name: Managed validation

on:
  pull_request:
  workflow_dispatch:
    inputs:
      profile:
        description: Allowlisted validation profile
        required: true
        default: full
        type: choice
        options: [test, lint, typecheck, build, security, full]

permissions:
  contents: read

concurrency:
  group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
  cancel-in-progress: true

jobs:
  full:
    # Gitea Actions does not consistently evaluate the GitHub-style `||`
    # expression for pull-request runs without workflow inputs.
    name: Managed repository validation
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: backend/requirements-ci.lock
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - name: Validate the requested profile against the real projects
        shell: bash
        env:
          REQUESTED_PROFILE: ${{ inputs.profile }}
        run: |
          set -euo pipefail
          profile="${REQUESTED_PROFILE:-full}"
          case "${profile}" in
            test|lint|typecheck|build|security|full) ;;
            *) echo "Profile is not allowlisted" >&2; exit 2 ;;
          esac

          git diff --check
          if git grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
            echo "Unresolved merge markers detected" >&2
            exit 1
          fi

          # MANAGED_FAST_PATH: documentation and this baseline workflow cannot
          # affect the shipped runtime. Keep the required status check, but do
          # not install toolchains or execute the full product suite.
          if [[ -n "${GITHUB_BASE_REF:-}" ]]; then
            git fetch --no-tags --depth=1 origin "${GITHUB_BASE_REF}"
            managed_base="origin/${GITHUB_BASE_REF}"
            git diff --check "${managed_base}..HEAD"
            mapfile -t managed_changed_files < <(
              git diff --name-only --diff-filter=ACMR "${managed_base}..HEAD"
            )
            managed_runtime_change=0
            for managed_path in "${managed_changed_files[@]}"; do
              case "${managed_path}" in
                *.md|*.mdx|docs/*|.github/ISSUE_TEMPLATE/*|.gitea/ISSUE_TEMPLATE/*|.gitea/runner-scope.sh|.gitea/workflows/managed-validation.yml)
                  ;;
                *)
                  managed_runtime_change=1
                  break
                  ;;
              esac
            done
            if [[ "${#managed_changed_files[@]}" -gt 0 && "${managed_runtime_change}" -eq 0 ]]; then
              printf 'Managed validation fast path: %s non-runtime file(s); full product suite skipped.\n' \
                "${#managed_changed_files[@]}"
              exit 0
            fi
          fi          python scripts/verify_repository_layout.py

          python -m pip install --disable-pip-version-check --require-hashes -r backend/requirements-ci.lock
          python -m pip install --disable-pip-version-check --no-deps -e backend
          (cd frontend && npm ci)

          case "${profile}" in
            test)
              (cd backend && python -m pytest -W error::DeprecationWarning)
              (cd frontend && npm run test:unit)
              ;;
            lint)
              python -m ruff check backend scripts tests
              (cd frontend && npm run lint --if-present)
              ;;
            typecheck)
              (cd frontend && npm run typecheck)
              ;;
            build)
              python -m compileall backend/app
              (cd frontend && npm run build)
              ;;
            security)
              python -m pip install --disable-pip-version-check pip-audit==2.10.1
              bash scripts/audit_python_dependencies.sh
              (cd frontend && npm audit --audit-level=high)
              ;;
            full)
              PYTHON_BIN=python bash scripts/run_readiness_check.sh
              ;;
          esac