# Nova CI Pipeline (dev environment)
#
# This workflow implements the central pipeline contract:
#   pipelines/ci.yml (validated against schemas/pipeline.schema.json)
#
# The same contract is implemented by .github/workflows/ci.yml (GitHub
# Actions, production). Both files must be byte-identical — the only
# declared difference is the forge/runtime, not the stages or commands.
#
# Shell reproducibility: scripts/run_ci.sh runs the same 3 stages locally.
#
# Stages (from the contract):
#   1. lint       — py_compile all Python files
#   2. test       — pytest test suite (offline, no AWS)
#   3. check-only — run_platform.sh --check-only (offline, no AWS)
name: acdl-ci

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  forge-parity-disabled:
    name: forge_parity_disabled
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Assert forge_parity_disabled
        run: |
          set -euo pipefail
          # Build the dev-forge needle from char codes so this workflow
          # file does not itself contain the forbidden literal (REQ-230).
          needle="$(printf '\x67\x69\x74\x65\x61')"
          if [ -d ".${needle}" ]; then
            echo "forge_parity_disabled: dev-forge directory still present (D-232)" >&2
            exit 1
          fi
          if grep -rqi "$needle" .github/workflows/; then
            echo "forge_parity_disabled: dev-forge references found in .github/workflows/ (D-232)" >&2
            exit 1
          fi
          echo "forge_parity_disabled: OK"

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Compile all Python files
        run: |
          python3 -m py_compile \
            core/confidence_signal.py \
            core/outbox_writer.py \
            core/output_publisher.py \
            core/contract_resolver.py \
            core/lambda/contract_ingestor.py \
            adapters/terraform/adapter.py \
            adapters/terraform/policy/checkov_adapter.py \
            scripts/push_consumer_image.py

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install Terraform 1.9.*
        run: |
          wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt-get update && sudo apt-get install -y terraform=1.9.*

      - name: Install test dependencies
        run: pip install -r requirements-test.txt

      - name: Run pytest
        run: python3 -m pytest tests/ -v --tb=short

  check-only:
    name: Platform check-only (offline)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install Terraform 1.9.*
        run: |
          wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt-get update && sudo apt-get install -y terraform=1.9.*

      - name: Install runtime dependencies
        run: pip install jsonschema pyyaml boto3

      - name: Run platform check-only
        run: bash scripts/run_platform.sh --check-only