# SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
# The gate for this repository, on Gitea Actions. The syntax also runs on GitHub, but nothing here
# references a hosted action, a public image registry or an external font: the checkout is open
# coded and the toolchain comes from the runner's own image.
name: ci

on:
  push:
    branches: [main]
    paths-ignore: ["**/*.md"]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ gitea.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

jobs:
  gate:
    name: gate
    runs-on: linux-amd64-docker
    container:
      image: node:24-slim
    timeout-minutes: 25
    steps:
      - name: Checkout
        run: |
          git init -q .
          git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
          git -c http.extraheader="AUTHORIZATION: token ${{ gitea.token }}" fetch -q --depth 1 origin "${{ gitea.sha }}"
          git checkout -q FETCH_HEAD
      - name: Install
        env:
          # The ConusAI vendor registry serves the @conusai-kit and @conusai-sdk scopes. The token
          # is a repository secret, written to the user-level ~/.npmrc, which is the only config
          # pnpm trusts for credentials, and never to a file in the checkout.
          CONUSAI_NPM_TOKEN: ${{ secrets.CONUSAI_NPM_TOKEN }}
          CONUSAI_NPM_REGISTRY: ${{ secrets.CONUSAI_NPM_REGISTRY }}
          COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
        run: |
          corepack enable pnpm
          umask 077
          {
            echo "@conusai-kit:registry=${CONUSAI_NPM_REGISTRY}"
            echo "@conusai-sdk:registry=${CONUSAI_NPM_REGISTRY}"
            echo "${CONUSAI_NPM_REGISTRY#https:}:_authToken=${CONUSAI_NPM_TOKEN}"
          } > "$HOME/.npmrc"
          # The committed pnpm-lock.yaml makes this a frozen install in CI: the gate runs against
          # exactly the dependency graph the Dockerfile's deps stage later builds.
          pnpm install --ignore-scripts
      - name: Gate
        run: pnpm gate
      - name: Build the image
        # The Dockerfile's install stage reads the registry credentials from the mounted secret;
        # without it the vendor scopes 404 against the public registry.
        run: docker build --secret id=npmrc,src="$HOME/.npmrc" --target runtime -t "app:${{ gitea.sha }}" .
      - name: Software bill of materials
        run: |
          pnpm licenses list --json > sbom-licences.json
          # Fails on a dependency whose licence is not on the allow-list.
          node -e '
            const allowed = new Set(["MIT", "ISC", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "0BSD", "CC0-1.0", "Unlicense", "BlueOak-1.0.0", "Python-2.0", "LicenseRef-ConusAI-Template-1.0"])
            const licences = JSON.parse(require("node:fs").readFileSync("sbom-licences.json", "utf8"))
            const refused = Object.keys(licences).filter((name) => !allowed.has(name))
            if (refused.length > 0) {
              console.error(`licences that are not on the allow-list: ${refused.join(", ")}`)
              process.exit(1)
            }
          '
      - name: Dependency audit
        run: pnpm audit --audit-level high