ci.yml

name: quality

on:
  pull_request:
    branches:
      - dev
      - main

permissions:
  contents: read

concurrency:
  group: quality-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  quality:
    name: quality
    runs-on: ubuntu-24.04
    timeout-minutes: 15

    steps:
      - name: Check out full history
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Require promotion to fast-forward main from dev
        if: github.base_ref == 'main'
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PROMOTION_SOURCE: ${{ github.event.pull_request.head.repo.full_name }}:${{ github.head_ref }}
          PULL_REQUEST: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail
          if [[ "$PROMOTION_SOURCE" != "$GITHUB_REPOSITORY:dev" ]]; then
            echo "::error::main receives only promotions from $GITHUB_REPOSITORY:dev. Target dev instead."
            exit 1
          fi
          if ! git merge-base --is-ancestor "$BASE_SHA" "$HEAD_SHA"; then
            echo "::error::main is not an ancestor of dev. Promotion must be a fast-forward."
            exit 1
          fi
          {
            echo "## Promotion"
            echo
            echo "Fast-forwards main from \`$BASE_SHA\` to the exact dev commit \`$HEAD_SHA\` ($(git rev-list --count "$BASE_SHA..$HEAD_SHA") commits)."
            echo "Once quality passes, run the promote workflow for pull request #$PULL_REQUEST. Promotion publishes no release."
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Install exact Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.4.0

      - name: Validate public contribution text
        env:
          PUBLIC_TITLE: ${{ github.event.pull_request.title }}
          PUBLIC_BODY: ${{ github.event.pull_request.body }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: bun scripts/check-publication.ts --metadata-env --range "$BASE_SHA..HEAD"

      - name: Install exact foundation dependencies
        run: bun install --frozen-lockfile

      - name: Install verified Gitleaks
        env:
          GITLEAKS_ARCHIVE: gitleaks_8.30.1_linux_x64.tar.gz
          GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
          GITLEAKS_VERSION: 8.30.1
        run: |
          set -euo pipefail
          curl --fail --silent --show-error --location \
            --output "$RUNNER_TEMP/$GITLEAKS_ARCHIVE" \
            "https://github.com/gitleaks/gitleaks/releases/download/v$GITLEAKS_VERSION/$GITLEAKS_ARCHIVE"
          printf '%s  %s\n' "$GITLEAKS_SHA256" "$RUNNER_TEMP/$GITLEAKS_ARCHIVE" | sha256sum --check --strict
          tar --extract --gzip --file "$RUNNER_TEMP/$GITLEAKS_ARCHIVE" --directory "$RUNNER_TEMP" gitleaks
          printf '%s\n' "$RUNNER_TEMP" >> "$GITHUB_PATH"

      - name: Install verified actionlint
        env:
          ACTIONLINT_ARCHIVE: actionlint_1.7.12_linux_amd64.tar.gz
          ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
          ACTIONLINT_VERSION: 1.7.12
        run: |
          set -euo pipefail
          curl --fail --silent --show-error --location \
            --output "$RUNNER_TEMP/$ACTIONLINT_ARCHIVE" \
            "https://github.com/rhysd/actionlint/releases/download/v$ACTIONLINT_VERSION/$ACTIONLINT_ARCHIVE"
          printf '%s  %s\n' "$ACTIONLINT_SHA256" "$RUNNER_TEMP/$ACTIONLINT_ARCHIVE" | sha256sum --check --strict
          tar --extract --gzip --file "$RUNNER_TEMP/$ACTIONLINT_ARCHIVE" --directory "$RUNNER_TEMP" actionlint
          printf '%s\n' "$RUNNER_TEMP" >> "$GITHUB_PATH"

      - name: Validate pull request metadata
        if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
        env:
          PR_BODY: ${{ github.event.pull_request.body }}
          PR_TITLE: ${{ github.event.pull_request.title }}
        run: bun scripts/check-pr-metadata.ts

      - name: Validate pull request commits
        # Commits are gated where they enter dev; a promotion carries those same commits.
        if: github.base_ref == 'dev' && github.actor != 'dependabot[bot]'
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: bun scripts/check-commit-range.ts

      - name: Run full quality gate
        env:
          # The product spec gate applies where changes enter dev; promotions carry gated changes.
          ROOTFORM_BASE_SHA: ${{ github.base_ref == 'dev' && github.event.pull_request.base.sha || '' }}
          ROOTFORM_HEAD_BRANCH: ${{ github.base_ref == 'dev' && github.head_ref || '' }}
        run: bun run verify