ci.yml

name: CI

# GATE_LIST_START
# - build
# - vet
# - lint
# - format
# - contamination
# - unit-tests
# - gosec
# - govulncheck
# - go-mod-verify
# - unit-tests-race
# - docker-build
# - smoke-l25
# - sbom
# GATE_LIST_END

on:
  pull_request:
    branches: [develop]
  push:
    branches: [develop, main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

# Parameterized — no hardcoded owner/repo names. Rebrand-resilient per Decision 015.
permissions:
  contents: read

jobs:
  build:
    name: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
        with:
          go-version-file: go.mod
          cache: true
      - run: go build ./cmd/broker ./cmd/aactl

  vet:
    name: vet
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
        with:
          go-version-file: go.mod
          cache: true
      - run: go vet ./...

  lint:
    name: lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
        with:
          go-version-file: go.mod
          cache: true
      # v6.x is the last major compatible with golangci-lint v1.x config.
      # version: pin to v1.64.8 explicitly — with 'version: latest' the v6
      # action installs golangci-lint v2.x, which rejects our v1 schema.
      # This matches the local developer version (see scripts/gates.sh).
      # v8+ of the action requires golangci-lint v2 and a migrated config —
      # migration tracked for a later cycle.
      - uses: golangci/golangci-lint-action@8564da7cb3c6866ed1da648ca8f00a258ef0c802  # v6.5.2
        with:
          version: v1.64.8
          args: --config .golangci.yml

  format:
    name: format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
        with:
          go-version-file: go.mod
      - run: |
          unformatted=$(gofmt -l .)
          if [[ -n "$unformatted" ]]; then
            echo "The following files are not gofmt'd:"
            echo "$unformatted"
            exit 1
          fi

  contamination:
    name: contamination
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - run: |
          if grep -ri 'hitl\|approval\|oidc\|federation\|cloud\|sidecar' internal/ cmd/ 2>/dev/null; then
            echo "FAIL: enterprise references found in core code"
            exit 1
          fi
          echo "PASS: no enterprise contamination"

  unit-tests:
    name: unit-tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
        with:
          go-version-file: go.mod
          cache: true
      - run: go test -short -count=1 ./...

  unit-tests-race:
    name: unit-tests-race
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
        with:
          go-version-file: go.mod
          cache: true
      - run: go test -race -count=1 -coverprofile=coverage.out ./...
      - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2  # v6.0.0
        with:
          files: ./coverage.out
          fail_ci_if_error: false
          verbose: true

  gosec:
    name: gosec
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
        with:
          go-version-file: go.mod
      # Exclusions (G117, G304, G101) are documented in .gosec.yml and
      # mirrored in scripts/gates.sh and .golangci.yml.
      - uses: securego/gosec@223e19b8856e00f02cc67804499a83f77e208f3c  # v2.25.0
        with:
          args: '-quiet -conf .gosec.yml -exclude=G117,G304,G101 -severity=medium ./...'

  govulncheck:
    name: govulncheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
        with:
          go-version-file: go.mod
      - run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

  go-mod-verify:
    name: go-mod-verify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
        with:
          go-version-file: go.mod
      - run: |
          go mod verify
          go mod tidy
          if ! git diff --exit-code go.mod go.sum; then
            echo "FAIL: go.mod or go.sum changed after 'go mod tidy'"
            exit 1
          fi

  docker-build:
    name: docker-build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Build image
        run: docker build -t agentauth-ci:${{ github.sha }} .

  smoke-l25:
    name: smoke-l25
    runs-on: ubuntu-latest
    needs: [docker-build]
    env:
      AA_ADMIN_SECRET: live-test-secret-32bytes-long-ok  # known test fixture
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Install python cryptography (for Ed25519 challenge-response)
        run: python3 -m pip install --user cryptography
      - name: Start broker
        run: |
          export AA_ADMIN_SECRET="$AA_ADMIN_SECRET"
          ./scripts/stack_up.sh
          for i in {1..30}; do
            if curl -sf http://localhost:8080/v1/health >/dev/null 2>&1; then
              echo "Broker up after $i seconds"
              break
            fi
            sleep 1
          done
      - name: Run L2.5 core contract smoke
        run: ./scripts/smoke/core-contract.sh
      - name: Teardown
        if: always()
        run: ./scripts/stack_down.sh || true

  sbom:
    name: sbom
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610  # v0.24.0
        with:
          path: .
          format: spdx-json
          output-file: sbom.spdx.json
      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
        with:
          name: sbom
          path: sbom.spdx.json
          retention-days: 30

  # dep-review is removed temporarily: actions/dependency-review-action
  # requires GitHub Advanced Security (GHAS) on private repos. devonartis/
  # agentauth is private without GHAS, so the action fails with a 403
  # from the Dependency Graph API on every PR. Re-enable when:
  #   (a) the repo flips public (GHAS is free on public repos), OR
  #   (b) GHAS is purchased for the private repo.
  # Tracking: TD-VUL-005 in TECH-DEBT.md.

  changelog:
    name: changelog
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          fetch-depth: 0
      - name: Check CHANGELOG.md diff
        run: |
          if echo '${{ toJson(github.event.pull_request.labels) }}' | grep -q '"skip-changelog"'; then
            echo "Label 'skip-changelog' present — bypassing CHANGELOG check"
            exit 0
          fi
          BASE_SHA='${{ github.event.pull_request.base.sha }}'
          if git diff --name-only "$BASE_SHA" HEAD | grep -q '^CHANGELOG.md$'; then
            echo "PASS: CHANGELOG.md touched in this PR"
          else
            echo "FAIL: This PR does not touch CHANGELOG.md"
            echo "Add a CHANGELOG entry or apply the 'skip-changelog' label if the PR is docs/tests-only."
            exit 1
          fi

  gate-parity:
    name: gate-parity
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - run: ./scripts/test-gate-parity.sh

  gates-passed:
    name: gates-passed
    runs-on: ubuntu-latest
    needs:
      - build
      - vet
      - lint
      - format
      - contamination
      - unit-tests
      - unit-tests-race
      - gosec
      - govulncheck
      - go-mod-verify
      - docker-build
      - smoke-l25
      - sbom
      - gate-parity
    if: always()
    steps:
      - name: Check all gates passed
        run: |
          if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" ]]; then
            echo "One or more gates failed"
            exit 1
          fi
          if [[ "${{ contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
            echo "One or more gates were cancelled"
            exit 1
          fi
          echo "All gates passed"