name: httpclient-contract

# Per-PR gate for the HTTP Client Platform (design §29). Each transport runs the same semantic
# contract in its own job, so a transport that stops satisfying it fails on its own row instead of
# disappearing into an aggregate run.

on:
  workflow_dispatch:
  pull_request:
    paths:
      - 'src/adapter/outbound/httpclient/**'
      - 'src/app-bootstrap/src/**/httpclient/**'
      - 'docs/httpclient/**'
      - 'scripts/verify-httpclient-docs.py'
      - '.github/workflows/httpclient-contract.yml'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  httpclient-unit-and-boundaries:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Run the focused module suite and the architecture gate
        working-directory: src
        run: >-
          ./gradlew
          :adapter:outbound:httpclient:test
          verifyCleanArchitectureDependencies
          --no-daemon
          --stacktrace

  httpclient-stable-contract:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        transport: [apache, jdk, reactor]
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Certify one transport against the shared contract
        working-directory: src
        run: >-
          ./gradlew
          :adapter:outbound:httpclient:httpClientStableContractTest
          -Phttpclient.contract.transports=${{ matrix.transport }}
          --no-daemon
          --stacktrace

  httpclient-security-and-compatibility:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Run the SSRF, cardinality, and Spring compatibility lanes
        working-directory: src
        run: >-
          ./gradlew
          :adapter:outbound:httpclient:httpClientSecurityTest
          :adapter:outbound:httpclient:httpClientBlockHoundTest
          :adapter:outbound:httpclient:spring62ApiSurfaceScan
          :adapter:outbound:httpclient:spring70CompatibilityTest
          --no-daemon
          --stacktrace

  httpclient-composition:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Verify composition and architecture in the bootstrap module
        working-directory: src
        run: >-
          ./gradlew
          :app-bootstrap:test --tests '*httpclient*' --tests '*CleanArchitectureTest'
          --no-daemon
          --stacktrace