name: Fast gate

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
    paths-ignore:
      - '**/*.md'
      - 'docs/**'

concurrency:
  group: fast-gate-${{ github.event.pull_request.number || github.ref }}
  # Pushes to main must each reach a verdict; only PR iterations supersede each other.
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  actions: read
  contents: read

env:
  NODE_OPTIONS: --max-old-space-size=6144
  BUILD_VITEST_MAX_FORKS: '4'
  BUILD_VITEST_MAX_THREADS: '4'
  BUILD_SCHED_IDLE: '0'
  # Heavy lanes share a host under build.slice's aggregate ceiling instead of
  # queueing inside a timed step, where the wait consumed timeout-minutes.
  BUILD_NO_LOCK: '1'

jobs:
  quality-changed:
    name: Quality / changed
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: [self-hosted, linux, x64, multideal-gate]
    timeout-minutes: 20
    env:
      QUALITY_BASE_REF: ${{ github.event_name == 'pull_request' && format('origin/{0}', github.base_ref) || 'HEAD~1' }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: ./.github/actions/setup
        with:
          github-packages-token: ${{ secrets.GH_PKG_READ_TOKEN }}
      - name: Changed lint
        run: pnpm lint:changed --base-ref "$QUALITY_BASE_REF"
      - name: Changed slopgate
        run: pnpm slop:changed --base-ref "$QUALITY_BASE_REF"
      - name: Changed E2E risk reconciliation
        run: pnpm risk:changed --base-ref "$QUALITY_BASE_REF"
      - name: Quality gate contracts
        run: pnpm quality:changed:test
      - name: Full slopgate
        run: pnpm slop:full

  test:
    name: Typecheck / unit
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: [self-hosted, linux, x64, multideal-gate]
    timeout-minutes: 60
    env:
      # This job outlives the other two by ~7 of its ~12 minutes, so it spends most
      # of its life alone on the host. build.slice's 700% aggregate quota absorbs
      # the brief three-job overlap; sizing for that overlap throttled the whole run.
      BUILD_VITEST_MAX_FORKS: '6'
      BUILD_VITEST_MAX_THREADS: '6'
    steps:
      # fetch-depth:0 for diff-based unit tests (origin/main refs). Locale structural parity lives in locale-structural-parity.
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: ./.github/actions/setup
        with:
          github-packages-token: ${{ secrets.GH_PKG_READ_TOKEN }}
      - name: Typecheck
        run: bash apps/web/scripts/cpu-limit.sh pnpm --filter web typecheck
      - name: Ledger parity gate
        run: bash apps/web/scripts/cpu-limit.sh node apps/web/scripts/migration-audit.mjs
      - name: E2E risk and coverage contract
        run: bash apps/web/scripts/cpu-limit.sh pnpm --filter web check:e2e-risk
      - name: Stock concurrency tests
        run: bash apps/web/scripts/cpu-limit.sh pnpm --filter web test:stock-concurrency
      - name: Default test lane
        run: bash apps/web/scripts/cpu-limit.sh pnpm --filter web test

  test-realpg:
    name: Real-Postgres lanes
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: [self-hosted, linux, x64, multideal-gate]
    timeout-minutes: 60
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      NEON_API_KEY: ${{ secrets.NEON_CI_API_KEY }}
      NEON_PROJECT_ID: ${{ secrets.NEON_CI_PROJECT_ID }}
      NEON_MAIN_BRANCH_ID: ${{ secrets.NEON_CI_MAIN_BRANCH_ID }}
      SOURCE_DATABASE_URL: ${{ secrets.DATABASE_URL }}
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/setup
        with:
          github-packages-token: ${{ secrets.GH_PKG_READ_TOKEN }}
      - name: Real-Postgres cart lane
        run: bash apps/web/scripts/cpu-limit.sh pnpm --filter web test:cart-realpg
      - name: Real-Postgres migration replay lane
        run: bash apps/web/scripts/cpu-limit.sh bash apps/web/scripts/ci-with-disposable-pg.sh pnpm test:realpg
