# Nova CI Pipeline (dev environment)
#
# This workflow implements the central pipeline contract:
#   pipelines/ci.yml (validated against schemas/pipeline.schema.json)
#
# The same contract is implemented by .github/workflows/ci.yml (GitHub
# Actions, production). Both files must be byte-identical — the only
# declared difference is the forge/runtime, not the stages or commands.
#
# Shell reproducibility: scripts/run_ci.sh runs the same 3 stages locally.
#
# Stages (from the contract):
#   1. lint       — py_compile all Python files
#   2. test       — pytest test suite (offline, no AWS)
#   3. check-only — run_platform.sh --check-only (offline, no AWS)
name: acdl-ci

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Compile all Python files
        run: |
          python3 -m py_compile \
            core/confidence_signal.py \
            core/outbox_writer.py \
            core/output_publisher.py \
            core/contract_resolver.py \
            core/lambda/contract_ingestor.py \
            adapters/terraform/adapter.py \
            adapters/terraform/policy/checkov_adapter.py \
            scripts/push_consumer_image.py

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install Terraform 1.9.*
        run: |
          wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt-get update && sudo apt-get install -y terraform=1.9.*

      - name: Install test dependencies
        run: pip install -r requirements-test.txt

      - name: Install kyverno-json (kj) for policy-engine tests
        run: |
          # v1.25: kyverno-json is the primary policy engine. Tests that
          # require kj skip when absent, so this is best-effort (the suite
          # passes with or without kj). Install is cached via the Go
          # module cache (~/.cache/go-build + ~/go/pkg/mod).
          if command -v go >/dev/null 2>&1; then
            go install github.com/kyverno/kyverno-json/cmd/kj@latest && \
              echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH" || \
              echo "kj install failed; policy-engine tests will skip"
          else
            sudo apt-get update && sudo apt-get install -y golang-go && \
              go install github.com/kyverno/kyverno-json/cmd/kj@latest && \
              echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH" || \
              echo "kj install failed; policy-engine tests will skip"
          fi

      - name: Run pytest
        run: python3 -m pytest tests/ -v --tb=short

  check-only:
    name: Platform check-only (offline)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install Terraform 1.9.*
        run: |
          wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt-get update && sudo apt-get install -y terraform=1.9.*

      - name: Install runtime dependencies
        run: pip install jsonschema pyyaml boto3

      - name: Run platform check-only
        run: bash scripts/run_platform.sh --check-only