# Quality gates — contract drift + tech-debt RED zone.
# Scaffolded by ContextDevKit. Each job FAILS the run on a regression; to make it
# BLOCK merges, add it as a required status check in branch protection.
name: quality

on:
  pull_request:
  push:
    branches: [main, master]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  contract-drift:
    # Fails if a public export was removed/renamed since the committed baseline
    # (contextkit/memory/contract-baseline.json). No-op until you set `l5.contractGlobs`
    # and save a baseline (`contract-scan.mjs --save`).
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 20
      - run: node contextkit/tools/scripts/contract-scan.mjs

  tech-debt:
    # Fails on any RED-zone finding (a file over the hard line-budget limit).
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 20
      # Architecture & Technical Debt Governance Gate (ADR-0122) — the sole CI
      # verdict path. Evaluates real debt across 12 dimensions; line count is an
      # advisory signal only and never blocks. The legacy tech-debt-scan is now
      # report-only (composed inside the gate as the line-count signal collector).
      - run: node contextkit/tools/scripts/architecture-debt-gate.mjs --ci

  project-map:
    # Fails if the committed structural map is STALE or an architectural-fitness
    # rule is violated (ADR-0046). No-op until a map exists; rule enforcement is
    # opt-in (contextkit/memory/project-map/rules.json).
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 20
      - run: node contextkit/tools/scripts/project-map.mjs --check --strict