# The messaging platform's broker certification lane.
#
# Separate from ci-quality-gates.yml because it needs a container runtime and several minutes of it.
# The lane deliberately carries no Docker guard: every other container suite in the messaging tree
# skips with a stated reason when Docker is absent, and a certification lane that skipped would
# report success for a broker nobody started — which is the exact claim the evidence exists to rule
# out.
#
# The job runs the evidence gate rather than the lane, and the gate depends on the lane. What it
# proves is not only that the scenarios pass but that the committed manifest
# (messaging-testkit/src/main/resources/messaging/broker-certification-evidence.jsonl) is what this
# run produced, so "certified against a live broker" cannot be restored by editing a file.
name: messaging-certification

on:
  pull_request:
    paths:
      - "src/messaging/**"
      - ".github/workflows/messaging-certification.yml"
      # Every Gradle job here installs its toolchain through this composite action, so a change to
      # it changes what this gate runs.
      - ".github/actions/setup-gradle-java/action.yml"
  schedule:
    - cron: "41 4 * * 3"
  workflow_dispatch:

permissions:
  contents: read

env:
  # Reuse would hand one scenario the broker another scenario had already faulted.
  TESTCONTAINERS_REUSE_ENABLE: "false"

jobs:
  broker-certification:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Certify the Kafka adapter against a real broker
        working-directory: src
        # GITHUB_SHA is read by the lane and written into every evidence line, because "certified"
        # is a claim about one source tree.
        run: ./gradlew :messaging:messaging-kafka:verifyMessagingCertificationEvidence --no-daemon --stacktrace
      - name: Publish the certification evidence
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact@v4.6.2
        with:
          name: messaging-broker-certification-evidence
          path: src/messaging/messaging-kafka/build/messaging-certification/
          if-no-files-found: warn