From cfdaa2349ab5b88d72a078e5f1727cc6d2621c4a Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Wed, 26 Aug 2026 23:54:03 +0200
Subject: [PATCH] ci: add managed ChatGPT validation profiles

---
 .gitea/workflows/chatgpt-validation.yml | 107 ++++++++++++++++++++++++
 1 file changed, 107 insertions(+)
 create mode 100644 .gitea/workflows/chatgpt-validation.yml

diff --git a/.gitea/workflows/chatgpt-validation.yml b/.gitea/workflows/chatgpt-validation.yml
new file mode 100644
index 00000000..a6b38ae4
--- /dev/null
+++ b/.gitea/workflows/chatgpt-validation.yml
@@ -0,0 +1,107 @@
+name: ChatGPT validation
+
+on:
+  workflow_dispatch:
+    inputs:
+      profile:
+        description: Allowlisted validation profile
+        required: true
+        type: choice
+        options:
+          - test
+          - lint
+          - typecheck
+          - build
+          - security
+          - full
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: "3.11"
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: "20"
+      - name: Install locked dependencies
+        run: |
+          set -euo pipefail
+          python -m pip install --disable-pip-version-check --require-hashes -r backend/requirements-ci.lock
+          python -m pip install --disable-pip-version-check --no-deps -e backend
+          (cd frontend && npm ci)
+      - name: Run bounded profile
+        shell: bash
+        env:
+          VALIDATION_PROFILE: ${{ inputs.profile }}
+          PYTHON_BIN: python
+        run: |
+          set -euo pipefail
+          profile="${VALIDATION_PROFILE}"
+          case "${profile}" in
+            test|lint|typecheck|build|security|full) ;;
+            *) echo "Profile is not allowlisted" >&2; exit 2 ;;
+          esac
+
+          run_test() {
+            (cd backend && python -m pytest -W error::DeprecationWarning)
+            (cd frontend && npm run test:unit)
+          }
+
+          run_lint() {
+            python scripts/check_repository_hygiene.py
+            python scripts/check_architecture_budgets.py
+            python scripts/verify_supply_chain_pins.py
+            python -m ruff check backend/app scripts --select E9,F63,F7,F82
+            (cd frontend && npm run lint)
+          }
+
+          run_typecheck() {
+            python -m compileall -q backend/app
+            (cd frontend && npm run typecheck)
+          }
+
+          run_build() {
+            (cd frontend && npm run build)
+            docker compose config >/dev/null
+            docker compose -f docker-compose.unraid.yml config >/dev/null
+          }
+
+          run_security() {
+            bash scripts/scan_secrets.sh
+            python scripts/verify_security_exceptions.py
+            python -m pip install --disable-pip-version-check pip-audit==2.10.1
+            bash scripts/audit_python_dependencies.sh
+            set +e
+            (cd frontend && npm audit --audit-level=high --json) | tee artifacts/npm-audit-managed.json
+            audit_status="${PIPESTATUS[0]}"
+            set -e
+            if [ "$audit_status" -ne 0 ]; then
+              echo "npm audit policy failed; full JSON is printed above." >&2
+              exit "$audit_status"
+            fi
+          }
+
+          case "${profile}" in
+            test) run_test ;;
+            lint) run_lint ;;
+            typecheck) run_typecheck ;;
+            build) run_build ;;
+            security) run_security ;;
+            full)
+              run_lint
+              run_typecheck
+              run_test
+              run_build
+              run_security
+              bash scripts/run_readiness_check.sh
+              ;;
+          esac