geointel/.gitea/workflows/release-gates.yml

name: GeoIntel release gates

on:
  push:
    branches: [main, develop, "codex/**", "build/**"]
  pull_request:
    branches: [main, develop]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: geointel-release-${{ gitea.ref }}
  cancel-in-progress: true

jobs:
  source-trust:
    name: Trusted workflow source
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Accept trusted push and manual runs
        if: ${{ gitea.event_name != 'pull_request' }}
        run: echo "Trusted non-PR workflow source."
      - name: Require a same-repository pull request
        if: ${{ gitea.event_name == 'pull_request' }}
        env:
          HEAD_REPOSITORY: ${{ gitea.event.pull_request.head.repo.full_name }}
          TARGET_REPOSITORY: ${{ gitea.repository }}
        run: |
          set -euo pipefail
          test -n "$HEAD_REPOSITORY"
          if [ "$HEAD_REPOSITORY" != "$TARGET_REPOSITORY" ]; then
            echo "Docker-capable release validation refuses forked pull requests." >&2
            exit 1
          fi
          echo "Trusted same-repository pull request."

  quality:
    name: Compile, test, contracts and builds
    needs: source-trust
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          persist-credentials: false
      - name: Verified secret scan
        env:
          DOCKER_HOST: tcp://gitea-runner-dind:2375
          DOCKER_TLS_CERTDIR: ""
        run: |
          docker info >/dev/null
          bash scripts/scan_secrets.sh
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: backend/requirements-ci.lock
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - name: Install locked backend dependencies
        run: |
          python -m pip install --disable-pip-version-check --require-hashes -r backend/requirements-ci.lock
          python -m pip install --disable-pip-version-check --no-deps -e backend
      - name: Install locked frontend dependencies
        working-directory: frontend
        run: npm ci
      - name: Verify dependency lock policy
        run: python scripts/verify_python_lock.py
      - name: Run complete release readiness gate
        env:
          PYTHON_BIN: python
        run: bash scripts/run_readiness_check.sh
      - name: Render migration and Compose evidence
        run: |
          mkdir -p artifacts
          cd backend
          python -m alembic upgrade head --sql > ../artifacts/alembic-upgrade.sql
          cd ..
          docker compose config > artifacts/docker-compose.resolved.yml
      - name: Publish quality evidence
        if: always()
        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de
        with:
          name: quality-evidence
          path: |
            artifacts/alembic-upgrade.sql
            artifacts/docker-compose.resolved.yml
          if-no-files-found: warn
          retention-days: 30

  dependency-audit:
    name: Python and npm vulnerability policy
    needs: source-trust
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: backend/requirements-ci.lock
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - name: Audit locked Python dependencies
        run: |
          mkdir -p artifacts
          python -m pip install --disable-pip-version-check pip-audit==2.10.1
          bash scripts/audit_python_dependencies.sh
      - name: Audit locked frontend dependencies
        working-directory: frontend
        run: |
          set +e
          npm ci
          install_status="$?"
          if [ "$install_status" -ne 0 ]; then exit "$install_status"; fi
          npm audit --audit-level=high --json | tee ../artifacts/npm-audit.json
          audit_status="${PIPESTATUS[0]}"
          set -e
          exit "$audit_status"
      - name: Publish dependency evidence
        if: always()
        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de
        with:
          name: dependency-audits
          path: |
            artifacts/pip-audit-full.json
            artifacts/pip-audit-policy.json
            artifacts/npm-audit.json
          if-no-files-found: warn
          retention-days: 30

  container-gis:
    name: GIS image, SBOM and container scan
    needs: source-trust
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          persist-credentials: false
      - name: Build GIS release image
        env:
          RELEASE_SHA: ${{ gitea.sha }}
          DOCKER_HOST: tcp://gitea-runner-dind:2375
          DOCKER_TLS_CERTDIR: ""
        run: |
          docker info >/dev/null
          mkdir -p artifacts
          BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          docker build \
            -f deploy/unraid/Dockerfile.all-in-one \
            --build-arg GEOINTEL_INSTALL_AI=false \
            --build-arg GEOINTEL_BUILD_SHA="$RELEASE_SHA" \
            --build-arg GEOINTEL_BUILD_TIME="$BUILD_TIME" \
            -t "geointel-ci:$RELEASE_SHA-gis" \
            .
          docker image inspect "geointel-ci:$RELEASE_SHA-gis" > artifacts/image-inspect-gis.json
      - name: Generate GIS SPDX SBOM
        env:
          RELEASE_SHA: ${{ gitea.sha }}
          DOCKER_HOST: tcp://gitea-runner-dind:2375
          DOCKER_TLS_CERTDIR: ""
        run: bash scripts/generate_container_sbom.sh "geointel-ci:$RELEASE_SHA-gis"
      - name: Enforce GIS container vulnerability policy
        env:
          RELEASE_SHA: ${{ gitea.sha }}
          DOCKER_HOST: tcp://gitea-runner-dind:2375
          DOCKER_TLS_CERTDIR: ""
        run: bash scripts/scan_container_image.sh "geointel-ci:$RELEASE_SHA-gis"
      - name: Cleanup GIS CI image
        if: always()
        env:
          RELEASE_SHA: ${{ gitea.sha }}
          DOCKER_HOST: tcp://gitea-runner-dind:2375
          DOCKER_TLS_CERTDIR: ""
        run: docker image rm -f "geointel-ci:$RELEASE_SHA-gis" >/dev/null 2>&1 || true
      - name: Publish GIS container evidence
        if: always()
        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de
        with:
          name: container-gis-evidence
          path: |
            artifacts/image-inspect-gis.json
            artifacts/geointel-sbom.spdx.json
            artifacts/geointel-container-vulnerabilities.json
          if-no-files-found: warn
          retention-days: 30

  container-ai:
    name: AI image, SBOM and container scan
    needs: source-trust
    if: ${{ gitea.event_name == 'pull_request' || gitea.ref == 'refs/heads/main' || gitea.event_name == 'workflow_dispatch' }}
    runs-on: ubuntu-latest
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          persist-credentials: false
      - name: Build AI release image
        env:
          RELEASE_SHA: ${{ gitea.sha }}
          DOCKER_HOST: tcp://gitea-runner-dind:2375
          DOCKER_TLS_CERTDIR: ""
        run: |
          docker info >/dev/null
          mkdir -p artifacts
          BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          docker build \
            -f deploy/unraid/Dockerfile.all-in-one \
            --build-arg GEOINTEL_INSTALL_AI=true \
            --build-arg GEOINTEL_BUILD_SHA="$RELEASE_SHA" \
            --build-arg GEOINTEL_BUILD_TIME="$BUILD_TIME" \
            -t "geointel-ci:$RELEASE_SHA-ai" \
            .
          docker image inspect "geointel-ci:$RELEASE_SHA-ai" > artifacts/image-inspect-ai.json
      - name: Generate AI SPDX SBOM
        env:
          RELEASE_SHA: ${{ gitea.sha }}
          DOCKER_HOST: tcp://gitea-runner-dind:2375
          DOCKER_TLS_CERTDIR: ""
        run: bash scripts/generate_container_sbom.sh "geointel-ci:$RELEASE_SHA-ai"
      - name: Enforce AI container vulnerability policy
        env:
          RELEASE_SHA: ${{ gitea.sha }}
          DOCKER_HOST: tcp://gitea-runner-dind:2375
          DOCKER_TLS_CERTDIR: ""
        run: bash scripts/scan_container_image.sh "geointel-ci:$RELEASE_SHA-ai"
      - name: Cleanup AI CI image
        if: always()
        env:
          RELEASE_SHA: ${{ gitea.sha }}
          DOCKER_HOST: tcp://gitea-runner-dind:2375
          DOCKER_TLS_CERTDIR: ""
        run: docker image rm -f "geointel-ci:$RELEASE_SHA-ai" >/dev/null 2>&1 || true
      - name: Publish AI container evidence
        if: always()
        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de
        with:
          name: container-ai-evidence
          path: |
            artifacts/image-inspect-ai.json
            artifacts/geointel-sbom.spdx.json
            artifacts/geointel-container-vulnerabilities.json
          if-no-files-found: warn
          retention-days: 30