name: Main backstop gate
# GSTA-49 T1b (docs/ship-policy.md#run-a-merge-train). Every push to main is
# covered by a full gate. Under merge trains a train's merges are covered by
# the gate the train already ran on the same trees, so this workflow gates
# main only when no green-train record lists main's tree modulo stamps (a
# merge outside the queue), after any train has finished merging. A red
# backstop writes the freeze record gstack-ship-queue reads. Inert (no paid
# work, nothing written) unless main's .gstack/ship-policy.json declares a
# `train` block; without one the per-PR gates cover main as before.
on:
  push:
    branches: [main]

# One backstop at a time; a newer push waits and the script hands a superseded
# push to it (only the newest pending run is kept).
concurrency:
  group: evals-main-backstop
  cancel-in-progress: false

permissions: {}

jobs:
  backstop:
    runs-on: ubuntu-24.04
    if: github.actor != 'dependabot[bot]'
    # Settle window (60) + the full gate (270) + margin.
    timeout-minutes: 345
    permissions:
      # Pushes the freeze record to refs/notes/gstack-trains.
      contents: write
      # Dispatches the gate and reads train runs and their artifacts.
      actions: write
      checks: read
      # Opens the issue a red backstop names.
      issues: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0

      # Read with git and jq only: without a train block nothing below runs.
      - name: Read the train policy (main)
        id: policy
        run: |
          train=$(git show "${GITHUB_SHA}:.gstack/ship-policy.json" 2>/dev/null | jq -c 'if (.train | type) == "object" then .train else null end' 2>/dev/null || true)
          if [ -z "$train" ] || [ "$train" = null ]; then
            echo "train=false" >> "$GITHUB_OUTPUT"
            echo "- Backstop inert: main's .gstack/ship-policy.json declares no train block; per-PR gates cover main" >> "$GITHUB_STEP_SUMMARY"
          else
            echo "train=true" >> "$GITHUB_OUTPUT"
          fi

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        if: steps.policy.outputs.train == 'true'
        with:
          bun-version: 1.4.2

      - name: Gate main unless a green train covers its tree
        if: steps.policy.outputs.train == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          GSTACK_STATE_ROOT: ${{ runner.temp }}/gstack-state
        run: |
          bun --no-env-file --config=/dev/null --no-install run scripts/train-backstop.ts run --repo "$GITHUB_REPOSITORY" --branch "$GITHUB_REF_NAME" --sha "$GITHUB_SHA" \
            --summary "$GITHUB_STEP_SUMMARY"