# yad-managed-include: yad-checks
# SDLC check gates (Phase 3 build plan §C), as an INCLUDABLE fragment.
# This file is pulled into a repo's existing .gitlab-ci.yml via:
#   include:
#     - local: '.gitlab/ci/yad-checks.yml'
# so wiring NEVER edits the foreign root pipeline beyond adding that one include line.
#
# Merge-safety: these jobs do NOT declare a `stage:` and use `needs: []`, so they run in the
# pipeline's default stage regardless of any `stages:` order the foreign root defines — a foreign
# `stages:` list can neither break them nor reorder them. Job names are yad-prefixed to avoid
# colliding with the host project's own job names.
#
# `image:`/`tags:` live on the .sdlc_mr_only anchor below — NOT a top-level `default:`. An included
# top-level `default:` merges into the HOST root pipeline; if the host already sets a top-level
# `image:`, GitLab rejects the whole config ("image is defined in top-level and 'default:' entry").
# Putting them on the anchor scopes them to the gate jobs (which all `extends: .sdlc_mr_only`) and
# never touches the host root. The same goes for the gate jobs' own variables (`YAD_NODE_VERSION`,
# `NX_BASE`, `NX_HEAD`): an included top-level `variables:` merges into the host's globals, where a
# generic name like NX_BASE can collide with one the host already computes for its own Nx jobs.
# Only `GIT_DEPTH` stays global — the gates need the full history and a host that sets its own wins.

.sdlc_mr_only:
  image: node:${YAD_NODE_VERSION}
  variables:
    # A project/group CI/CD variable overrides a YAML value, so YAD_NODE_VERSION can be changed in
    # project settings without editing the managed fragment (a current 20, 22 or 24 line; Node 25+ has no Corepack).
    YAD_NODE_VERSION: "22"
    NX_BASE: $CI_MERGE_REQUEST_DIFF_BASE_SHA
    NX_HEAD: $CI_COMMIT_SHA
  # Runner selection. These jobs need a docker/dind executor; on instances whose runners are all
  # tag-locked (run_untagged: false) an untagged image job never starts. Set the YAD_RUNNER_TAGS
  # CI/CD variable (Settings → CI/CD → Variables, e.g. `dind_runner`) to route them — it lives in
  # project settings, so it survives every `yad` sync. When unset, current GitLab (>=15) drops the
  # empty-expanded tag so the job runs untagged (gitlab.com shared runners); some older versions
  # instead strand it `pending` — if so, set the variable to a real tag. Single value only:
  # `tags: [$VAR]` is one tag equal to the whole variable, not a comma-split.
  tags: [$YAD_RUNNER_TAGS]
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

variables:
  GIT_DEPTH: "0"   # full history so the gates can diff against the target branch

yad-spec-link:
  extends: .sdlc_mr_only
  needs: []
  script:
    - bash checks/spec-link.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"

yad-contract-check:
  extends: .sdlc_mr_only
  needs: []
  script:
    # E120: check the Product out where .sdlc/product-link.json says, when the YAD_PRODUCT_TOKEN CI/CD
    # variable is set (masked); without it this prints a note and the gate defers, as before.
    - bash checks/product-checkout.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
    - bash checks/contract-check.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"

# E65/E66 — the risk map (.sdlc/risk-map: a risk level per directory, no names). Warnings, and the
# approver count read from the base branch's map. It never fails the pipeline (the count is reported,
# not enforced), so the job needs no allow_failure.
yad-risk-map:
  extends: .sdlc_mr_only
  needs: []
  script:
    - bash checks/risk-map-check.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"

yad-build-test-lint:
  extends: .sdlc_mr_only
  needs: []
  variables:
    YAD_TEST_MAX_WORKERS: "2" # cap jest/vitest test workers in CI; ignored by other runners
  script:
    - bash checks/install-deps.sh
    - bash checks/build-test-lint.sh

# Phase 6 — feature-thread gates (lineage / seal / hotfix-debt). Build on spec-link's story->epic
# resolution; degrade to a note when the product repo is not reachable from CI.
yad-lineage-check:
  extends: .sdlc_mr_only
  needs: []
  script:
    # E120: check the Product out where .sdlc/product-link.json says, when the YAD_PRODUCT_TOKEN CI/CD
    # variable is set (masked); without it this prints a note and the gate defers, as before.
    - bash checks/product-checkout.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
    - bash checks/lineage-check.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"

yad-epic-open:
  extends: .sdlc_mr_only
  needs: []
  script:
    # E120: check the Product out where .sdlc/product-link.json says, when the YAD_PRODUCT_TOKEN CI/CD
    # variable is set (masked); without it this prints a note and the gate defers, as before.
    - bash checks/product-checkout.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
    - bash checks/epic-open.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"

yad-reconcile-debt:
  extends: .sdlc_mr_only
  needs: []
  script:
    # E120: check the Product out where .sdlc/product-link.json says, when the YAD_PRODUCT_TOKEN CI/CD
    # variable is set (masked); without it this prints a note and the gate defers, as before.
    - bash checks/product-checkout.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
    - bash checks/reconcile-debt-check.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"

# Pattern gates: commit subject + MR title + MR body all follow the convention (profile: code).
yad-commit-message:
  extends: .sdlc_mr_only
  needs: []
  script:
    - bash checks/commit-message.sh --profile code "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"

yad-pr-title:
  extends: .sdlc_mr_only
  needs: []
  script:
    - bash checks/pr-title.sh --profile code "$CI_MERGE_REQUEST_TITLE"

yad-pr-template:
  extends: .sdlc_mr_only
  needs: []
  script:
    - body="$(mktemp)"; printf '%s' "$CI_MERGE_REQUEST_DESCRIPTION" > "$body"
    - bash checks/pr-template.sh --profile code "$body"

# No unverified commits: a platform-Verified signature on every commit (write access decides who authors).
# Needs a CI/CD variable GITLAB_TOKEN (or SDLC_API_TOKEN) with read_api scope — CI_JOB_TOKEN cannot
# read the commit-signature API. Without it the job FAILS closed with guidance.
yad-verified-commits:
  extends: .sdlc_mr_only
  needs: []
  script:
    - bash checks/verified-commits.sh "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"