name: Staging Integrity Gate

# Phase P automation. Runs the Phase O staging integrity checklist programmatically
# against a hosted staging Supabase + worker. The maintainer's role narrows
# to reviewing the generated report and merging the sign-off PR — not executing
# the checks by hand.
#
# Trigger this manually via the Actions tab when staging is in a known-good state
# (post-deploy, pre-Limited-Beta-flip).

on:
  workflow_dispatch:
    inputs:
      sign_off:
        description: 'Open a PR that fills the Phase O sign-off rows (yes / no)'
        required: true
        default: 'no'

jobs:
  integrity:
    runs-on: ubuntu-latest
    env:
      STAGING_PLATFORM_API_URL: ${{ secrets.STAGING_PLATFORM_API_URL }}
      STAGING_SUPABASE_URL: ${{ secrets.STAGING_SUPABASE_URL }}
      STAGING_SUPABASE_SERVICE_KEY: ${{ secrets.STAGING_SUPABASE_SERVICE_KEY }}
      STAGING_TEST_LENSER_TOKEN: ${{ secrets.STAGING_TEST_LENSER_TOKEN }}
      STAGING_MODERATION_WEBHOOK_LISTENER: ${{ secrets.STAGING_MODERATION_WEBHOOK_LISTENER }}

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Run staging integrity checklist
        id: integrity
        run: |
          node tools/run-staging-integrity-checklist.mjs --report integrity-report.json
          echo "report=$(cat integrity-report.json | jq -c .)" >> "$GITHUB_OUTPUT"

      - name: Upload integrity report artifact
        uses: actions/upload-artifact@v4
        with:
          name: integrity-report
          path: integrity-report.json

      - name: Generate sign-off PR
        if: ${{ inputs.sign_off == 'yes' && success() }}
        run: |
          node tools/apply-integrity-signoff.mjs --report integrity-report.json
          git config user.name 'lenserfight-bot'
          git config user.email 'bot@lenserfight.org'
          BRANCH="staging-integrity-signoff/$(date -u +%Y%m%d-%H%M%S)"
          git checkout -b "$BRANCH"
          git add docs/how-to/battles/battle-integrity-checklist.md
          git commit -m "Phase P: auto-sign Phase O staging gate from CI run" || {
            echo "No changes to sign — checklist already up to date."
            exit 0
          }
          git push origin "$BRANCH"
          gh pr create \
            --base main \
            --head "$BRANCH" \
            --title "Phase P: Auto-sign Phase O staging gate ($(date -u +%Y-%m-%d))" \
            --body "Generated by the Staging Integrity Gate workflow. See the integrity-report artifact attached to that run for evidence." \
            --label cloud-battles-beta-gate
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Comment summary on workflow run
        if: always()
        run: |
          echo "## Staging Integrity Gate Report" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          jq -r '"Overall: " + (if .overall_ok then "PASS" else "FAIL" end)' integrity-report.json >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "| Check | Status | Name |" >> "$GITHUB_STEP_SUMMARY"
          echo "|---|---|---|" >> "$GITHUB_STEP_SUMMARY"
          jq -r '.checks[] | "| " + .id + " | " + (if .ok then "PASS" else "FAIL" end) + " | " + .name + " |"' integrity-report.json >> "$GITHUB_STEP_SUMMARY"
