name: fileserver-release

# The gate a release must clear. Its job list is deliberately the same shape as the support matrix:
# nothing may be advertised at a support level whose evidence job is absent here.

on:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  fileserver-full-verification:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Run the architecture-wide dependency and module verification
        working-directory: src
        run: >-
          ./gradlew
          verifyCleanArchitectureDependencies
          --no-daemon
          --stacktrace
      - name: Run the complete fileserver suite across every leaf
        working-directory: src
        run: >-
          ./gradlew
          :application-core:check
          :adapter:inbound:web:check
          :adapter:outbound:fileserver:check
          --no-daemon
          --stacktrace

  fileserver-documentation-gate:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Prove every support claim maps to a job and every endpoint is documented
        working-directory: src
        run: >-
          ./gradlew
          :app-bootstrap:test --tests '*FileserverDocumentationCoverageTest'
          --no-daemon
          --stacktrace

  fileserver-pvc-certification:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      # Two different things, kept apart on purpose. The manifest checks below run everywhere and
      # fail on real drift; the cluster run needs a cluster and is skipped without one. The job
      # used to `test -f` the manifest and report success, which read as "ReadWriteOnce certified"
      # when nothing had been applied anywhere.
      - name: Check the certification manifest still says what the claim depends on
        run: |
          set -euo pipefail
          manifest=infra/fileserver/kubernetes/pvc-certification-job.yaml
          test -f "$manifest"
          grep -q 'kind: PersistentVolumeClaim' "$manifest"
          grep -q 'kind: Job' "$manifest"
          # ReadWriteMany is explicitly not claimed; a manifest that quietly widened the access
          # mode would certify a topology the support matrix says is uncertified.
          grep -q 'ReadWriteOnce' "$manifest"
          ! grep -q 'ReadWriteMany' "$manifest"
      - name: Certify the ReadWriteOnce claim on the release cluster
        id: pvc-cluster-run
        env:
          KUBECONFIG_CONTENT: ${{ secrets.FILESERVER_PVC_KUBECONFIG }}
        run: |
          set -euo pipefail
          if [ -z "${KUBECONFIG_CONTENT:-}" ]; then
            echo "::warning::no release cluster configured; PVC certification was NOT run."
            echo "The support matrix records this profile as Limited for exactly this reason:"
            echo "the cluster result is produced by an operator against a real cluster and read"
            echo "from docs/fileserver/storage-certification.md, not by this job."
            echo "certified=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          printf '%s' "$KUBECONFIG_CONTENT" > /tmp/kubeconfig
          export KUBECONFIG=/tmp/kubeconfig
          kubectl apply -f infra/fileserver/kubernetes/pvc-certification-job.yaml
          kubectl wait --for=condition=complete --timeout=30m job/fileserver-pvc-certification
          kubectl logs job/fileserver-pvc-certification
          echo "certified=true" >> "$GITHUB_OUTPUT"

  fileserver-sensitive-telemetry-scan:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Prove telemetry carries no filename, path, or raw identifier
        working-directory: src
        run: >-
          ./gradlew
          :application-core:test --tests '*FileserverObservabilityTest'
          --no-daemon
          --stacktrace