name: Build and Test Quality Gate

on:
  pull_request:
  push:
    branches:
      - main
      - master
  workflow_dispatch:

permissions:
  contents: read

jobs:
  web:
    name: Contract Web typecheck and build
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm

      - name: Install workspace dependencies
        run: |
          npm install -g npm@10.9.7
          npm ci

      - name: Typecheck Contract Web
        run: npm run typecheck --workspace @yuqei/contract-web

      - name: Test Contract Web critical routing and policy guards
        run: npm test --workspace @yuqei/contract-web

      - name: Build Contract Web
        run: npm run build --workspace @yuqei/contract-web

  kms-gateway:
    name: Isolated Alibaba and Tencent KMS gateway
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      PIP_INDEX_URL: https://pypi.tuna.tsinghua.edu.cn/simple
      PIP_DISABLE_PIP_VERSION_CHECK: "1"
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip

      - name: Install isolated KMS gateway
        working-directory: yuqei-contract-platform/services/kms-gateway
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e ".[test]"

      - name: Verify both official cloud SDKs and gateway contracts
        working-directory: yuqei-contract-platform/services/kms-gateway
        run: |
          python -c "from alibabacloud_kms_kms20160120.client import Client as AliClient; from tencentcloud.kms.v20190118.kms_client import KmsClient as TencentClient; print('cloud KMS SDK imports passed')"
          python -m pip check
          python -m pytest -q

  python:
    name: Python tests and Contract API migration
    runs-on: ubuntu-latest
    timeout-minutes: 25
    env:
      PIP_INDEX_URL: https://pypi.tuna.tsinghua.edu.cn/simple
      PIP_DISABLE_PIP_VERSION_CHECK: "1"
      CONTRACT_API_ENVIRONMENT: test
      CONTRACT_API_DATABASE_URL: "sqlite+pysqlite:///:memory:"
      CONTRACT_API_DATABASE_AUTO_CREATE: "true"
      CONTRACT_API_SEED_DEMO_DATA: "false"
      AI_PLATFORM_ENVIRONMENT: test
      AI_PLATFORM_DATABASE_URL: "sqlite+pysqlite:///:memory:"
      AI_PLATFORM_DATABASE_AUTO_CREATE: "true"
      AI_PLATFORM_REPOSITORY_BACKEND: sqlalchemy
      YUQEI_WORKER_ENVIRONMENT: test
      YUQEI_WORKER_DATABASE_URL: "sqlite+pysqlite:///:memory:"
      YUQEI_WORKER_DATABASE_AUTO_CREATE: "true"
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip

      - name: Install Python projects and test runner
        run: |
          python -m pip install --upgrade pip
          python -m pip install pytest \
            -e yuqei-contract-platform/services/contract-api \
            -e yuqei-ai-platform/services/ai-platform-api \
            -e yuqei-ai-platform/services/worker \
            -e yuqei-ai-sdk-python

      - name: Test Contract API
        env:
          TMPDIR: /dev/shm/yuqei-contract-tests
          YUQEI_TEST_CLEAN_TMP_PATHS: "true"
        run: |
          mkdir -p "$TMPDIR"
          python -m pytest yuqei-contract-platform/services/contract-api/tests -q

      - name: Test P0 critical launch journeys
        env:
          TMPDIR: /dev/shm/yuqei-p0-tests
          YUQEI_TEST_CLEAN_TMP_PATHS: "true"
        run: |
          mkdir -p "$TMPDIR"
          python -m pytest \
            yuqei-contract-platform/services/contract-api/tests/test_contract_templates.py \
            yuqei-contract-platform/services/contract-api/tests/test_contract_delivery_quality_gate.py \
            yuqei-contract-platform/services/contract-api/tests/test_tenant_isolation.py \
            yuqei-contract-platform/services/contract-api/tests/test_public_policy_promotion.py \
            yuqei-contract-platform/services/contract-api/tests/test_p0_launch_critical_journeys.py \
            yuqei-ai-platform/services/ai-platform-api/tests/test_public_ai_disclosure.py \
            -q

      - name: Test AI Platform API
        run: python -m pytest yuqei-ai-platform/services/ai-platform-api/tests -q

      - name: Test AI worker
        run: python -m pytest yuqei-ai-platform/services/worker/tests -q

      - name: Test Python SDK
        run: python -m pytest yuqei-ai-sdk-python/tests -q

      - name: Test production release tools
        run: python -m pytest yuqei-infra/tests -q

      - name: Verify Contract API empty-database migrations
        working-directory: yuqei-contract-platform/services/contract-api
        env:
          CONTRACT_API_DATABASE_URL: sqlite+pysqlite:////tmp/yuqei-contract-api-ci.sqlite3
          CONTRACT_API_DATABASE_AUTO_CREATE: "false"
        run: |
          python -m alembic upgrade head
          python -m alembic downgrade 20260710_0030
          python -m alembic upgrade head
          python -m alembic current | grep -F "20260826_0073 (head)"