# yad-managed: yad-checks
# SDLC check gates (Phase 3 build plan §C). The three gates run on every PR and must pass before
# merge. They are CI-agnostic bash in checks/ — this workflow just invokes them with the PR base.
# This workflow file is OWNED by yad-checks (the marker on line 1 identifies it). It runs
# independently of any other workflow in .github/workflows/, so wiring never edits a foreign workflow.
name: yad-checks
on:
  pull_request:
    # `edited` (beyond the opened/synchronize/reopened defaults) so a PR title/body correction
    # re-runs the pattern gates without a close/reopen — e.g. fixing a body the pr-template gate held.
    # The commit-range jobs below skip a bare `edited` (only pr-title/pr-template need to re-check).
    types: [opened, synchronize, reopened, edited]
    branches: ["**"]

jobs:
  spec-link:
    runs-on: ubuntu-latest
    if: github.event.action != 'edited'
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: bash checks/spec-link.sh "origin/${{ github.base_ref }}"

  contract-check:
    runs-on: ubuntu-latest
    if: github.event.action != 'edited'
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: bash checks/contract-check.sh "origin/${{ github.base_ref }}"

  build-test-lint:
    runs-on: ubuntu-latest
    if: github.event.action != 'edited'
    env:
      YAD_TEST_MAX_WORKERS: "2" # cap jest/vitest test workers in CI; ignored by other runners
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: actions/setup-node@v4
        with: { node-version: "20", cache: "npm" }
      - run: npm ci # install deps so the real lint/build/test toolchain can run (mirrors the GitLab template)
      - run: bash checks/build-test-lint.sh

  # Phase 6 — feature-thread gates. lineage-check: the change links a real threaded epic. epic-open:
  # a sealed epic (all stories shipped) refuses new behaviour, forcing a change-epic. reconcile-debt:
  # a thread with open hotfix debt is frozen for new changes until paid. All build on spec-link's
  # story->epic resolution and degrade to a note when the product repo is not reachable from CI.
  lineage-check:
    runs-on: ubuntu-latest
    if: github.event.action != 'edited'
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: bash checks/lineage-check.sh "origin/${{ github.base_ref }}"

  epic-open:
    runs-on: ubuntu-latest
    if: github.event.action != 'edited'
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: bash checks/epic-open.sh "origin/${{ github.base_ref }}"

  reconcile-debt:
    runs-on: ubuntu-latest
    if: github.event.action != 'edited'
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: bash checks/reconcile-debt-check.sh "origin/${{ github.base_ref }}"

  # Pattern gates: commit subject + PR title + PR body all follow the convention (profile: code).
  # commit-message reads the commit range, not the title/body — skip it on a bare `edited` event.
  commit-message:
    runs-on: ubuntu-latest
    if: github.event.action != 'edited'
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: bash checks/commit-message.sh --profile code "origin/${{ github.base_ref }}"

  # Pass the title via env (never interpolate untrusted ${{ }} into a run line — injection-safe).
  pr-title:
    runs-on: ubuntu-latest
    env:
      PR_TITLE: ${{ github.event.pull_request.title }}
    steps:
      - uses: actions/checkout@v4
      - run: bash checks/pr-title.sh --profile code "$PR_TITLE"

  pr-template:
    runs-on: ubuntu-latest
    env:
      PR_BODY: ${{ github.event.pull_request.body }}
    steps:
      - uses: actions/checkout@v4
      - run: |
          body="$(mktemp)"; printf '%s' "$PR_BODY" > "$body"
          bash checks/pr-template.sh --profile code "$body"

  # No unverified commits from unverified users: platform-Verified signature + allowlisted author.
  # Reads the commit range, not the title/body — skip it on a bare `edited` event.
  verified-commits:
    runs-on: ubuntu-latest
    if: github.event.action != 'edited'
    permissions:
      contents: read
    env:
      GH_TOKEN: ${{ github.token }} # read-only: gh api commits/<sha> for the Verified badge
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: bash checks/verified-commits.sh "origin/${{ github.base_ref }}"