name: Managed validation

on:
  pull_request:
  workflow_dispatch:
    inputs:
      profile:
        description: Allowlisted validation profile
        required: true
        default: full
        type: choice
        options: [test, lint, typecheck, build, security, full]

permissions:
  contents: read

concurrency:
  group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
  cancel-in-progress: true

jobs:
  full:
    name: full
    # Public fork code must never execute automatically on the private runner.
    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
    runs-on: ubuntu-latest
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
      - name: Select validation profile
        shell: bash
        env:
          REQUESTED_PROFILE: ${{ inputs.profile }}
        run: |
          set -euo pipefail
          profile="${REQUESTED_PROFILE:-full}"
          case "$profile" in
            test|lint|typecheck|build|security|full) ;;
            *) echo "Profile is not allowlisted" >&2; exit 2 ;;
          esac
          echo "PROFILE=$profile" >> "$GITHUB_ENV"
      - name: Repository boundaries
        shell: bash
        run: |
          set -euo pipefail
          git diff --check
          if git grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
            echo "Unresolved merge markers detected" >&2
            exit 1
          fi

          # MANAGED_FAST_PATH: documentation and this baseline workflow cannot
          # affect the shipped runtime. Keep the required status check, but do
          # not install toolchains or execute the full product suite.
          if [[ -n "${GITHUB_BASE_REF:-}" ]]; then
            git fetch --no-tags --depth=1 origin "${GITHUB_BASE_REF}"
            managed_base="origin/${GITHUB_BASE_REF}"
            git diff --check "${managed_base}..HEAD"
            mapfile -t managed_changed_files < <(
              git diff --name-only --diff-filter=ACMR "${managed_base}..HEAD"
            )
            managed_runtime_change=0
            for managed_path in "${managed_changed_files[@]}"; do
              case "${managed_path}" in
                *.md|*.mdx|docs/*|.github/ISSUE_TEMPLATE/*|.gitea/ISSUE_TEMPLATE/*|.gitea/runner-scope.sh|.gitea/workflows/managed-validation.yml)
                  ;;
                *)
                  managed_runtime_change=1
                  break
                  ;;
              esac
            done
            if [[ "${#managed_changed_files[@]}" -gt 0 && "${managed_runtime_change}" -eq 0 ]]; then
              printf 'Managed validation fast path: %s non-runtime file(s); full product suite skipped.\n' \
                "${#managed_changed_files[@]}"
              exit 0
            fi
          fi          # Checkout recreates only `origin`; restore the documented upstream
          # identity required by the fork-boundary guard. The pinned baseline
          # tag is already part of this repository, so no upstream fetch occurs.
          git remote add upstream https://gitlab.com/CalcProgrammer1/OpenRGB.git
          bash scripts/openrgb-upstream-guard.sh
      - name: Backend environment
        if: "env.PROFILE != 'security'"
        shell: bash
        run: |
          set -euo pipefail
          python3 -m venv "$RUNNER_TEMP/lumaops-python"
          "$RUNNER_TEMP/lumaops-python/bin/python" -m pip install --disable-pip-version-check -e 'lumaops/backend[dev]'
      - name: Backend tests
        if: "env.PROFILE == 'test' || env.PROFILE == 'full'"
        run: |
          "$RUNNER_TEMP/lumaops-python/bin/python" -m pytest lumaops/backend/tests
      - name: Backend lint
        if: "env.PROFILE == 'lint' || env.PROFILE == 'full'"
        run: |
          "$RUNNER_TEMP/lumaops-python/bin/python" -m ruff check lumaops/backend
      - name: Backend typecheck
        if: "env.PROFILE == 'typecheck' || env.PROFILE == 'full'"
        working-directory: lumaops/backend
        run: |
          "$RUNNER_TEMP/lumaops-python/bin/python" -m mypy src
      - name: Frontend dependencies
        if: "env.PROFILE != 'security'"
        working-directory: lumaops/frontend
        run: npm ci --ignore-scripts
      - name: Frontend tests
        if: "env.PROFILE == 'test' || env.PROFILE == 'full'"
        working-directory: lumaops/frontend
        run: npm test
      - name: Frontend lint
        if: "env.PROFILE == 'lint' || env.PROFILE == 'full'"
        working-directory: lumaops/frontend
        run: npm run lint
      - name: Frontend build
        if: "env.PROFILE == 'build' || env.PROFILE == 'typecheck' || env.PROFILE == 'full'"
        working-directory: lumaops/frontend
        run: npm run build
      - name: Dependency audit
        if: "env.PROFILE == 'security' || env.PROFILE == 'full'"
        working-directory: lumaops/frontend
        run: npm audit --omit=dev --audit-level=moderate
      - name: Secret scan
        if: "env.PROFILE == 'security' || env.PROFILE == 'full'"
        shell: bash
        run: |
          set -euo pipefail
          [[ "$(uname -m)" == "x86_64" ]] || { echo "Unsupported Gitleaks runner architecture" >&2; exit 1; }
          gitleaks_version="8.30.0"
          gitleaks_archive="gitleaks_${gitleaks_version}_linux_x64.tar.gz"
          gitleaks_sha256="79a3ab579b53f71efd634f3aaf7e04a0fa0cf206b7ed434638d1547a2470a66e"
          gitleaks_dir="${RUNNER_TEMP}/gitleaks-${gitleaks_version}"
          mkdir -p "${gitleaks_dir}"
          curl --proto '=https' --tlsv1.2 --fail --location --silent --show-error \
            --retry 3 --output "${RUNNER_TEMP}/${gitleaks_archive}" \
            "https://github.com/gitleaks/gitleaks/releases/download/v${gitleaks_version}/${gitleaks_archive}"
          echo "${gitleaks_sha256}  ${RUNNER_TEMP}/${gitleaks_archive}" | sha256sum --check --strict
          tar -xzf "${RUNNER_TEMP}/${gitleaks_archive}" -C "${gitleaks_dir}" gitleaks
          "${gitleaks_dir}/gitleaks" version
          "${gitleaks_dir}/gitleaks" git . --config .gitleaks.toml --redact --no-banner