sop-gate.yml

# SOP Gate - v0.21.x Hardening CI
#
# Runs the source-backed SOP pipeline defined in docs/sop/v0.21.x/README.md.
# Triggered on push to dev/main and on PRs. Also available via workflow_dispatch.
#
# If any gate fails, v0.22.0 Edge Full-Stack should NOT start.

name: SOP Gate (v0.21.x)

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main, dev]
  workflow_dispatch:

jobs:
  fmt-check:
    name: 'fmt:check'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: denoland/setup-deno@v2
        with:
          deno-version: '2'
      - run: deno task fmt:check

  lint:
    name: 'lint'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: denoland/setup-deno@v2
        with:
          deno-version: '2'
      - run: deno task lint

  typecheck:
    name: 'typecheck'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: denoland/setup-deno@v2
        with:
          deno-version: '2'
      - run: deno install --node-modules-dir
      - run: deno task typecheck

  audit:
    name: 'audit'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: denoland/setup-deno@v2
        with:
          deno-version: '2'
      - run: deno audit

  test:
    name: 'test'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: denoland/setup-deno@v2
        with:
          deno-version: '2'
      - run: deno install --node-modules-dir
      - name: Run full test suite
        run: deno task test

  test-ssg-starter:
    name: 'SSG starter proof (SOP-010 Q4)'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: denoland/setup-deno@v2
        with:
          deno-version: '2'
      - run: deno install --node-modules-dir
      - name: Run generated-project starter proof
        run: deno test packages/create/__tests__/cli.test.ts --allow-read --allow-write --allow-env --allow-run --allow-ffi --filter "generated project builds"

  build:
    name: 'build'
    runs-on: ubuntu-latest
    needs: [lint]
    steps:
      - uses: actions/checkout@v4
      - uses: denoland/setup-deno@v2
        with:
          deno-version: '2'
      - run: deno install --node-modules-dir
      - run: deno task build

  dsd-check:
    name: 'dsd:check-report'
    runs-on: ubuntu-latest
    needs: [lint]
    steps:
      - uses: actions/checkout@v4
      - uses: denoland/setup-deno@v2
        with:
          deno-version: '2'
      - run: deno install --node-modules-dir
      - name: Build www site
        run: deno task build
      - run: deno task dsd:check-report

  hub-validate:
    name: 'hub:validate'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: denoland/setup-deno@v2
        with:
          deno-version: '2'
      - run: deno install --node-modules-dir
      - run: deno task hub:validate -- --strict --json

  hub-check-index:
    name: 'hub:check-index'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: denoland/setup-deno@v2
        with:
          deno-version: '2'
      - run: deno task hub:check-index

  docs-check:
    name: 'docs:check-strategy'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: denoland/setup-deno@v2
        with:
          deno-version: '2'
      - run: deno task docs:check-strategy

  test-e2e:
    name: 'test:e2e'
    runs-on: ubuntu-latest
    needs: [lint]
    steps:
      - uses: actions/checkout@v4
      - uses: denoland/setup-deno@v2
        with:
          deno-version: '2'
      - run: deno install --node-modules-dir
      - name: Build www site for Playwright
        run: deno task build
      - name: Install Playwright Chromium
        run: npx -y playwright@1.59.1 install chromium --with-deps
      - name: Run E2E tests
        run: deno task test:e2e

  gate-summary:
    name: 'SOP Gate Summary'
    runs-on: ubuntu-latest
    needs:
      [
        fmt-check,
        lint,
        typecheck,
        audit,
        test,
        test-ssg-starter,
        build,
        dsd-check,
        hub-validate,
        hub-check-index,
        docs-check,
        test-e2e,
      ]
    if: always()
    steps:
      - name: Check all gates
        run: |
          ALL_PASS=true

          check() {
            if [ "$1" = "success" ]; then
              echo "- [x] $2"
            else
              echo "- [ ] $2 (failed)"
              ALL_PASS=false
            fi
          }

          {
            echo "## SOP Gate v0.21.x Results"
            echo ""
            check "${{ needs.fmt-check.result }}"        "fmt:check"
            check "${{ needs.lint.result }}"             "lint"
            check "${{ needs.typecheck.result }}"        "typecheck"
            check "${{ needs.audit.result }}"            "audit"
            check "${{ needs.test.result }}"             "test"
            check "${{ needs.test-ssg-starter.result }}" "SSG starter proof (SOP-010 Q4)"
            check "${{ needs.build.result }}"            "build"
            check "${{ needs.dsd-check.result }}"        "dsd:check-report"
            check "${{ needs.hub-validate.result }}"     "hub:validate --strict"
            check "${{ needs.hub-check-index.result }}"  "hub:check-index"
            check "${{ needs.docs-check.result }}"       "docs:check-strategy"
            check "${{ needs.test-e2e.result }}"         "test:e2e"
            echo ""
            if [ "$ALL_PASS" = "true" ]; then
              echo "All source-backed SOP gates passed. v0.22.0 Edge Full-Stack may proceed."
            else
              echo "Some gates failed. v0.22.0 must not start until all gates pass."
              exit 1
            fi
          } >> "$GITHUB_STEP_SUMMARY"