architecture-gates.yml

name: architecture-gates

on:
  pull_request:
  push:
    branches: [main]

jobs:
  mechanical-architecture-gates:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Ensure script is executable
        run: chmod +x scripts/review-checklist.sh

      - name: Compute PR diff SHAs
        id: shas
        shell: bash
        run: |
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            echo "base_sha=${{ github.event.pull_request.base.sha }}" >> "$GITHUB_OUTPUT"
            echo "head_sha=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"
          else
            # push event fallback: previous commit -> current SHA
            # github.event.before is the all-zero null SHA on first-time branch pushes
            before="${{ github.event.before }}"
            if [[ "$before" == "0000000000000000000000000000000000000000" ]]; then
              # First-time branch push: verify parent exists before using it
              if git rev-parse --verify "${{ github.sha }}^" >/dev/null 2>&1; then
                before="${{ github.sha }}^"
              else
                # Initial repo commit: no parent; leave base_sha unset so the
                # script falls back to its HEAD~1 HEAD path gracefully
                before=""
              fi
            fi
            if [[ -n "$before" ]]; then
              echo "base_sha=$before" >> "$GITHUB_OUTPUT"
            fi
            echo "head_sha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
          fi

      - name: Run architecture mechanical gates
        env:
          BASE_REF_SHA: ${{ steps.shas.outputs.base_sha }}
          HEAD_REF_SHA: ${{ steps.shas.outputs.head_sha }}

          # Customize policy here (regex, colon-separated for multiple rules)
          FORBIDDEN_TRACKED_PATHS_REGEX: "^\\.gitmind/materialized/|^\\.gitmind/cache/|^dist/materialized/|^tmp/materialized/"
          PUBLISH_ALLOWLIST_REGEX: "^docs/published/"
          GENERATED_MARKER_REGEX: "^x-gitmind-generated:|^# Generated by Git Mind|^<!-- Generated by Git Mind -->"

          SCHEMA_DIR: "contracts/schemas"
          CONTRACT_DIR_REGEX: "^src/(contracts|api)/|^contracts/|^docs/contracts/"
          CORE_PATH_REGEX: "^src/(domain|core|engine|materialization)/"
          WORKTREE_COUPLING_PATTERN: "process\\.cwd\\(|fs\\.readFileSync\\(|fs\\.readFile\\(|git\\s+rev-parse\\s+--show-toplevel|git\\s+status"
        run: |
          scripts/review-checklist.sh