name: CI
on:
  pull_request:
    branches: [main]
  merge_group:

permissions:
  contents: read
  checks: write
  pull-requests: write
  issues: write
  statuses: write

jobs:
  cancel-kill-switch:
    name: cancel-kill-switch
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Cancel kill-switch (cancelled marker)
        run: |
          set -euo pipefail
          REF="${{ github.head_ref }}${{ github.ref }}"
          TASK_ID=$(echo "$REF" | grep -oE 'task-[0-9]+' | head -n1 || true)
          if [[ -n "$TASK_ID" && -f "memory/events/${TASK_ID}.cancelled" ]]; then
            echo "::error::Cancelled task — CI FAIL ($TASK_ID)"
            exit 1
          fi
          echo "OK: no cancellation marker (task=$TASK_ID)"

  qc-check:
    name: qc-check
    needs: cancel-kill-switch
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Run guard.sh qc-check
        run: |
          set -euo pipefail
          TASK_ID=$(echo "${{ github.head_ref }}" | grep -oE 'task-[0-9]+' | head -n1 || true)
          if [[ -n "$TASK_ID" ]]; then
            bash scripts/guard.sh qc-check "$TASK_ID"
          else
            echo "no task id detected — skipping qc-check"
          fi

  hidden-path-audit:
    name: hidden-path-audit
    needs: cancel-kill-switch
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Detect unguarded merge calls
        run: |
          set -euo pipefail
          UNGUARDED=$(grep -rn -E "gh pr merge|git push.*origin main|worktree_manager.*finish" \
            --include='*.py' --include='*.sh' scripts/ \
            | grep -v "guard\|cancelled\|docstring\|comment\|# " \
            || true)
          COUNT=$(printf '%s\n' "$UNGUARDED" | grep -c . || true)
          echo "candidate matches: $COUNT"
          printf '%s\n' "$UNGUARDED"

  lock-in-check:
    name: lock-in-check
    needs: cancel-kill-switch
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: AST verify First-line guard
        run: |
          set -euo pipefail
          python3 scripts/lock_in_verify.py

  merge-safety-check:
    name: merge-safety-check
    needs: [qc-check, hidden-path-audit, lock-in-check]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Run guard.sh pre-push
        run: |
          set -euo pipefail
          TASK_ID=$(echo "${{ github.head_ref }}" | grep -oE 'task-[0-9]+' | head -n1 || true)
          if [[ -n "$TASK_ID" ]]; then
            bash scripts/guard.sh pre-push "$TASK_ID"
          else
            echo "no task id detected — skipping merge-safety-check"
          fi

  gemini-review-gate:
    name: gemini-review-gate
    needs: [merge-safety-check]
    runs-on: ubuntu-latest
    env:
      GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Mark check pending
        if: ${{ github.event.pull_request.head.sha != '' }}
        run: |
          set -euo pipefail
          python3 scripts/gemini_review_gate.py \
            --pr-number "${{ github.event.pull_request.number }}" \
            --commit-sha "${{ github.event.pull_request.head.sha }}" \
            --status pending || true
      - name: Run Gemini review gate
        run: |
          set -euo pipefail
          SHA="${{ github.event.pull_request.head.sha }}"
          PR="${{ github.event.pull_request.number }}"
          if [[ -z "$SHA" ]]; then SHA="${{ github.sha }}"; fi
          python3 scripts/gemini_review_gate.py \
            --pr-number "${PR:-0}" \
            --commit-sha "$SHA" \
            --publish-check

  ci-guard:
    name: ci/guard
    needs: [gemini-review-gate]
    runs-on: ubuntu-latest
    steps:
      - run: echo "all required checks passed"
