# ============================================================================
# GATETEST QUALITY GATE — DISABLED (auto-triggers off)
# ============================================================================
# Authorized by Craig (ccantynz-alt) on 2026-04-30.
#
# This workflow tried to clone the GateTest CLI source from a private dev
# repo on every push, producing red runs because the clone fails. The real
# GateTest integration happens via API call in src/hooks/post-receive.ts
# → ${GATETEST_URL} on every git push — that uses the actual GateTest
# service account and is canonical. The two never needed to coexist.
#
# Triggers narrowed to workflow_dispatch only so the file is preserved
# (with original logic intact) but never auto-fires. To re-enable as a
# proper CI gate, swap the dev-repo clone step for a published GateTest
# GitHub Action and restore the push/pull_request triggers below.
# ============================================================================

name: GateTest Quality Gate (DISABLED)

on:
  workflow_dispatch: {}

permissions:
  contents: read
  pull-requests: write
  security-events: write
  checks: write

concurrency:
  group: gatetest-${{ github.ref }}
  cancel-in-progress: true

jobs:
  gatetest:
    name: GateTest — Quality Gate
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout target repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install project dependencies
        run: bun install --frozen-lockfile

      - name: Clone GateTest (single source of truth)
        run: |
          git clone --depth 1 https://github.com/ccantynz-alt/gatetest.git "$RUNNER_TEMP/gatetest"
          echo "GATETEST_HOME=$RUNNER_TEMP/gatetest" >> $GITHUB_ENV
          echo "$RUNNER_TEMP/gatetest/bin" >> $GITHUB_PATH
          chmod +x "$RUNNER_TEMP/gatetest/bin/gatetest.js"

      - name: Verify GateTest installed
        run: node "$GATETEST_HOME/bin/gatetest.js" --version

      - name: GateTest — Quick (diff-mode) on PRs
        if: github.event_name == 'pull_request'
        run: node "$GATETEST_HOME/bin/gatetest.js" --suite quick --diff --sarif --junit --project "$GITHUB_WORKSPACE"

      - name: GateTest — Full on main push
        if: github.event_name == 'push'
        run: node "$GATETEST_HOME/bin/gatetest.js" --suite full --sarif --junit --project "$GITHUB_WORKSPACE"

      - name: Upload SARIF to GitHub Security
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: .gatetest/reports/gatetest-results.sarif
          category: gatetest

      - name: Upload GateTest reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: gatetest-reports-${{ github.run_id }}
          path: |
            .gatetest/reports/
          retention-days: 30
          if-no-files-found: ignore