name: ci-quality-gates

# The pull-request gate. Everything here blocks a merge.
#
# The job list used to include `gate-matrix-lint`, which ran .github/scripts/verify-gate-matrix.sh
# against .github/ci-gate-matrix.yml: a 1,025-line register of all 107 CI controls, checked for
# consistency against the Gradle task graph and this workflow by a 568-line shell script, which was
# itself checked by contract tests in :app-bootstrap. Adding one check meant editing Gradle, a
# workflow, the matrix, the verifier's expectations and a Java test. The information was already in
# the task graph and the job graph; the matrix was a third copy that had to be kept equal to both.

on:
  pull_request:
  push:
    branches: ["main"]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  TESTCONTAINERS_REUSE_ENABLE: "false"

jobs:
  quality-gates:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Require the committed public-path security baseline
        run: |
          set -euo pipefail
          readonly snapshot='docs/security/public-paths-snapshot.txt'
          if [[ ! -s "${snapshot}" ]]; then
            echo "::error::${snapshot} is missing or empty. CI must not let verifyPublicPathSnapshot create its own first-run baseline."
            exit 1
          fi
          if ! git ls-files --error-unmatch "${snapshot}" >/dev/null 2>&1; then
            echo "::error::${snapshot} exists locally but is not committed."
            exit 1
          fi
      - uses: ./.github/actions/setup-gradle-java
      # `ci`, not `check`. A leaf's `check` is that leaf's — compile, its tests, Spotless, Checkstyle
      # and Error Prone — and the repository-wide gates are named tasks of their own:
      #   ci = every leaf check + architectureCheck + qualityCheck + configContractCheck + qualificationCheck
      # so CI runs strictly more than it used to while `./gradlew :domain-core:check` runs strictly
      # less.
      - name: Run the pull-request gate
        working-directory: src
        run: ./gradlew :ci :verifyPublicPathSnapshot :verifyDependencyLocks --warning-mode=fail --stacktrace
      # build-logic is an included build: its own suite is not reachable from the root project's
      # `check`, so the convention plugins every leaf applies would otherwise ship untested.
      - name: Test the build-logic convention plugins
        working-directory: src
        run: ./gradlew -p build-logic test --stacktrace
      # Named as its own step because nothing else runs it: `check` does not depend on
      # graphqlStableTest, so the lane's required-class guard — the check that its module-boundary
      # suite has not silently stopped being discovered — would protect nothing in CI.
      - name: Qualify the GraphQL Stable lane
        working-directory: src
        run: ./gradlew :adapter:inbound:graphql:graphqlStableTest --stacktrace
      - name: Qualify opt-in inbound transports without skips
        working-directory: src
        run: ./gradlew :conditionalTransportQualification --stacktrace

  redis-sdk:
    # Milestone A of the Redis wrapper/typed API plan: policy catalog, typed API parity, permit
    # provenance, connection isolation, and the executor guard. There is no real-server lane yet.
    #
    # `verifyConfigurationPropertiesProcessor` used to be in this list. It is deleted: the parity it
    # enforced — a leaf declares Spring's configuration processor exactly when it owns
    # @ConfigurationProperties — is now what applying `ca.spring-config` means.
    # `verifyEnvKeys` is no longer named here either; it belongs to :app-bootstrap and runs through
    # `configContractCheck`, which the quality-gates job covers.
    uses: ./.github/workflows/_reusable-gradle.yml
    with:
      tasks: ":shared-contract:edgeRateLimitContractTest"

  optional-platforms:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - uses: ./.github/actions/setup-gradle-java
      - name: Verify the optional gRPC platform build
        working-directory: src
        run: ./gradlew -p optional-platforms ci --stacktrace

  configuration-cache:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - uses: ./.github/actions/setup-gradle-java
      - name: Store configuration cache for the everyday core build
        working-directory: src
        run: >-
          ./gradlew
          :domain-core:check
          :application-core:check
          --configuration-cache
          --configuration-cache-problems=fail
          --stacktrace
      - name: Require configuration-cache reuse
        working-directory: src
        shell: bash
        run: |
          set -euo pipefail
          output="$({ ./gradlew :domain-core:check :application-core:check \
            --configuration-cache --configuration-cache-problems=fail --stacktrace; } 2>&1)"
          printf '%s\n' "${output}"
          grep -Fq 'Reusing configuration cache.' <<<"${output}" || {
            echo '::error::Gradle did not reuse the configuration cache on the second identical build.'
            exit 1
          }

  jpa-candidate-evidence:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - uses: ./.github/actions/setup-gradle-java
      - name: Produce zero-skip JPA candidate manifests
        working-directory: src
        run: >-
          ./gradlew
          :adapter:outbound:persistence-jpa:verifyJpaCandidateEvidence

          --stacktrace
      - name: Retain content-addressed JPA candidate manifests
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v7.0.1
        with:
          name: jpa-candidate-evidence-${{ github.sha }}
          path: src/adapter/outbound/persistence-jpa/build/jpa-evidence/manifests
          if-no-files-found: error
          retention-days: 14

  # Advisory. The quarantine bucket runs so a flaky test is still executed and reported; it never
  # blocks. The 14-day sunset registry that used to make an expired quarantine entry a build failure
  # is gone — it was a 250-line YAML-and-Java parser guarding a registry with zero entries.
  quarantine:
    uses: ./.github/workflows/_reusable-gradle.yml
    with:
      tasks: ":quarantineTest"
      gradle-args: "--stacktrace"
      continue-on-error: true

  release-gate:
    needs:
      - quality-gates
      - redis-sdk
      - jpa-candidate-evidence
      - optional-platforms
      - configuration-cache
    if: always()
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Require every current blocking job to succeed
        env:
          QUALITY_RESULT: ${{ needs.quality-gates.result }}
          REDIS_RESULT: ${{ needs.redis-sdk.result }}
          JPA_CANDIDATE_RESULT: ${{ needs.jpa-candidate-evidence.result }}
          OPTIONAL_PLATFORMS_RESULT: ${{ needs.optional-platforms.result }}
          CONFIGURATION_CACHE_RESULT: ${{ needs.configuration-cache.result }}
        run: |
          set -euo pipefail
          for result in \
            "${QUALITY_RESULT}" \
            "${REDIS_RESULT}" \
            "${JPA_CANDIDATE_RESULT}" \
            "${OPTIONAL_PLATFORMS_RESULT}" \
            "${CONFIGURATION_CACHE_RESULT}"; do
            if [[ "${result}" != "success" ]]; then
              echo "::error::release-gate: required job result was ${result}"
              exit 1
            fi
          done
          echo "release-gate: all current blocking quality jobs succeeded."