name: coverage-gate

# SOC2 CC4.1 — track unit-test coverage on changed files. ENFORCED (issue #9943):
# a PR that changes source under packages/plugins/apps must change at least one
# unit test that can emit coverage. Every surviving changed executable source
# must appear in LCOV and clear the line-coverage floor. A source-aware
# classifier strips TypeScript-only syntax before excluding modules with no
# runtime code; declarations and deleted files are not targets. LCOV LF:0 never
# proves type-only status. Source covered only by e2e/live lanes still needs a
# focused unit test in this gate. Docs-only PRs do not spend coverage time.
# Standalone Node self-tests are excluded only when listed in the manifest that
# the Develop PR Test Integrity job executes on every PR.
# A test-only PR (changed tests, no changed source) executes its changed tests —
# gating the run steps on changed *source* let such PRs go vacuously green with
# the new test never running (#15849); the per-file floor simply has no source
# to enforce against.
#
# The per-package coverage floors live in the shared base vitest config
# (packages/test/vitest/default.config.ts, sourced from coverage-policy.mjs) and
# apply on a `--coverage` run. This changed-files gate is the second layer: it
# enforces a per-changed-file floor (`threshold` below), set to a ratchetable 50%
# — raise it toward the long-term 70% target as suites fill in. See issue #9943
# (the umbrella) and #10104 for the broader test-gating audit.

on:
  pull_request:
    branches: [develop, main]
    paths:
      - "packages/**"
      - "plugins/**"
      - "apps/**"

# cancel superseded in-flight runs for the same PR to free hosted-runner
# capacity. only cancels pull_request runs; push runs on protected branches
# (main/develop) are never cancelled mid-flight.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

env:
  NODE_VERSION: "24.15.0"

jobs:
  coverage:
    name: coverage on changed files
    runs-on: ${{ fromJSON(vars.HETZNER_FLEET_ONLINE == 'false' && '["ubuntu-24.04"]' || '["self-hosted","hetzner-robot"]') }}
    steps:
      - name: Checkout
        # actions/checkout@v4
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          fetch-depth: 0

      - name: Setup Node.js for source classification
        # The classifier is Node-based and runs before optional Bun workspace
        # setup, including for JSON-only PRs on runners without system Node.
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Determine changed files
        id: changed
        # Three-dot diff (merge-base..HEAD) so a branch trailing develop does not
        # count develop-side files it never touched. Logic lives in the script so
        # its path/diff boundary rules are regression-tested (issue #15845).
        run: |
          bash scripts/security/coverage-changed-files.sh \
            "${{ github.event.pull_request.base.sha }}" \
            "${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"

      - name: Require changed tests for changed source
        if: steps.changed.outputs.files != '' && steps.changed.outputs.bun_tests == '' && steps.changed.outputs.vitest_tests == '' && steps.changed.outputs.node_tests == ''
        run: |
          echo "Changed source files require at least one changed Bun or Vitest unit test:"
          printf '%s\n' "${{ steps.changed.outputs.files }}"
          exit 1

      - name: Setup Bun workspace
        if: steps.changed.outputs.bun_tests != '' || steps.changed.outputs.vitest_tests != ''
        # Keep dependency setup behind the changed-test check so docs-only and
        # test-free source PRs either skip or fail before spending setup time.
        # Not gated on changed source: a test-only PR (files == '') must still
        # execute its changed tests, or the suite goes vacuously green (#15849).
        uses: ./.github/actions/setup-bun-workspace
        with:
          install-native-deps: "false"
          install-protoc: "false"
          setup-python: "false"

      - name: Run changed registered Node self-tests
        if: steps.changed.outputs.node_tests != ''
        run: |
          while IFS= read -r self_test; do
            [ -n "$self_test" ] || continue
            node "$self_test"
          done <<'EOF'
          ${{ steps.changed.outputs.node_tests }}
          EOF

      - name: Run changed Bun tests with coverage
        if: steps.changed.outputs.bun_tests != ''
        run: |
          cat > "$RUNNER_TEMP/changed-tests.txt" <<'EOF'
          ${{ steps.changed.outputs.bun_tests }}
          EOF
          mapfile -t changed_tests < <(grep -v '^$' "$RUNNER_TEMP/changed-tests.txt" || true)
          if [ "${#changed_tests[@]}" -eq 0 ]; then
            echo "no changed Bun-native test files; skipping coverage run"
            exit 0
          fi
          shared_tests=()
          process_isolated_tests=()
          for test_file in "${changed_tests[@]}"; do
            case "$test_file" in
              packages/cloud/api/v1/voice/session/__tests__/harness-real-server.test.ts|packages/tools/voice-evidence-harness/src/cli-run.test.ts)
                process_isolated_tests+=("$test_file")
                ;;
              *) shared_tests+=("$test_file") ;;
            esac
          done
          # This lane runs before workspace builds, so package defaults point at
          # absent dist files; source exports keep changed tests self-contained.
          if [ "${#shared_tests[@]}" -gt 0 ]; then
            bun test --conditions=eliza-source "${shared_tests[@]}" --coverage --coverage-reporter=lcov --coverage-dir=coverage/bun/shared
          fi
          # Bun module mocks remain process-global despite `--isolate`. Tests
          # listed here run in fresh processes and emit separate LCOV files;
          # the gate below already aggregates every coverage/**/lcov.info.
          for index in "${!process_isolated_tests[@]}"; do
            ELIZA_PROCESS_ISOLATED_TEST=1 bun test --conditions=eliza-source "${process_isolated_tests[$index]}" --coverage --coverage-reporter=lcov --coverage-dir="coverage/bun/isolated-$index"
          done
        env:
          # Tests must produce LCOV under this coverage root; the enforced gate
          # recursively aggregates process-isolated and shared outputs.
          BUN_COVERAGE_DIR: coverage/bun

      - name: Build core for changed Vitest tests
        if: steps.changed.outputs.vitest_tests != ''
        # Vitest package configs may exercise source graphs that still depend on
        # the standard built core/logger/contracts/cloud-routing entrypoints.
        run: bun run --cwd packages/core build

      - name: Run changed Vitest tests with coverage
        if: steps.changed.outputs.vitest_tests != ''
        run: |
          cat > "$RUNNER_TEMP/changed-vitest-tests.txt" <<'EOF'
          ${{ steps.changed.outputs.vitest_tests }}
          EOF
          mapfile -t changed_tests < <(grep -v '^$' "$RUNNER_TEMP/changed-vitest-tests.txt" || true)
          if [ "${#changed_tests[@]}" -eq 0 ]; then
            echo "no changed Vitest test files; skipping coverage run"
            exit 0
          fi
          node packages/scripts/run-changed-vitest-coverage.mjs "${changed_tests[@]}"

      - name: Apply coverage gate (enforced)
        # Runs whenever changed tests ran, including test-only PRs (files == '').
        # With no changed source, executing the changed tests is the gate:
        # Bun may not emit LCOV when it only ran tests, and there is no per-file
        # floor to enforce (#15849).
        if: steps.changed.outputs.bun_tests != '' || steps.changed.outputs.vitest_tests != '' || steps.changed.outputs.node_tests != ''
        env:
          COVERAGE_GATE_ENFORCE: "1"   # enforced (issue #9943)
        run: |
          mapfile -t lcov_files < <(find coverage -name lcov.info -type f | sort)
          if [ "${#lcov_files[@]}" -eq 0 ]; then
            if [ -z "${{ steps.changed.outputs.files }}" ]; then
              echo "changed tests ran; no changed source files require LCOV enforcement"
              exit 0
            fi
            echo "changed tests ran but no coverage/lcov.info files were produced"
            exit 1
          fi
          awk \
            -v changed="${{ steps.changed.outputs.files }}" \
            -v threshold=50 \
            -f scripts/security/coverage-gate.awk \
            "${lcov_files[@]}"