sync.yml

name: Niakvio provider pipeline

on:
  workflow_dispatch:
    inputs:
      mode:
        description: Validation depth
        required: true
        default: quick
        type: choice
        options:
          - quick
          - deep
  pull_request:
    branches:
      - main
    paths:
      - '.github/workflows/sync.yml'
      - 'provider_catalog.json'
      - 'engine_v2/**'
      - 'scripts/run_adaptive_quick_repair.py'
      - 'scripts/run_adaptive_deep_repair.py'
      - 'scripts/promote_refresh_candidates.py'
      - 'scripts/promote_candidates.py'
      - 'scripts/runtime_repair.py'
      - 'scripts/adaptive_runtime/runtime_repair.py'
      - 'scripts/provider_engine_normalizer.py'
      - 'scripts/provider_evidence_model.py'
      - 'scripts/release_evidence_fence.py'
      - 'scripts/sync_release_versions.py'
      - 'scripts/nuvio_client_activation_ids.py'
      - 'tests/quick_refresh_policy_test.py'
      - 'tests/release_auto_bump_test.py'
      - 'tests/release_version_sync_test.py'
  push:
    branches:
      - main
    paths:
      - '.github/triggers/deep-provider-repair'
      - '.github/workflows/sync.yml'
      - 'provider_catalog.json'
      - 'engine_v2/src/**'
      - 'engine_v2/scripts/**'
      - 'scripts/run_adaptive_quick_repair.py'
      - 'scripts/run_adaptive_deep_repair.py'
      - 'scripts/promote_refresh_candidates.py'
      - 'scripts/promote_candidates.py'
      - 'scripts/runtime_repair.py'
      - 'scripts/adaptive_runtime/runtime_repair.py'
      - 'scripts/provider_engine_normalizer.py'
      - 'scripts/provider_evidence_model.py'
      - 'scripts/release_evidence_fence.py'
      - 'scripts/sync_release_versions.py'
      - 'scripts/nuvio_client_activation_ids.py'
  schedule:
    - cron: '17 5 * * 0,1,3,4,6'
    - cron: '47 4 * * 2,5'

permissions:
  contents: read

concurrency:
  group: nuvio-provider-publish-${{ github.event.pull_request.number || 'main' }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  stage-and-test:
    name: Discover, repair and validate providers
    runs-on: ubuntu-latest
    timeout-minutes: 90
    permissions:
      contents: read
    outputs:
      validation_mode: ${{ steps.resolve-mode.outputs.validation_mode }}

    steps:
      - name: Checkout without persisted credentials
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 2
          persist-credentials: false

      - name: Resolve validation mode
        id: resolve-mode
        shell: bash
        run: |
          MODE=quick
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            MODE="${{ github.event.inputs.mode }}"
          elif [ "${{ github.event.schedule }}" = "47 4 * * 2,5" ]; then
            MODE=deep
          elif [ "${{ github.event_name }}" = "push" ]; then
            BEFORE="${{ github.event.before }}"
            AFTER="${{ github.sha }}"
            if [ -n "$BEFORE" ] && git cat-file -e "$BEFORE^{commit}" 2>/dev/null; then
              if git diff --name-only "$BEFORE" "$AFTER" | grep -Fxq '.github/triggers/deep-provider-repair'; then
                MODE=deep
              fi
            fi
          fi
          echo "validation_mode=${MODE}" >> "$GITHUB_OUTPUT"
          echo "Resolved validation mode: ${MODE}"

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: '3.12'

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
          node-version: '24'
          package-manager-cache: false

      - name: Install pinned runtime dependencies
        run: |
          if [ -f package-lock.json ]; then
            npm ci --ignore-scripts --no-audit --no-fund
          else
            npm install --ignore-scripts --no-audit --no-fund --package-lock=false
          fi

      - name: Validate ARCHI2 control plane
        run: |
          node engine_v2/tests/provider-catalog.test.mjs
          node engine_v2/tests/contracts.test.mjs
          node engine_v2/tests/runtime-adapters.test.mjs
          node engine_v2/tests/media-validator.test.mjs
          node engine_v2/tests/resolver-core.test.mjs
          node engine_v2/tests/repair-brain.test.mjs
          node engine_v2/tests/recipe-memory.test.mjs
          node engine_v2/tests/decision-engine.test.mjs
          node engine_v2/tests/evidence.test.mjs

      - name: Validate compatibility execution primitives
        run: |
          python -m py_compile scripts/run_adaptive_quick_repair.py
          python -m py_compile scripts/run_adaptive_deep_repair.py
          python -m py_compile scripts/promote_refresh_candidates.py
          python -m py_compile scripts/promote_candidates.py
          python -m py_compile scripts/validate_automatic_repair_results.py
          python -m py_compile scripts/normalize_terminal_quarantine_stage.py
          python -m py_compile scripts/normalize_provider_activation_overrides.py
          python -m py_compile scripts/repair_profile_persistence.py
          python -m py_compile scripts/repair_identity_gate.py
          python -m py_compile scripts/sync_release_versions.py
          python tests/quick_refresh_policy_test.py
          python tests/quick_refresh_deep_authority_test.py
          python tests/quick_repair_probe_profile_test.py
          python tests/quick_repair_acceptance_policy_test.py
          python tests/healthy_sibling_resolution_test.py
          python tests/provider_activation_override_normalization_test.py
          python tests/repair_profile_persistence_test.py
          python tests/terminal_quarantine_stage_normalization_test.py
          python tests/refresh_manifest_finalization_test.py
          python tests/adaptive_runtime_repair_test.py
          python tests/global_final_wrapper_order_test.py
          python tests/release_auto_bump_test.py
          python tests/release_version_sync_test.py
          python tests/sync_atomic_publication_test.py

      - name: Run repository regression tests
        run: npm test

      - name: Release stale non-safety activation vetoes
        run: python scripts/normalize_provider_activation_overrides.py

      - name: Resolve official hubs and retain last-known-good routes
        run: |
          python scripts/resolve_provider_hubs.py \
            --apply \
            --mode "${{ steps.resolve-mode.outputs.validation_mode }}" \
            --include-disabled \
            --workers 8 \
            --timeout 8 \
            --output health-output/provider-hub-report.json

      - name: Discover all non-P2P candidates before triage
        run: python scripts/discover_candidates.py --require-all-upstreams

      - name: Enforce canonical catalog preservation
        run: node engine_v2/scripts/validate-stage-against-catalog.mjs --catalog provider_catalog.json --stage staging/candidates.json

      - name: Resolve DNS and validated domain migrations
        env:
          GLOBALPING_API_TOKEN: ${{ secrets.GLOBALPING_API_TOKEN }}
        run: |
          node scripts/provider_dns_preflight.mjs \
            --stage staging \
            --output health-output/dns-preflight-report.json
          python scripts/apply_dns_migration_overrides.py \
            --stage staging \
            --report health-output/dns-preflight-report.json

      - name: Apply known runtime profiles before repair
        run: |
          python scripts/build_provider_runtime_profiles.py
          python scripts/reapply_published_overrides.py
          python scripts/build_provider_runtime_profiles.py --stage staging --apply-stage
          python scripts/normalize_terminal_quarantine_stage.py --stage staging
          python scripts/validate_override_pipeline.py --stage staging

      - name: Repair unresolved provider structures
        env:
          NUVIO_DNS_PREFLIGHT_RESULTS: health-output/dns-preflight-report.json
          NUVIO_WORKER_MEMORY_MB: '1024'
        shell: bash
        run: |
          if [ "${{ steps.resolve-mode.outputs.validation_mode }}" = "deep" ]; then
            python scripts/run_adaptive_deep_repair.py \
              --stage staging \
              --output health-output \
              --mode deep
          else
            python scripts/run_adaptive_quick_repair.py \
              --stage staging \
              --output health-output \
              --max-rounds 1
          fi
          python scripts/validate_automatic_repair_results.py \
            --stage staging \
            --health health-output/health-results.json \
            --repairs health-output/repair-report.json
          python scripts/normalize_terminal_quarantine_stage.py --stage staging
          python scripts/validate_override_pipeline.py --stage staging

      - name: Validate deep evidence integrity
        if: steps.resolve-mode.outputs.validation_mode == 'deep'
        run: |
          python scripts/validate_deep_health_integrity.py \
            --health health-output/health-results.json \
            --repairs health-output/repair-report.json

      - name: Generate diagnostics after repair
        run: |
          python scripts/generate_diagnostics.py \
            --results health-output/health-results.json \
            --output health-output
          python scripts/validate_route_overrides.py \
            --results health-output/health-results.json \
            --report health-output/route-regressions.json

      - name: Upload validated staging transaction
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: nuvio-validation-stage-${{ github.run_id }}
          path: |
            staging/
            health-output/
            provider-overrides.json
            provider-domain-history.json
          retention-days: 2
          if-no-files-found: error

  publish:
    name: Publish validated provider transaction
    needs: stage-and-test
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 90
    permissions:
      contents: write

    steps:
      - name: Checkout current published repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0

      - name: Capture published manifest baseline
        shell: bash
        run: |
          NUVIO_PUBLISHED_MANIFEST_BASELINE="$RUNNER_TEMP/published-manifest.json"
          echo "NUVIO_PUBLISHED_MANIFEST_BASELINE=$NUVIO_PUBLISHED_MANIFEST_BASELINE" >> "$GITHUB_ENV"
          git show HEAD:manifest.json > "$NUVIO_PUBLISHED_MANIFEST_BASELINE"

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: '3.12'

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
          node-version: '24'
          package-manager-cache: false

      - name: Install pinned runtime dependencies
        run: |
          if [ -f package-lock.json ]; then
            npm ci --ignore-scripts --no-audit --no-fund
          else
            npm install --ignore-scripts --no-audit --no-fund --package-lock=false
          fi

      - name: Download validated staging transaction
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: nuvio-validation-stage-${{ github.run_id }}
          path: checked-artifact

      - name: Restore validated routing state
        run: |
          cp checked-artifact/provider-overrides.json provider-overrides.json
          cp checked-artifact/provider-domain-history.json provider-domain-history.json
          python scripts/build_provider_runtime_profiles.py
          python scripts/reapply_published_overrides.py

      - name: Promote only proven candidates
        env:
          NUVIO_STAGE: checked-artifact/staging
          NUVIO_HEALTH_RESULTS: checked-artifact/health-output/health-results.json
        shell: bash
        run: |
          if [ "${{ needs.stage-and-test.outputs.validation_mode }}" = "quick" ]; then
            python scripts/promote_refresh_candidates.py
          else
            python scripts/promote_candidates.py
          fi

      - name: Finalize upstream last-known-good snapshots
        run: |
          test -f checked-artifact/staging/upstream-lkg-pending.json
          python scripts/finalize_upstream_lkg.py \
            --pending checked-artifact/staging/upstream-lkg-pending.json \
            --keep-generations 2

      - name: Prune stale bundles and validate overrides
        run: |
          python scripts/prune_unreferenced_providers.py
          python scripts/validate_published_overrides.py

      - name: Restore validated reports
        shell: bash
        run: |
          git config user.name 'github-actions[bot]'
          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
          cp checked-artifact/health-output/dns-preflight-report.json dns-preflight-report.json
          cp checked-artifact/health-output/provider-hub-report.json provider-hub-report.json
          cp checked-artifact/health-output/diagnostics-report.json diagnostics-report.json
          cp checked-artifact/health-output/diagnostics-report.html diagnostics-report.html
          cp checked-artifact/health-output/route-regressions.json route-regressions.json
          cp checked-artifact/health-output/repair-report.json repair-report.json

      - name: Build canonical publication transaction
        shell: bash
        run: |
          test -f manifest.next.json
          mv manifest.next.json manifest.json
          python scripts/build_provider_runtime_profiles.py
          python scripts/reapply_published_overrides.py
          python scripts/generate_language_manifests.py
          python scripts/prune_unreferenced_providers.py

          # First pass catches promoter/repair changes before content audit.
          python scripts/sync_release_versions.py \
            --manifest manifest.json \
            --previous "$NUVIO_PUBLISHED_MANIFEST_BASELINE"

          python scripts/validate_activation_preservation.py
          python scripts/validate_language_projection.py

          # Compatibility promoters emit a candidate manifest. ARCHI2 imports
          # that transaction into the canonical catalog, then manifests are
          # rendered back from the catalog before publication.
          node engine_v2/scripts/bootstrap-provider-catalog.mjs \
            --general manifest.json \
            --vf vf/manifest.json \
            --output provider_catalog.json
          node engine_v2/scripts/render-manifests-from-catalog.mjs \
            --catalog provider_catalog.json \
            --general manifest.json \
            --vf vf/manifest.json
          node engine_v2/tests/provider-catalog.test.mjs

          python scripts/release_evidence_fence.py fingerprint \
            --manifest manifest.json \
            --root . \
            --output /tmp/release-generation.json

      - name: Audit content identity and media
        env:
          NUVIO_CATALOGUE_AUDIT_OUTPUT: /tmp/catalogue-media-audit.json
          NUVIO_CATALOGUE_AUDIT_WORKERS: '8'
          NUVIO_CATALOGUE_AUDIT_TIMEOUT: '60'
        shell: bash
        run: |
          if [ "${{ needs.stage-and-test.outputs.validation_mode }}" = "deep" ]; then
            python scripts/audit_catalogue_identity_media.py
          else
            set +e
            python scripts/audit_catalogue_identity_media.py
            audit_status=$?
            set -e
            if [ "$audit_status" -ne 0 ]; then
              python scripts/quarantine_catalogue_audit_failures.py \
                --audit /tmp/catalogue-media-audit.json \
                --evidence /tmp/release-generation.json \
                --workflow-run-id "${{ github.run_id }}" \
                --tested-commit-sha "${{ github.sha }}"
            fi
          fi

          # The audit is allowed to mutate activation state. Re-run the same
          # idempotent finalizer against the original published generation so
          # late quarantine/metadata changes cannot escape provider/global cache
          # invalidation, and cannot double-bump earlier changes.
          python scripts/generate_language_manifests.py
          python scripts/sync_release_versions.py \
            --manifest manifest.json \
            --previous "$NUVIO_PUBLISHED_MANIFEST_BASELINE"
          python scripts/validate_activation_preservation.py
          python scripts/validate_language_projection.py
          node engine_v2/scripts/bootstrap-provider-catalog.mjs \
            --general manifest.json \
            --vf vf/manifest.json \
            --output provider_catalog.json
          node engine_v2/scripts/render-manifests-from-catalog.mjs \
            --catalog provider_catalog.json \
            --general manifest.json \
            --vf vf/manifest.json
          node engine_v2/tests/provider-catalog.test.mjs
          python scripts/release_evidence_fence.py fingerprint \
            --manifest manifest.json \
            --root . \
            --output /tmp/release-generation.json

      - name: Upload catalogue/media audit
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: catalogue-media-audit-${{ github.run_id }}
          path: /tmp/catalogue-media-audit.json
          retention-days: 7
          if-no-files-found: warn

      - name: Measure Interstellar real coverage
        continue-on-error: true
        run: |
          python scripts/interstellar_nuvio_matrix.py \
            --workers 8 \
            --timeout 90 \
            --minimum-automatic 0 \
            --output /tmp/interstellar-nuvio-matrix.json

      - name: Upload real coverage diagnostics
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: interstellar-real-coverage-${{ github.run_id }}
          path: /tmp/interstellar-nuvio-matrix.json
          retention-days: 7
          if-no-files-found: warn

      - name: Publish atomic ARCHI2 transaction
        shell: bash
        run: |
          python scripts/release_evidence_fence.py validate \
            --manifest manifest.json \
            --root . \
            --evidence /tmp/release-generation.json
          python scripts/generate_release_hashes.py
          python scripts/validate_release_integrity.py
          node engine_v2/tests/provider-catalog.test.mjs

          git add manifest.json vf/manifest.json provider_catalog.json \
            package.json package-lock.json sources.json nuvio-client-id-state.json \
            FILE-HASHES.json PATCH-SHA256SUMS.txt SHA256SUMS.json \
            PROVENANCE.json provider-overrides.json provider-domain-history.json \
            upstream-lkg.json upstream-lkg/ health-report.json health-history.json \
            dns-preflight-report.json provider-hub-report.json diagnostics-report.json \
            diagnostics-report.html route-regressions.json repair-report.json
          git add -A providers

          if git diff --cached --quiet; then
            echo 'No validated provider change.'
            exit 0
          fi

          git commit -m "chore: publish validated ARCHI2 provider transaction"
          git reset --hard HEAD
          git clean -fdx
          git fetch origin main
          git rebase origin/main

          # The rebase can import concurrent README/config/cleanup changes after
          # the publication hashes were first generated. Rebuild the inventories
          # on the exact rebased tree so a provider transaction can never publish
          # stale checksums for files that were changed or removed concurrently.
          python scripts/generate_release_hashes.py
          python scripts/validate_release_integrity.py
          git add FILE-HASHES.json PATCH-SHA256SUMS.txt SHA256SUMS.json
          if ! git diff --cached --quiet; then
            git commit --amend --no-edit
          fi

          python scripts/release_evidence_fence.py validate \
            --manifest manifest.json \
            --root . \
            --evidence /tmp/release-generation.json
          git push origin HEAD:main

      - name: Verify exact published main
        shell: bash
        run: |
          git fetch origin main
          git reset --hard origin/main
          git clean -fdx
          if [ -f package-lock.json ]; then
            npm ci --ignore-scripts --no-audit --no-fund
          else
            npm install --ignore-scripts --no-audit --no-fund --package-lock=false
          fi
          npm test
          node engine_v2/tests/provider-catalog.test.mjs
          python scripts/validate_activation_preservation.py
          python scripts/validate_language_projection.py
          python scripts/validate_release_integrity.py
          python scripts/release_evidence_fence.py validate \
            --manifest manifest.json \
            --root . \
            --evidence /tmp/release-generation.json
          git diff --exit-code