# missionMATCH CI. Fails closed on the security gates. Runs on every push and pull request.
# This job runs the UNIT suite plus the gates only. The integration suite in
# internal/integration (build tag integration) needs a live Postgres 16 with pgvector and the
# MEGAMIND plane, which a GitHub hosted runner does not have, so it stays a manual or staging
# step (make test-integration against M4). See ci-reconciliation note in the PR description.
name: ci

on:
  push:
  pull_request:

# Least privilege. The whole workflow can only read repo contents. No write scopes anywhere.
permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # One job, one required status check named "build-test-gates". No matrix: the runner is
  # native linux/amd64, which is exactly the FIPS build target and the only platform the race
  # detector and the FIPS gates need. Add a matrix only when a second target appears.
  build-test-gates:
    name: build-test-gates
    runs-on: ubuntu-latest
    env:
      # The exact validated module pin from docs/STACK_DECISIONS.md section 1. Mirrors the Makefile.
      GOFIPS140: v1.0.0
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Set up Go
        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          # Single source of truth for the Go version: the go directive in go.mod (1.26).
          go-version-file: go.mod
          # setup-go caches GOMODCACHE and GOCACHE keyed on go.sum by default. Leave it on.
          cache: true

      - name: Build the FIPS binaries (cross compile, CGO off, validated module)
        # Same incantation as `make build`. Cross compiles to linux/amd64 on a linux/amd64
        # runner. Proves the release artifacts compile under GOFIPS140=v1.0.0.
        run: make build

      - name: Unit suite with the race detector under FIPS runtime
        # CGO_ENABLED=1 is mandatory for -race (ThreadSanitizer). It works here because the
        # runner is native linux/amd64, so this is a native test build, not a cross compile.
        # GODEBUG=fips140=on runs the validated module in FIPS mode for the test process.
        # No matrix tag, so internal/integration (build tag integration) is skipped: the DB
        # backed suite is a separate staging step, not part of CI.
        env:
          CGO_ENABLED: "1"
          GODEBUG: fips140=on
        run: go test -race ./...

      - name: Security gates (fail closed)
        # make ci-gates = verify-backdoor + verify-fips. These already exit non zero on any
        # failure, which fails the step and the job. There is deliberately NO continue-on-error
        # on this step, so a gate failure blocks the merge through the required status check.
        run: make ci-gates

  # Build the two container images. Each Dockerfile carries an in build RUN gate
  # (go version -m grep GOFIPS140=v1.0.0), so a SUCCESSFUL docker build is itself the proof that
  # the FIPS stamp is present in the image: a non FIPS binary fails the build. The runner ships
  # docker, so this also exercises the distroless non root image end to end.
  image:
    name: image
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Build the mm-api image (in build FIPS stamp gate)
        run: docker build -f infra/docker/Dockerfile.mm-api -t mm-api:ci .
      - name: Build the gateway image (in build FIPS stamp gate)
        run: docker build -f infra/docker/Dockerfile.megamind-gateway -t megamind-gateway:ci .

  # Terraform fmt and validate. No cloud credentials: init runs with -backend=false and validate is
  # offline, so this is safe in CI. plan and apply are the operator's step (see infra/terraform/README.md)
  # and are never run here.
  terraform:
    name: terraform
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Set up Terraform
        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
      - name: Format check
        run: terraform -chdir=infra/terraform fmt -check -recursive
      - name: Init without a backend (download providers, no credentials)
        run: terraform -chdir=infra/terraform init -backend=false -input=false
      - name: Validate
        run: terraform -chdir=infra/terraform validate