# CASAN harness gate — Gitea Actions workflow (adoption template).
# Copy to .gitea/workflows/casan-ci.yml in your project. Assumes the CASAN core harness
# lives at packages/casan-harness/ (via casan-devkit install.sh) and domain data at
# apps/<project>/domain/. Runs the full governance gate on every push/PR.
name: CASAN Gate

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  casan-gate:
    runs-on: ci-runner
    timeout-minutes: 45
    env:
      CASAN_CI_RUN_FRONTEND: "0"        # set 1 if your project has a frontend workspace
      CASAN_CI_RUN_BACKEND: "0"         # set 1 if your project has backend tests
      CASAN_CI_RUN_INFRA_LAB: "0"
      CASAN_CI_STEP_TIMEOUT_SEC: "1200" # headroom; some suites are model-backed
      # CASAN_DOMAIN_ROOT: apps/<project>/domain   # uncomment + set for your project
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Ensure toolchain
        run: |
          set -euo pipefail
          command -v python3 >/dev/null || { apt-get update && apt-get install -y python3; }
          python3 --version

      - name: Run CASAN harness gate
        run: bash packages/casan-harness/scripts/bash/ci-harness-gate.sh

      - name: Verify audit chain + policy bundle
        run: |
          bash packages/casan-harness/scripts/bash/verify-audit-chain.sh
          bash packages/casan-harness/scripts/bash/sign-policy-bundle.sh verify