name: CI Required

# До отдельной приёмки canary workflow запускается только вручную.
on:
  workflow_dispatch: {}

env:
  PIP_DISABLE_PIP_VERSION_CHECK: "1"
  PIP_NO_CACHE_DIR: "1"
  PIP_NO_INPUT: "1"
  PYTHONDONTWRITEBYTECODE: "1"

jobs:
  quality:
    name: quality
    runs-on: dzentra-python312
    steps:
      - name: Checkout закреплённой revision
        uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          fetch-depth: 1
          persist-credentials: false
      - name: Проверка контракта runner
        run: |
          set -euo pipefail
          test "$(uname -s)" = "Linux"
          command -v bash
          command -v git
          command -v grep
          command -v node
          command -v python3.12
          command -v timeout
          test "$(python3.12 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')" = "3.12"
          case "$(node --version)" in
            v20.*) ;;
            *) printf 'Требуется Node.js 20.\n' >&2; exit 1 ;;
          esac
          timeout --version | grep -q 'GNU coreutils'
          python3.12 -c 'import socket; sock = socket.socket(); sock.bind(("127.0.0.1", 0)); sock.close()'
      - name: Установка hash-locked environment
        run: |
          set -euo pipefail
          timeout --signal=TERM --kill-after=30s 2m \
            python3.12 -m venv app/.venv
          timeout --signal=TERM --kill-after=30s 10m \
            app/.venv/bin/python -m pip install \
            --require-hashes \
            -r app/requirements-dev.lock
          app/.venv/bin/python -m pip check
      - name: Quality gate
        run: |
          set -euo pipefail
          timeout --signal=TERM --kill-after=30s 10m \
            ./scripts/run_ci_gate.sh quality
      - name: Проверка отсутствия артефактов
        run: |
          set -euo pipefail
          changes="$(git status --short --untracked-files=all)"
          if [[ -n "${changes}" ]]; then
            printf '%s\n' "${changes}" >&2
            exit 1
          fi

  offline-regression:
    name: offline-regression
    runs-on: dzentra-python312
    steps:
      - name: Checkout закреплённой revision
        uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          fetch-depth: 1
          persist-credentials: false
      - name: Проверка контракта runner
        run: |
          set -euo pipefail
          test "$(uname -s)" = "Linux"
          command -v bash
          command -v git
          command -v grep
          command -v node
          command -v python3.12
          command -v timeout
          test "$(python3.12 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')" = "3.12"
          case "$(node --version)" in
            v20.*) ;;
            *) printf 'Требуется Node.js 20.\n' >&2; exit 1 ;;
          esac
          timeout --version | grep -q 'GNU coreutils'
          python3.12 -c 'import socket; sock = socket.socket(); sock.bind(("127.0.0.1", 0)); sock.close()'
      - name: Установка hash-locked environment
        run: |
          set -euo pipefail
          timeout --signal=TERM --kill-after=30s 2m \
            python3.12 -m venv app/.venv
          timeout --signal=TERM --kill-after=30s 10m \
            app/.venv/bin/python -m pip install \
            --require-hashes \
            -r app/requirements-dev.lock
          app/.venv/bin/python -m pip check
      - name: Offline regression
        run: |
          set -euo pipefail
          timeout --signal=TERM --kill-after=30s 20m \
            ./scripts/run_ci_gate.sh offline-regression
      - name: Проверка отсутствия артефактов
        run: |
          set -euo pipefail
          changes="$(git status --short --untracked-files=all)"
          if [[ -n "${changes}" ]]; then
            printf '%s\n' "${changes}" >&2
            exit 1
          fi

  loopback-integration:
    name: loopback-integration
    runs-on: dzentra-python312
    steps:
      - name: Checkout закреплённой revision
        uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          fetch-depth: 1
          persist-credentials: false
      - name: Проверка контракта runner
        run: |
          set -euo pipefail
          test "$(uname -s)" = "Linux"
          command -v bash
          command -v git
          command -v grep
          command -v node
          command -v python3.12
          command -v timeout
          test "$(python3.12 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')" = "3.12"
          case "$(node --version)" in
            v20.*) ;;
            *) printf 'Требуется Node.js 20.\n' >&2; exit 1 ;;
          esac
          timeout --version | grep -q 'GNU coreutils'
          python3.12 -c 'import socket; sock = socket.socket(); sock.bind(("127.0.0.1", 0)); sock.close()'
      - name: Установка hash-locked environment
        run: |
          set -euo pipefail
          timeout --signal=TERM --kill-after=30s 2m \
            python3.12 -m venv app/.venv
          timeout --signal=TERM --kill-after=30s 10m \
            app/.venv/bin/python -m pip install \
            --require-hashes \
            -r app/requirements-dev.lock
          app/.venv/bin/python -m pip check
      - name: Loopback integration
        run: |
          set -euo pipefail
          timeout --signal=TERM --kill-after=30s 10m \
            ./scripts/run_ci_gate.sh loopback-integration
      - name: Проверка отсутствия артефактов
        run: |
          set -euo pipefail
          changes="$(git status --short --untracked-files=all)"
          if [[ -n "${changes}" ]]; then
            printf '%s\n' "${changes}" >&2
            exit 1
          fi