name: Managed validation

on:
  pull_request:
  workflow_dispatch:
    inputs:
      profile:
        description: Allowlisted validation profile
        required: true
        default: full
        type: choice
        options: [test, lint, typecheck, build, security, full]

permissions:
  contents: read

concurrency:
  group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
  cancel-in-progress: true

jobs:
  full:
    # Gitea Actions does not consistently evaluate the GitHub-style `||`
    # expression for pull-request runs without workflow inputs.
    name: Managed repository validation
    # Public fork code must never execute automatically on the private runner.
    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: backend/requirements-ci.lock
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - name: Validate the requested profile against the real projects
        shell: bash
        env:
          REQUESTED_PROFILE: ${{ inputs.profile }}
        run: |
          set -euo pipefail
          profile="${REQUESTED_PROFILE:-full}"
          case "${profile}" in
            test|lint|typecheck|build|security|full) ;;
            *) echo "Profile is not allowlisted" >&2; exit 2 ;;
          esac

          git diff --check
          if git grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
            echo "Unresolved merge markers detected" >&2
            exit 1
          fi
          python scripts/verify_repository_layout.py

          python -m pip install --disable-pip-version-check --require-hashes -r backend/requirements-ci.lock
          python -m pip install --disable-pip-version-check --no-deps -e backend
          (cd frontend && npm ci)

          case "${profile}" in
            test)
              (cd backend && python -m pytest -W error::DeprecationWarning)
              (cd frontend && npm run test:unit)
              ;;
            lint)
              python -m ruff check backend scripts tests
              (cd frontend && npm run lint --if-present)
              ;;
            typecheck)
              (cd frontend && npm run typecheck)
              ;;
            build)
              python -m compileall backend/app
              (cd frontend && npm run build)
              ;;
            security)
              python -m pip install --disable-pip-version-check pip-audit==2.10.1
              bash scripts/audit_python_dependencies.sh
              (cd frontend && npm audit --audit-level=high)
              ;;
            full)
              PYTHON_BIN=python bash scripts/run_readiness_check.sh
              ;;
          esac