name: PR Gate

# Pre-merge gate — the authoritative green/red signal for every PR before it
# lands on main. Free tier has no branch protection, so merge enforcement lives
# in scripts/safe-merge.mjs (refuses to merge a PR whose "PR Gate" is not green);
# this workflow produces the signal that guard reads.

on:
  pull_request:
    branches: [main]

concurrency:
  group: pr-gate-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  gate:
    name: Full gate
    runs-on: [self-hosted, linux, x64, platform-gate]
    timeout-minutes: 90
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Setup pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: pnpm
      - name: Install
        run: pnpm install --frozen-lockfile
      - name: Install Playwright Chromium
        run: pnpm --filter @app/consumer exec playwright install chromium
      - name: Gate
        run: pnpm gate
        env:
          # Runner shares the dev box. Widen the core budget (default reserve 8)
          # but rely on nice/build.slice in cpu-limit.sh to keep the machine
          # responsive.
          BUILD_CPU_RESERVE: "2"
          # CI runs tests with wall-clock timeouts; under SCHED_IDLE a busy box
          # starves them into spurious failures (PGLite boots > 30s). Idle
          # scheduling stays on for interactive local runs only.
          BUILD_SCHED_IDLE: "0"
          # Same box as dev — use the machine-wide turbo cache (ACL-shared with
          # the dev user). Work already computed by the local pre-push replays
          # here instead of recomputing; no tar/untar of actions/cache.
          TURBO_CACHE_DIR: /var/cache/platform-turbo
