name: Bartholomew Continuous SOC 2 & ISO 27001 Evidence Collection

on:
  schedule:
    # Runs daily at 06:00 UTC - satisfies AICPA CC7.1 continuous monitoring
    - cron: '0 6 * * *'
  # Allow manual trigger for on-demand audit evidence generation
  workflow_dispatch:

permissions:
  contents: write

jobs:
  collect-compliance-evidence:
    name: Collect SOC 2 & ISO 27001 Audit Evidence
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Repository at Release Tag
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Runtime & Test Dependencies
        run: |
          python -m pip install --upgrade pip
          pip install --no-cache-dir -r requirements.txt pytest pyyaml

      - name: Generate Merkle-Rooted SOC 2 & ISO 27001 Evidence Record
        id: evidence
        env:
          PYTHONPATH: .
        run: |
          python scripts/collect_compliance_evidence.py

      - name: Display Daily Merkle Receipt
        if: always()
        run: |
          DATE=$(date -u +%Y-%m-%d)
          if [ -f "audit_evidence/daily_receipts/receipt_${DATE}.json" ]; then
            echo "--- Daily Merkle Receipt: $DATE ---"
            cat audit_evidence/daily_receipts/receipt_${DATE}.json
          fi

      - name: Commit & Archive Evidence to Repository
        if: success()
        run: |
          git config user.name "Bartholomew CI Bot"
          git config user.email "ci-bot@bartholomew.info"
          DATE=$(date -u +%Y-%m-%d)
          git add audit_evidence/
          git diff --staged --quiet || git commit -m "evidence(soc2): Daily compliance receipt ${DATE} [automated]"
          git pull --rebase origin main || true
          git push origin main || echo "Note: Push skipped or permissions restricted (artifact saved)."

      - name: Upload Evidence Package as GitHub Artifact
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: soc2-evidence-${{ github.run_number }}
          path: audit_evidence/
          retention-days: 365