quality.yml

name: Quality

on:
  push:
    branches: [develop, main, "milestone-*"]
  pull_request:
  workflow_dispatch:
    inputs:
      profile:
        description: Assurance profile to run
        required: true
        default: feature
        type: choice
        options: [feature, integration, release]
      targets:
        description: Extra hosted targets (comma-separated)
        required: false
        type: string
  schedule:
    - cron: "15 3 * * 1"

permissions:
  contents: read

concurrency:
  group: oxid-quality-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  quality:
    name: Audit, Licenses, Sources, and Documentation
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Select profile and target lanes
        id: plan
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before || 'origin/develop' }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          EVENT_NAME: ${{ github.event_name }}
          BASE_BRANCH: ${{ github.base_ref || '' }}
          HEAD_BRANCH: ${{ github.head_ref || '' }}
          REF_NAME: ${{ github.ref_name }}
          REQUESTED_PROFILE: ${{ inputs.profile || 'auto' }}
          EXTRA_TARGETS: ${{ inputs.targets || '' }}
        run: |
          node scripts/ci/target-plan.mjs \
            --base "$BASE_SHA" \
            --head "$HEAD_SHA" \
            --event "$EVENT_NAME" \
            --base-branch "$BASE_BRANCH" \
            --head-branch "$HEAD_BRANCH" \
            --ref-name "$REF_NAME" \
            --profile "$REQUESTED_PROFILE" \
            --targets "$EXTRA_TARGETS" \
            --format github >> "$GITHUB_OUTPUT"

      - name: Install Nix
        if: steps.plan.outputs.quality == 'true'
        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22

      - name: Cache the cargo registry
        if: steps.plan.outputs.quality == 'true'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cargo/registry/index
            ~/.cargo/registry/cache
            ~/.cargo/git/db
          key: cargo-quality-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml') }}

      - name: Run quality gate
        if: steps.plan.outputs.quality == 'true'
        run: nix develop .#ci-quality --command ./run.sh quality --strict

      - name: Run lightweight policy gate
        if: steps.plan.outputs.quality != 'true'
        run: |
          ./scripts/check-adr-links.sh
          node --test tests/repository/target-plan-contract.test.mjs