name: Quality Gates

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  quality-checks:
    name: Quality Gates (PMAT v2.200.0)
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Install Rust toolchain
      uses: actions-rust-lang/setup-rust-toolchain@v1
      with:
        toolchain: stable
        components: rustfmt, clippy

    - name: Cache cargo registry
      uses: actions/cache@v4
      with:
        path: ~/.cargo/registry
        key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}

    - name: Cache cargo index
      uses: actions/cache@v4
      with:
        path: ~/.cargo/git
        key: ${{ runner.os }}-cargo-git-${{ hashFiles('**/Cargo.lock') }}

    - name: Cache target directory
      uses: actions/cache@v4
      with:
        path: target
        key: ${{ runner.os }}-target-${{ hashFiles('**/Cargo.lock') }}

    - name: Build PMAT binary
      working-directory: ./server
      run: cargo build --release --bin pmat

    - name: Install PMAT
      run: |
        cp target/release/pmat /usr/local/bin/pmat
        pmat --version

    # Quality Gate 1: Critical Defects (BLOCKING)
    - name: "Gate 1: Check for critical defects"
      working-directory: ./server
      run: |
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        echo "🔴 GATE 1: Critical Defects (Known Defects v2.1)"
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        pmat analyze defects --path . --format text || {
          echo "❌ CRITICAL DEFECTS FOUND - Build blocked"
          echo "Run: pmat analyze defects --path . --format text"
          exit 1
        }

    # Quality Gate 2: TDG Analysis (BLOCKING)
    - name: "Gate 2: Technical Debt Grading"
      working-directory: ./server
      run: |
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        echo "📊 GATE 2: Technical Debt Grading"
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        pmat analyze tdg --path . --format table || {
          echo "❌ TDG SCORE TOO LOW - Build blocked"
          echo "Run: pmat analyze tdg --path . --format table"
          exit 1
        }

    # Quality Gate 3: Clippy (BLOCKING)
    - name: "Gate 3: Clippy lints"
      working-directory: ./server
      run: |
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        echo "🔧 GATE 3: Clippy Lints"
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        cargo clippy --all-targets --all-features -- -D warnings || {
          echo "❌ CLIPPY WARNINGS FOUND - Build blocked"
          echo "Run: cargo clippy --fix --allow-dirty --allow-staged"
          exit 1
        }

    # Quality Gate 4: Rustfmt (BLOCKING)
    - name: "Gate 4: Code formatting"
      working-directory: ./server
      run: |
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        echo "📝 GATE 4: Code Formatting"
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        cargo fmt --all -- --check || {
          echo "❌ CODE NOT FORMATTED - Build blocked"
          echo "Run: cargo fmt --all"
          exit 1
        }

    - name: Install cargo-nextest
      uses: taiki-e/install-action@cargo-nextest

    # Quality Gate 5: Tests (BLOCKING)
    - name: "Gate 5: Run tests"
      working-directory: ./server
      run: |
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        echo "🧪 GATE 5: Unit & Integration Tests (Parallel with nextest)"
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        cargo nextest run --lib --release --profile ci || {
          echo "❌ TESTS FAILED - Build blocked"
          echo "Run: cargo nextest run --lib"
          exit 1
        }

    # Quality Gate 6: Rust Project Score (WARNING)
    - name: "Gate 6: Rust Project Score"
      working-directory: ./server
      continue-on-error: true
      run: |
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        echo "🦀 GATE 6: Rust Project Score (v1.1)"
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        pmat rust-project-score --path . --format text > score.txt
        cat score.txt

        # Extract score and fail if below threshold
        SCORE=$(grep "Score:" score.txt | awk '{print $2}' | cut -d'/' -f1)
        if (( $(echo "$SCORE < 80" | bc -l) )); then
          echo "⚠️  WARNING: Score $SCORE below threshold (80.0)"
          echo "This is a warning - build will continue"
        fi

    # Quality Gate 7: Security Audit
    - name: "Gate 7: Security audit"
      working-directory: ./server
      continue-on-error: true
      run: |
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        echo "🔒 GATE 7: Security Audit"
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        cargo install cargo-audit || true
        cargo audit || {
          echo "⚠️  SECURITY VULNERABILITIES FOUND"
          echo "Run: cargo audit"
        }

    # Upload artifacts
    - name: Upload quality reports
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: quality-reports
        path: |
          score.txt
        retention-days: 30

  quality-summary:
    name: Quality Summary
    runs-on: ubuntu-latest
    needs: quality-checks
    if: always()

    steps:
    - name: Print summary
      run: |
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        echo "✅ Quality Gates Summary"
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        echo ""
        echo "PMAT Version: v2.200.0"
        echo "Known Defects: v2.1 (TDG auto-fail enabled)"
        echo ""
        echo "Gate Results:"
        echo "  1. Critical Defects: ${{ needs.quality-checks.result }}"
        echo "  2. TDG Analysis: ${{ needs.quality-checks.result }}"
        echo "  3. Clippy Lints: ${{ needs.quality-checks.result }}"
        echo "  4. Code Formatting: ${{ needs.quality-checks.result }}"
        echo "  5. Tests: ${{ needs.quality-checks.result }}"
        echo "  6. Rust Project Score: WARNING ONLY"
        echo "  7. Security Audit: WARNING ONLY"
        echo ""
        if [ "${{ needs.quality-checks.result }}" = "success" ]; then
          echo "✅ All quality gates passed!"
        else
          echo "❌ Some quality gates failed - see logs above"
          exit 1
        fi
