#!/usr/bin/env bash
# ci-local.sh reproduces the CI job (.github/workflows/ci.yml) on a developer machine so the
# pipeline can be run without the platform. Same four steps, same order, same fail closed
# behavior: build the FIPS binaries, run the unit suite with the race detector under FIPS
# runtime, then run the security gates. Any failure aborts immediately with a non zero exit.
#
# The integration suite is NOT run here. It needs a live Postgres 16 with pgvector and the
# MEGAMIND plane (make test-integration with MM_APP_DSN and MM_MIGRATOR_DSN against M4). Run
# that separately as a manual or staging step.
#
# Usage: scripts/ci-local.sh
set -euo pipefail

# Pin the validated FIPS module, matching docs/STACK_DECISIONS.md section 1 and the Makefile.
export GOFIPS140=v1.0.0

# Run from the repo root regardless of where the script is invoked from.
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$repo_root"

echo "==> 1/4 build the FIPS binaries (cross compile, CGO off, validated module)"
make build

echo "==> 2/4 unit suite with the race detector under FIPS runtime"
# The race detector needs CGO. GODEBUG=fips140=on runs the validated module in FIPS mode.
# Plain `go test ./...` skips internal/integration because that suite carries the integration
# build tag and is not selected here.
CGO_ENABLED=1 GODEBUG=fips140=on go test -race ./...

echo "==> 3/4 backdoor gate (verify-backdoor)"
make verify-backdoor

echo "==> 4/4 FIPS stamp gate (verify-fips)"
make verify-fips

echo "==> ci-local PASS: build, race unit suite, backdoor gate, and FIPS stamp gate all green"