in :app-bootstrap. Adding one check meant editing Gradle, a
# workflow, the matrix, the verifier's expectations and a Java test. The information was already in
# the task graph and the job graph; the matrix was a third copy that had to be kept equal to both.

on:
  pull_request:
  push:
    branches: ["main"]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  TESTCONTAINERS_REUSE_ENABLE: "false"

jobs:
  quality-gates:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Require the committed public-path security baseline
        run: |
          set -euo pipefail
          readonly snapshot='docs/security/public-paths-snapshot.txt'
          if [[ ! -s "${snapshot}" ]]; then
            echo "::error::${snapshot} is missing or empty. CI must not let verifyPublicPathSnapshot create its own first-run baseline."
            exit 1
          fi
          if ! git ls-files --error-unmatch "${snapshot}" >/dev/null 2>&1; then
            echo "::error::${snapshot} exists locally but is not committed."
            exit 1
          fi
      - uses: ./.github/actions/setup-gradle-java
      # `ci`, not `check`. A leaf's `check` is that leaf's — compile, its tests, Spotless, Checkstyle
      # and Error Prone — and the repository-wide gates are named tasks of their own:
      #   ci = every leaf check + architectureCheck + qualityCheck + configContractCheck
      # so CI runs strictly more than it used to while `./gradlew :domain-core:check` runs strictly
      # less.
      - name: Run the pull-request gate
        working-directory: src
        run: ./gradlew ci verifyPublicPathSnapshot verifyDependencyLocks --warning-mode=fail --no-daemon --stacktrace
      # build-logic is an included build: its own suite is not reachable from the root project's
      # `check`, so the convention plugins every leaf applies would otherwise ship untested.
      - name: Test the build-logic convention plugins
        working-directory: src
        run: ./gradlew -p build-logic test --no-daemon --stacktrace
      # Named as its own step because nothing else runs it: `check` does not depend on
      # graphqlStableTest, so the lane's required-class guard — the check that its module-boundary
      # suite has not silently stopped being discovered — would protect nothing in CI.
      - name: Qualify the GraphQL Stable lane
        working-directory: src
        run: ./gradlew :adapter:inbound:graphql:graphqlStableTest --no-daemon --stacktrace
      - name: Qualify opt-in inbound transports without skips
        working-directory: src
        run: ./gradlew conditionalTransportQualification --no-daemon --stacktrace

  sample-off:
    uses: ./.github/workflows/_reusable-gradle.yml
    with:
      tasks: ":app-bootstrap:sampleOffTest verifyCleanArchitectureDependencies"

  redis-sdk:
    # Milestone A of the Redis wrapper/typed API plan: policy catalog, typed API parity, permit
    # provenance, connection isolation, and the executor guard. There is no real-server lane yet.
    #
    # `verifyConfigurationPropertiesProcessor` used to be in this list. It is deleted: the parity it
    # enforced — a leaf declares Spring's configuration processor exactly when it owns
    # @ConfigurationProperties — is now what applying `ca.spring-config` means.
    # `verifyEnvKeys` is no longer named here either; it belongs to :app-bootstrap and runs through
    # `configContractCheck`, which the quality-gates job covers.
    uses: ./.github/workflows/_reusable-gradle.yml
    with:
      tasks: >-
        :shared-contract:edgeRateLimitContractTest
        :adapter:outbound:cache-redis:check
        :app-bootstrap:verifyEnvKeys
        verifyCleanArchitectureDependencies
        verifyPublicPathSnapshot

  jpa-candidate-evidence:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - uses: ./.github/actions/setup-gradle-java
      - name: Produce zero-skip JPA candidate manifests
        working-directory: src
        run: >-
          ./gradlew
          :adapter:outbound:persistence-jpa:verifyJpaCandidateEvidence
          --no-daemon
          --stacktrace
      - name: Retain content-addressed JPA candidate manifests
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v7.0.1
        with:
          name: jpa-candidate-evidence-${{ github.sha }}
          path: src/adapter/outbound/persistence-jpa/build/jpa-evidence/manifests
          if-no-files-found: error
          retention-days: 14

  # Advisory. The quarantine bucket runs so a flaky test is still executed and reported; it never
  # blocks. The 14-day sunset registry that used to make an expired quarantine entry a build failure
  # is gone — it was a 250-line YAML-and-Java parser guarding a registry with zero entries.
  quarantine:
    uses: ./.github/workflows/_reusable-gradle.yml
    with:
      tasks: quarantineTest
      gradle-args: "--no-daemon"
      continue-on-error: true

  release-gate:
    needs:
      - quality-gates
      - sample-off
      - redis-sdk
      - jpa-candidate-evidence
    if: always()
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: read
    steps:
      - name: Require every current blocking job to succeed
        env:
          QUALITY_RESULT: ${{ needs.quality-gates.result }}
          SAMPLE_OFF_RESULT: ${{ needs.sample-off.result }}
          REDIS_RESULT: ${{ needs.redis-sdk.result }}
          JPA_CANDIDATE_RESULT: ${{ needs.jpa-candidate-evidence.result }}
        run: |
          set -euo pipefail
          for result in \
            "${QUALITY_RESULT}" \
            "${SAMPLE_OFF_RESULT}" \
            "${REDIS_RESULT}" \
            "${JPA_CANDIDATE_RESULT}"; do
            if [[ "${result}" != "success" ]]; then
              echo "::error::release-gate: required job result was ${result}"
              exit 1
            fi
          done
          echo "release-gate: all current blocking quality jobs succeeded."

      # `needs` cannot reach another workflow, so a blocking check in another file has to be required
      # by result. dependency-vulnerability.yml answers the same pull_request and push-to-main
      # triggers as this workflow and trivy-fs carries no `if:` guard, so its check run always exists
      # for this SHA — which is what makes it requirable rather than a matter of scheduling luck.
      # Only `success` passes: a skipped or cancelled security scan is not a scan.
      #
      # The release-tag and path-filtered workflows (release.yml, jpa-release.yml,
      # fileserver-certification.yml, object-storage-qualification.yml, messaging-certification.yml)
      # run on triggers this job does not share, so they cannot be required here without changing
      # when they run. That is a stated gap, not a hidden one.
      - name: Require the cross-workflow release-blocking checks to have succeeded
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          COMMIT_SHA: ${{ github.sha }}
          REQUIRED_CHECKS: trivy-fs
        run: |
          set -euo pipefail
          deadline=$(( $(date +%s) + 1800 ))
          for required in ${REQUIRED_CHECKS}; do
            while :; do
              result="$(
                gh api \
                  "repos/${GH_REPO}/commits/${COMMIT_SHA}/check-runs?check_name=${required}&per_page=100" \
                  --jq '[.check_runs[]] | sort_by(.started_at) | last
                        | if . == null then "absent none"
                          else "\(.status) \(.conclusion // "none")" end'
              )"
              check_status="${result%% *}"
              check_conclusion="${result##* }"
              if [[ "${check_status}" == "completed" ]]; then
                break
              fi
              if (( $(date +%s) >= deadline )); then
                echo "::error::release-gate: release-blocking check ${required} reported no result for ${COMMIT_SHA} (status ${check_status})"
                exit 1
              fi
              echo "release-gate: waiting for ${required} (status ${check_status})"
              sleep 30
            done
            if [[ "${check_conclusion}" != "success" ]]; then
              echo "::error::release-gate: release-blocking check ${required} concluded ${check_conclusion}"
              exit 1
            fi
            echo "release-gate: ${required} concluded success."
          done