name: CASAN Harness CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  harness:
    runs-on: ci-runner
    timeout-minutes: 45
    env:
      CASAN_CI_RUN_FRONTEND: "1"
      CASAN_CI_RUN_INFRA_LAB: "0"
      CASAN_GEN_MODE: "template"
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install system dependencies
        run: |
          set -euo pipefail
          if ! command -v node >/dev/null 2>&1; then
            curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
            apt-get install -y nodejs
          fi
          node --version
          npm --version

      - name: Install npm dependencies
        working-directory: .
        run: npm ci

      - name: Run CASAN harness gate
        working-directory: .
        run: bash packages/casan-harness/scripts/bash/ci-harness-gate.sh

      - name: Build and verify Evidence Pack for this CI run
        if: always()
        working-directory: .
        run: |
          set -euo pipefail
          RUN_ID="gitea-${GITHUB_RUN_ID:-local}-${GITHUB_SHA:-$(git rev-parse --short HEAD)}"
          bash packages/casan-harness/scripts/bash/evidence-pack.sh pack "$RUN_ID"
          bash packages/casan-harness/scripts/bash/evidence-pack.sh verify-pack "$RUN_ID"

      - name: Publish Evidence Pack
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: casan-evidence-pack-${{ github.run_id }}
          path: docs/output/casan/evidence-packs/
          retention-days: 90