# PR gate for a repo whose runner is a DEDICATED CI box (debian1/debian2), not a shared dev box.
#
# Differences from pr-gate.yml (the platform instance, whose runner shares the dev box):
#   - no TURBO_CACHE_DIR / BUILD_CPU_RESERVE: there is no second consumer to share a cache with and
#     no interactive work to reserve cores for. Copying them here would be cargo-culting a
#     workaround for a constraint this box does not have.
#   - BUILD_SCHED_IDLE stays only if the repo actually routes work through cpu-limit.sh. With no
#     wrapper the variable is inert, so it is absent below rather than decorative.
#
# Adapt: __PROJECT__ (runner label), __NODE__, the install step (pnpm vs npm), and the gate steps.
# The label must match the runner registered by templates/register-runner.sh --label <project>-gate;
# a label mismatch does not error, it queues the job forever.
name: PR Gate

on:
  pull_request:
    branches: [main]

concurrency:
  group: pr-gate-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  gate:
    name: Full gate
    # Self-hosted runner + pull_request = arbitrary code execution from a fork PR. This guard is
    # what makes the repo safe to make public later; it must be on EVERY job, not just this one.
    if: github.event.pull_request.head.repo.full_name == github.repository
    runs-on: [self-hosted, linux, x64, __PROJECT__-gate]
    timeout-minutes: 60
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Setup pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
        with:
          # action-setup installs into a fixed ~/setup-pnpm by default. When several repo-scoped
          # runners share one box, concurrent jobs race on that path and leave a truncated binary
          # (exit 127) or EACCES. runner.temp is per-job, which removes the shared path entirely.
          dest: ${{ runner.temp }}/setup-pnpm

      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: __NODE__
          cache: pnpm

      # MUST come after Setup Node, not after Checkout: a dedicated CI box carries no system node,
      # so placing this "to fail fast" exits 127 before it can check anything.
      - name: Workflow contract
        run: node tools/check-offload-workflow.mjs .github/workflows/pr-gate.yml

      - name: Install
        run: pnpm install --frozen-lockfile

      # The box already carries the playwright system libraries, so --with-deps is omitted: it
      # needs sudo and would fail on a user-scope runner. Browser builds land in the shared
      # ~/.cache/ms-playwright and are reused across every repo on this host.
      - name: Install Playwright browsers
        run: pnpm exec playwright install chromium

      - name: Gate
        run: __GATE_STEPS__
