# CI for the international-press-zone plugin ONLY.
#
# This monorepo hosts several unrelated stacks; each active project gets its
# own path-filtered workflow instead of one repo-wide pipeline. This workflow
# wakes up only for changes touching the plugin or its gate policy, and is the
# server-side mirror of the local pre-commit -> remote debian-builder gate, so
# commits that never ran local hooks (cloud agents, fresh clones, --no-verify)
# are still gated at the PR boundary once these checks are marked Required
# under branch protection.
name: ipz-plugin-ci

on:
  pull_request:
    paths:
      - 'plugins/international-press-zone/**'
      - '.slopgate/**'
      - '.dev-config/**'
      - '.github/workflows/ipz-plugin-ci.yml'
  push:
    branches: [master]
    paths:
      - 'plugins/international-press-zone/**'
      - '.slopgate/**'
      - '.dev-config/**'
      - '.github/workflows/ipz-plugin-ci.yml'

concurrency:
  group: ipz-ci-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

jobs:
  php-static:
    name: PHPCS + PHPStan (committed baselines)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: shivammathur/setup-php@v2
        with:
          php-version: '8.2'
          extensions: mbstring, json
          coverage: none
      - name: Install plugin dev dependencies
        working-directory: plugins/international-press-zone
        run: composer install --no-interaction --no-progress --prefer-dist
      - name: PHPCS (occurrence-counting baseline)
        working-directory: plugins/international-press-zone
        run: |
          git ls-files 'includes/**/*.php' international-press-zone.php uninstall.php \
            | xargs -r php tools/phpcs-baseline.php check
      - name: PHPStan (baseline via phpstan.neon.dist)
        working-directory: plugins/international-press-zone
        run: vendor/bin/phpstan analyse -c phpstan.neon.dist --no-progress --error-format=github

  js-static:
    name: ESLint (repo eslint.config.mjs)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - name: Install lint toolchain
        working-directory: .dev-config
        run: npm ci
      - name: ESLint over plugin admin sources
        run: |
          npx --prefix .dev-config eslint \
            --config .dev-config/eslint.config.mjs \
            'plugins/international-press-zone/admin/src/**/*.js'

  admin-build:
    name: Admin build reproducibility
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - name: Build admin bundle
        working-directory: plugins/international-press-zone/admin
        run: |
          npm ci
          npm run build
      - name: Committed dist must match a fresh build
        run: |
          if ! git diff --exit-code -- plugins/international-press-zone/admin/dist; then
            echo '::error::admin/dist is stale — run `cd admin && npm run build` and commit the output.'
            exit 1
          fi

  slopgate:
    # slopgate (@alexcodeplace/slopgate) is not on the public npm registry, so
    # this job needs a self-hosted runner with the pinned install on PATH —
    # the existing debian builders, registered with the `ipz-gate` label.
    # Gated behind the IPZ_SELFHOSTED_READY repo variable so the job is
    # skipped (not queued forever) until a runner is actually registered.
    name: slopgate repo scan
    if: ${{ vars.IPZ_SELFHOSTED_READY == 'true' }}
    runs-on: [self-hosted, ipz-gate]
    steps:
      - uses: actions/checkout@v4
      - name: Immutable full-repository gate
        run: slopgate scan --scope repo --tier commit --format github --config .slopgate/config.toml
