# yad-managed-include: yad-checks
# SDLC check gates (Phase 3 build plan §C), as an INCLUDABLE fragment.
# This file is pulled into a repo's existing .gitlab-ci.yml via:
#   include:
#     - local: '.gitlab/ci/yad-checks.yml'
# so wiring NEVER edits the foreign root pipeline beyond adding that one include line.
#
# Merge-safety: these jobs do NOT declare a `stage:` and use `needs: []`, so they run in the
# pipeline's default stage regardless of any `stages:` order the foreign root defines — a foreign
# `stages:` list can neither break them nor reorder them. Job names are yad-prefixed to avoid
# colliding with the host project's own job names.
#
# `image:`/`tags:` live on the .sdlc_mr_only anchor below — NOT a top-level `default:`. An included
# top-level `default:` merges into the HOST root pipeline; if the host already sets a top-level
# `image:`, GitLab rejects the whole config ("image is defined in top-level and 'default:' entry").
# Putting them on the anchor scopes them to the gate jobs (which all `extends: .sdlc_mr_only`) and
# never touches the host root.

.sdlc_mr_only:
  image: node:20
  # Runner selection. These jobs need a docker/dind executor; on instances whose runners are all
  # tag-locked (run_untagged: false) an untagged image job never starts. Set the YAD_RUNNER_TAGS
  # CI/CD variable (Settings → CI/CD → Variables, e.g. `dind_runner`) to route them — it lives in
  # project settings, so it survives every `yad` sync. When unset, current GitLab (>=15) drops the
  # empty-expanded tag so the job runs untagged (gitlab.com shared runners); some older versions
  # instead strand it `pending` — if so, set the variable to a real tag. Single value only:
  # `tags: [$VAR]` is one tag equal to the whole variable, not a comma-split.
  tags: [$YAD_RUNNER_TAGS]
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

variables:
  GIT_DEPTH: "0"   # full history so the gates can diff against the target branch

yad-spec-link:
  extends: .sdlc_mr_only
  needs: []
  script:
    - bash checks/spec-link.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"

yad-contract-check:
  extends: .sdlc_mr_only
  needs: []
  script:
    - bash checks/contract-check.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"

yad-build-test-lint:
  extends: .sdlc_mr_only
  needs: []
  variables:
    YAD_TEST_MAX_WORKERS: "2" # cap jest/vitest test workers in CI; ignored by other runners
  script:
    - npm ci
    - bash checks/build-test-lint.sh

# Phase 6 — feature-thread gates (lineage / seal / hotfix-debt). Build on spec-link's story->epic
# resolution; degrade to a note when the product repo is not reachable from CI.
yad-lineage-check:
  extends: .sdlc_mr_only
  needs: []
  script:
    - bash checks/lineage-check.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"

yad-epic-open:
  extends: .sdlc_mr_only
  needs: []
  script:
    - bash checks/epic-open.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"

yad-reconcile-debt:
  extends: .sdlc_mr_only
  needs: []
  script:
    - bash checks/reconcile-debt-check.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"

# Pattern gates: commit subject + MR title + MR body all follow the convention (profile: code).
yad-commit-message:
  extends: .sdlc_mr_only
  needs: []
  script:
    - bash checks/commit-message.sh --profile code "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"

yad-pr-title:
  extends: .sdlc_mr_only
  needs: []
  script:
    - bash checks/pr-title.sh --profile code "$CI_MERGE_REQUEST_TITLE"

yad-pr-template:
  extends: .sdlc_mr_only
  needs: []
  script:
    - body="$(mktemp)"; printf '%s' "$CI_MERGE_REQUEST_DESCRIPTION" > "$body"
    - bash checks/pr-template.sh --profile code "$body"

# No unverified commits from unverified users: platform-Verified signature + allowlisted author.
# Needs a CI/CD variable GITLAB_TOKEN (or SDLC_API_TOKEN) with read_api scope — CI_JOB_TOKEN cannot
# read the commit-signature API. Without it the job FAILS closed with guidance.
yad-verified-commits:
  extends: .sdlc_mr_only
  needs: []
  script:
    - bash checks/verified-commits.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"