name: Release quality gate

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: quality-gate-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  quality:
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.14
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22.23.1

      - name: Install frozen dependencies
        run: bun install --frozen-lockfile --ignore-scripts

      - name: Release and package contract tests
        run: bun run check:release

      - name: Scan changed production text for credentials
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          set -euo pipefail
          if ! git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null; then
            BASE_SHA=$(git rev-parse HEAD^)
          fi
          git diff --unified=0 --no-color "$BASE_SHA" "$HEAD_SHA" -- \
            . \
            ':(exclude)test/**' \
            ':(exclude)evals/**' \
            ':(exclude)outputs/**' \
            ':(exclude)lib/diagram-render/dist/**' \
            ':(exclude)skills/*/references/support/**' \
            ':(exclude)docs/gstack-2/BACKLOG-MAP.json' \
            | node .github/scripts/gate-secret-scan.mjs

      - name: Pack, install, and invoke the npm runtime-control package
        run: node .github/scripts/smoke-packed-package.mjs "$GITHUB_WORKSPACE"

      - name: Gate critical dependency advisories
        run: bun audit --audit-level=critical

      - name: Syntax-check runtime JavaScript
        run: find runtime -type f \( -name '*.js' -o -name '*.mjs' \) -print0 | xargs -0 -n1 node --check

      - name: Install ShellCheck
        run: |
          sudo apt-get update
          sudo apt-get install -y shellcheck=0.9.0-1
          shellcheck --version

      - name: ShellCheck release and setup boundaries
        run: >-
          shellcheck --severity=error
          setup
          scripts/build.sh
          scripts/write-version-files.sh
          scripts/gstack2/runtime-install-smoke.sh
          browse/scripts/build-node-server.sh