name: ChatGPT validation

on:
  workflow_dispatch:
    inputs:
      profile:
        description: Allowlisted validation profile
        required: true
        type: choice
        options:
          - test
          - lint
          - typecheck
          - build
          - security
          - full

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
        with:
          python-version: "3.11"
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version: "20"
      - name: Install locked dependencies
        run: |
          set -euo pipefail
          python -m pip install --disable-pip-version-check --require-hashes -r backend/requirements-ci.lock
          python -m pip install --disable-pip-version-check --no-deps -e backend
          (cd frontend && npm ci)
      - name: Run bounded profile
        shell: bash
        env:
          VALIDATION_PROFILE: ${{ inputs.profile }}
          PYTHON_BIN: python
        run: |
          set -euo pipefail
          profile="${VALIDATION_PROFILE}"
          case "${profile}" in
            test|lint|typecheck|build|security|full) ;;
            *) echo "Profile is not allowlisted" >&2; exit 2 ;;
          esac

          run_test() {
            (cd backend && python -m pytest -W error::DeprecationWarning)
            (cd frontend && npm run test:unit)
          }

          run_lint() {
            python scripts/check_repository_hygiene.py
            python scripts/check_architecture_budgets.py
            python scripts/verify_supply_chain_pins.py
            python -m ruff check backend/app scripts --select E9,F63,F7,F82
            (cd frontend && npm run lint)
          }

          run_typecheck() {
            python -m compileall -q backend/app
            (cd frontend && npm run typecheck)
          }

          run_build() {
            (cd frontend && npm run build)
            docker compose config >/dev/null
            docker compose -f docker-compose.unraid.yml config >/dev/null
          }

          run_security() {
            bash scripts/scan_secrets.sh
            python scripts/verify_security_exceptions.py
            python -m pip install --disable-pip-version-check pip-audit==2.10.1
            bash scripts/audit_python_dependencies.sh
            set +e
            (cd frontend && npm audit --audit-level=high --json) | tee artifacts/npm-audit-managed.json
            audit_status="${PIPESTATUS[0]}"
            set -e
            if [ "$audit_status" -ne 0 ]; then
              echo "npm audit policy failed; full JSON is printed above." >&2
              exit "$audit_status"
            fi
          }

          case "${profile}" in
            test) run_test ;;
            lint) run_lint ;;
            typecheck) run_typecheck ;;
            build) run_build ;;
            security) run_security ;;
            full)
              run_lint
              run_typecheck
              run_test
              run_build
              run_security
              bash scripts/run_readiness_check.sh
              ;;
          esac