"""Stable managed-validation contract used by Gitea governance tools."""

from __future__ import annotations

import hashlib

MANAGED_VALIDATION_PATH = ".gitea/workflows/managed-validation.yml"
MANAGED_VALIDATION_CONTEXT = "Managed validation / full (pull_request)"

# Keep this workflow pull-request/dispatch only. Bulk governance must never create
# a push-triggered Actions storm across the portfolio.
MANAGED_VALIDATION_WORKFLOW = """name: Managed validation
run-name: "Managed validation / ${{ inputs.profile || 'full' }}"

on:
  pull_request:
  workflow_dispatch:
    inputs:
      profile:
        description: Allowlisted validation profile
        required: true
        default: full
        type: choice
        options: [test, lint, typecheck, build, security, full]

permissions:
  contents: read

concurrency:
  group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
  cancel-in-progress: true

jobs:
  full:
    name: full
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install .NET 8 for solution repositories
        if: ${{ hashFiles('*.sln') != '' }}
        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
        with:
          dotnet-version: '8.0.x'
      - name: Validate repository with a bounded profile
        shell: bash
        env:
          REQUESTED_PROFILE: ${{ inputs.profile }}
        run: |
          set -euo pipefail
          profile="${REQUESTED_PROFILE:-full}"
          case "${profile}" in
            test|lint|typecheck|build|security|full) ;;
            *) echo "Profile is not allowlisted" >&2; exit 2 ;;
          esac
          python_tests_ran=0

          git diff --check
          if git grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
            echo "Unresolved merge markers detected" >&2
            exit 1
          fi

          if [[ -f pyproject.toml || -f requirements.txt ]]; then
            # Compile only tracked Python sources. Running compileall after a
            # Node install would otherwise traverse node_modules and turn a
            # lightweight baseline into a large runner workload.
            git ls-files -z '*.py' | xargs -0 -r python -m py_compile
            if [[ -f uv.lock ]]; then
              python -m venv "${RUNNER_TEMP}/managed-uv"
              uv_python="${RUNNER_TEMP}/managed-uv/bin/python"
              "${uv_python}" -m pip install --disable-pip-version-check uv==0.10.0
              managed_uv="${RUNNER_TEMP}/managed-uv/bin/uv"
              export UV_PROJECT_ENVIRONMENT="${RUNNER_TEMP}/managed-project-venv"
              "${managed_uv}" sync --locked
              export PATH="${UV_PROJECT_ENVIRONMENT}/bin:${PATH}"
              if [[ "${profile}" == test || "${profile}" == full ]]; then
                if "${managed_uv}" run python -c 'import pytest' 2>/dev/null; then
                  "${managed_uv}" run python -m pytest
                  python_tests_ran=1
                fi
              fi
              if [[ "${profile}" == lint || "${profile}" == full ]]; then
                if "${managed_uv}" run python -c 'import ruff' 2>/dev/null; then
                  "${managed_uv}" run python -m ruff check .
                fi
              fi
            elif [[ -f requirements.txt ]]; then
              python -m venv "${RUNNER_TEMP}/managed-python"
              managed_python="${RUNNER_TEMP}/managed-python/bin/python"
              "${managed_python}" -m pip install --disable-pip-version-check -r requirements.txt
              export PATH="${RUNNER_TEMP}/managed-python/bin:${PATH}"
              if [[ "${profile}" == test || "${profile}" == full ]]; then
                if "${managed_python}" -c 'import pytest' 2>/dev/null; then
                  "${managed_python}" -m pytest
                  python_tests_ran=1
                fi
              fi
            fi
          fi

          # Prepare Python before invoking Node scripts. Polyglot repositories
          # commonly delegate their test script to Python and need the managed
          # virtual environment to be active first.
          if [[ -f package.json ]]; then
            corepack enable
            run_node_test=1
            if [[ "${python_tests_ran}" == 1 ]] && node -e '
              const script = String(require("./package.json").scripts?.test || "");
              const delegated = /^\\s*python(?:3)?\\s+-m\\s+(?:pytest|unittest)\\b/.test(script);
              process.exit(delegated ? 0 : 1);
            '; then
              run_node_test=0
            fi
            if [[ -f pnpm-lock.yaml ]]; then
              pnpm install --frozen-lockfile
              if [[ "${run_node_test}" == 1 ]]; then
                [[ "${profile}" == test || "${profile}" == full ]] && pnpm --if-present test
              fi
              [[ "${profile}" == lint || "${profile}" == full ]] && pnpm --if-present lint
              [[ "${profile}" == typecheck || "${profile}" == full ]] && pnpm --if-present typecheck
              [[ "${profile}" == build || "${profile}" == full ]] && pnpm --if-present build
            elif [[ -f package-lock.json ]]; then
              npm ci
              if [[ "${run_node_test}" == 1 ]]; then
                [[ "${profile}" == test || "${profile}" == full ]] && npm run --if-present test
              fi
              [[ "${profile}" == lint || "${profile}" == full ]] && npm run --if-present lint
              if [[ "${profile}" == typecheck || "${profile}" == full ]]; then
                npm run --if-present typecheck
              fi
              [[ "${profile}" == build || "${profile}" == full ]] && npm run --if-present build
            fi
          fi

          if [[ -f go.mod ]]; then
            if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then
              go test ./...
            fi
          fi
          if [[ -f Cargo.toml ]]; then
            if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then
              cargo test --locked
            fi
          fi
          if compgen -G '*.sln' >/dev/null; then
            if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then
              dotnet test --configuration Release
            fi
          fi
"""

MANAGED_VALIDATION_DIGEST = hashlib.sha256(MANAGED_VALIDATION_WORKFLOW.encode("utf-8")).hexdigest()