name: Verify

on:
  workflow_dispatch:
  pull_request:
  push:
    branches: [staging, main]

concurrency:
  group: verify-${{ github.ref }}
  cancel-in-progress: true

jobs:
  branch-policy:
    runs-on: ubuntu-latest
    steps:
      - name: Enforce promotion flow
        if: github.event_name == 'pull_request'
        env:
          BASE_BRANCH: ${{ github.base_ref }}
          HEAD_BRANCH: ${{ github.head_ref }}
        run: |
          if [ "$BASE_BRANCH" = "master" ]; then
            echo "master is frozen; target staging or main" >&2
            exit 1
          fi
          if [ "$BASE_BRANCH" = "main" ]; then
            case "$HEAD_BRANCH" in
              staging|hotfix/*|release/*) ;;
              *)
                echo "main takes staging promotions, or a hotfix/* or release/* branch for direct work" >&2
                exit 1
                ;;
            esac
          fi
          if [ "$BASE_BRANCH" != "staging" ] && [ "$BASE_BRANCH" != "main" ]; then
            echo "Feature pull requests target staging; promotions target main" >&2
            exit 1
          fi
      - name: Confirm direct verification
        if: github.event_name != 'pull_request'
        run: echo "Direct branch verification requested for $GITHUB_SHA"

  static:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
      - run: npm run learn:check
      - run: npm run verify:fast
      - name: Enforce API and mobile coverage floors
        run: npm run test:coverage
      - run: npm run build

  backend-integration:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    services:
      postgres:
        image: postgres:17-alpine
        env:
          POSTGRES_DB: sauci_test
          POSTGRES_USER: sauci
          POSTGRES_PASSWORD: sauci_ci_only
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U sauci -d sauci_test"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 20
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
      - name: Run standalone backend integration tests
        env:
          DATABASE_URL: postgresql://sauci:sauci_ci_only@127.0.0.1:5432/sauci_test
        run: npm run test:integration:coverage -w @sauci/api

  container-contract:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - name: Verify production Compose contract
        run: infra/backend/verify-production.sh