name: Managed validation

on:
  push:
    branches:
      - main
      - 'codex/**'
      - 'chatgpt/**'
  pull_request:
  workflow_dispatch:
    inputs:
      profile:
        description: Allowlisted validation profile
        required: true
        default: full
        type: choice
        options: [test, lint, typecheck, build, security, full]

permissions:
  contents: read

concurrency:
  group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
  cancel-in-progress: true

jobs:
  full:
    name: full
    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      CI: 'true'
      DATABASE_URL: postgresql://devrunbook:ci-only-password@postgres:5432/devrunbook
      PUBLIC_BASE_URL: http://127.0.0.1:3000
      SESSION_SECRET: ci-only-session-secret-01234567890123456789
      INTEGRATION_ENCRYPTION_KEY: Y2ktb25seS1lbmNyeXB0aW9uLWtleS0wMDAwMDAwMDA=
      INTEGRATION_ENCRYPTION_KEY_VERSION: ci-v1
      CONTENT_ROOT: ${{ gitea.workspace }}/content
      ARTIFACT_ROOT: /tmp/devrunbook-artifacts
      BOOTSTRAP_TOKEN: ci-only-bootstrap-token
    services:
      postgres:
        image: postgres:17.9-bookworm@sha256:47f917f7409eacd22fc5dfb1dee634e1b55cf0c01d1a7eb701be2227a03e0641
        env:
          POSTGRES_DB: devrunbook
          POSTGRES_USER: devrunbook
          POSTGRES_PASSWORD: ci-only-password
        options: >-
          --health-cmd "pg_isready -U devrunbook -d devrunbook"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.18.0
      - name: Validate exact DevRunbook contracts
        shell: bash
        env:
          REQUESTED_PROFILE: ${{ inputs.profile }}
        run: |
          set -euo pipefail
          profile="${REQUESTED_PROFILE:-full}"
          case "${profile}" in
            test|lint|typecheck|build|security|full) ;;
            *) echo "Profile is not allowlisted" >&2; exit 2 ;;
          esac

          git diff --check
          if git grep -nE '^(<<<<<<< |>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
            echo "Unresolved merge markers detected" >&2
            exit 1
          fi

          corepack enable
          corepack prepare pnpm@10.33.0 --activate
          pnpm config set store-dir /tmp/devrunbook-pnpm-store
          pnpm install --frozen-lockfile
          python3 -m venv /tmp/devrunbook-validation-venv
          . /tmp/devrunbook-validation-venv/bin/activate
          python -m pip install --disable-pip-version-check --requirement scripts/requirements-validate.txt
          mkdir -p "${ARTIFACT_ROOT}"

          if [[ "${profile}" == lint ]]; then
            pnpm format:check
            pnpm lint
          elif [[ "${profile}" == typecheck ]]; then
            pnpm typecheck
          elif [[ "${profile}" == test ]]; then
            pnpm test
            python3 scripts/validate_pack.py
            python3 scripts/reference_compose.py --check
            pnpm db:migrate
            pnpm test:integration
          elif [[ "${profile}" == build ]]; then
            pnpm build
          elif [[ "${profile}" == security ]]; then
            pnpm db:migrate
            pnpm test:security
            pnpm audit --prod --audit-level high
          else
            pnpm verify
            pnpm db:migrate
            pnpm test:integration
            pnpm test:security
            pnpm audit --prod --audit-level high
          fi