# Quality gate (fork port wave 2, adapted from time-attack/gstack GStack 2).
#
# Three generic hygiene checks the repo previously had nowhere in CI:
#   1. Credential scan of the PR diff's ADDED lines through our own
#      bin/gstack-redact (HIGH fails the check; MEDIUM is an advisory count —
#      there is no human in CI to confirm, so it never fails here).
#   2. bun audit at critical severity.
#   3. ShellCheck (errors only) on the setup/build shell boundary.
#
# Trigger is `pull_request`, NEVER `pull_request_target`: fork PRs must not
# get secret-bearing contexts. Diff excludes cover the planted-bug fixtures
# and eval baselines that intentionally contain credential-shaped strings.
name: Quality gate

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: quality-gate-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  quality:
    runs-on: ubicloud-standard-8
    timeout-minutes: 10
    steps:
      # Shallow checkout: fetch-depth:0 cost 74s of a 92s job for checks that
      # take ~12s combined. The one history consumer (the added-lines diff)
      # fetches its exact base/head SHAs below — an exact-SHA fetch, not a
      # guessed depth, so long-lived branches and merge queues still resolve.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.13

      - name: Install frozen dependencies
        run: bun install --frozen-lockfile --ignore-scripts

      # Advisory slop scan of branch-changed files. Lived inside `bun run
      # test` before (silently appended, up to 240s invisible in the "~90s
      # suite" claim); decoupling it from the pre-commit loop is only honest
      # if a per-PR path still runs it — this is that path. || true: quality
      # signal, never a gate (/review runs it interactively too).
      - name: Slop scan (changed files, advisory)
        run: bun run slop:diff || true

      - name: Scan changed text for credentials (added lines, own redact engine)
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          set -euo pipefail
          # Exact-SHA shallow fetches: the checkout above is depth-1 of the
          # merge ref; the diff needs the PR head + base objects specifically.
          git fetch --no-tags --depth=1 origin "$HEAD_SHA" 2>/dev/null || true
          git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null \
            || git fetch --no-tags --depth=1 origin "$BASE_SHA" 2>/dev/null || true
          if ! git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null; then
            # push with an unusable `before` (branch create / force push):
            # deepen once so HEAD^ exists as the fallback base.
            git fetch --no-tags --deepen=1 origin 2>/dev/null || true
            BASE_SHA=$(git rev-parse HEAD^)
          fi
          git diff --unified=0 --no-color "$BASE_SHA" "$HEAD_SHA" -- \
            . \
            ':(exclude)test/fixtures/**' \
            ':(exclude)browse/test/fixtures/**' \
            ':(exclude)docs/evals/**' \
            ':(exclude)test/helpers/security-bench*' \
            | node .github/scripts/gate-secret-scan.mjs

      - name: Gate critical dependency advisories
        run: bun audit --audit-level=critical

      - name: Install ShellCheck
        run: |
          sudo apt-get update
          sudo apt-get install -y shellcheck
          shellcheck --version

      - name: ShellCheck setup and build boundaries
        run: >-
          shellcheck --severity=error
          setup
          scripts/build.sh
          scripts/build-app.sh
          scripts/write-version-files.sh
          browse/scripts/build-node-server.sh