name: Quality Gate

on:
  workflow_call:

permissions:
  contents: read

jobs:
  quality-gate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          submodules: true
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.5

      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.bun/install/cache
            node_modules
            stats/node_modules
            vendor/subminer-yomitan/node_modules
          key: ${{ runner.os }}-${{ runner.arch }}-bun-${{ hashFiles('bun.lock', 'stats/bun.lock', 'vendor/subminer-yomitan/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-bun-

      - name: Install dependencies
        run: |
          bun install --frozen-lockfile
          cd stats && bun install --frozen-lockfile

      - name: Lint changelog fragments
        run: bun run changelog:lint

      - name: Lint stats (formatting)
        run: bun run lint:stats

      - name: Enforce pull request changelog fragments (`skip-changelog` label bypass)
        if: github.event_name == 'pull_request'
        env:
          BASE_REF: ${{ github.base_ref }}
          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
        run: bun run changelog:pr-check --base-ref "origin/$BASE_REF" --head-ref "HEAD" --labels "$PR_LABELS"

      - name: Build (TypeScript check)
        run: bun run typecheck

      - name: Verify generated config examples
        run: bun run verify:config-example

      - name: Install Lua
        run: |
          sudo apt-get update
          sudo apt-get install -y lua5.4
          sudo ln -sf /usr/bin/lua5.4 /usr/local/bin/lua
          lua -v

      - name: Test suite (source)
        run: bun run test:fast

      - name: Environment suite
        run: bun run test:env

      - name: Coverage suite (maintained source lane)
        run: bun run test:coverage:src

      - name: Upload coverage artifact
        uses: actions/upload-artifact@v4
        with:
          name: coverage-test-src
          path: coverage/test-src/lcov.info
          if-no-files-found: error

      - name: Stats UI tests
        run: bun run test:stats

      - name: Launcher smoke suite (source)
        run: bun run test:launcher:smoke:src

      - name: Upload launcher smoke artifacts (on failure)
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: launcher-smoke
          path: .tmp/launcher-smoke/**
          if-no-files-found: ignore

      - name: Build (bundle)
        run: bun run build

      - name: Immersion SQLite verification
        run: bun run test:immersion:sqlite:dist

      - name: Dist smoke suite
        run: bun run test:smoke:dist

      - name: Security audit
        run: bun audit --audit-level high

      - name: Build Bun subminer wrapper
        run: make build-launcher

      - name: Verify Bun subminer wrapper
        run: dist/launcher/subminer --help >/dev/null

      - name: Enforce generated launcher workflow
        run: bash scripts/verify-generated-launcher.sh