name: T3MP3ST CI

on:
  pull_request:
    branches: [main]
  push:
    branches:
      - main
    tags:
      - "v*"

permissions:
  contents: read

concurrency:
  group: t3mp3st-ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run lint
      - run: npm run typecheck
      - run: npm test
      # Enforce the 100% coverage gate on the new multi-language ingest files
      # (vitest exits non-zero if a per-file threshold is missed).
      - run: npm run test:coverage
      - run: npm run doctor
      # Honesty gates: prove the headline numbers re-derive and that no
      # challenge-fitting has crept in. Public contributors / CI can verify.
      - run: npm run verify-claims
      - run: npm run test:no-fitting
      - run: npm run test:no-self-fitting
      # The provenance gate itself, in the compiled engine path (builds first).
      - run: npm run test:gate
      # The operator doctrine / prompt-pack contract must hold.
      - run: npm run prompt:audit
      # Non-network smoke: core traps run deterministically; server/live tiers
      # auto-skip when no server/LLM is present (they are absent in CI).
      - run: npm run smoke

  release:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: test
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          ref: ${{ github.sha }}
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run test:release
      - run: npm audit --audit-level=high
      - run: npm run pack:dry-run
      - run: npm pack --json > pack-result.json
      - name: Record release checksums
        run: |
          package_file="$(node -e "const fs=require('fs'); const p=JSON.parse(fs.readFileSync('pack-result.json')); process.stdout.write(p[0].filename)")"
          sha256sum "$package_file" > SHA256SUMS
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: tested-package-${{ github.sha }}
          path: |
            *.tgz
            SHA256SUMS
            pack-result.json
          if-no-files-found: error
          retention-days: 14