name: Client Quality Gates

on:
  pull_request:
    paths:
      - "frontend/**"
      - "frontend/scripts/**"
      - ".github/workflows/client-quality-gates.yml"
      - "docs/branch-governance.md"
      - "docs/audits/desktop-release-stabilization-checklist.md"
      - "docs/guides/client-release.md"
      - "docs/guides/branch-maintenance-sop-zh.md"
      - "docs/branch-governance.md"
      - "docs/audits/desktop-release-stabilization-checklist.md"
      - "docs/guides/client-release.md"
      - "docs/guides/branch-maintenance-sop-zh.md"
  push:
    branches:
      - dev
      - main
      - release
    paths:
      - "frontend/**"
      - "frontend/scripts/**"
      - ".github/workflows/client-quality-gates.yml"

jobs:
  web:
    name: Shared client and Web
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Check synchronized client version
        run: npm run version:check

      - name: Check runtime boundary
        run: npm run runtime:check

      - name: Check desktop release and security gate
        run: npm run desktop:release:check

      - name: Type check
        run: npm run type-check

      - name: Unit tests
        run: npm run test:unit

      - name: Build Web artifact
        run: npm run build
        env:
          VITE_BUILD_CHANNEL: ${{ github.ref_name }}
          VITE_BUILD_COMMIT: ${{ github.sha }}

  desktop:
    name: macOS Desktop
    runs-on: macos-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install dependencies
        run: npm ci

      - name: Check synchronized client version
        run: npm run version:check

      - name: Check runtime boundary
        run: npm run runtime:check

      - name: Check desktop release and security gate
        run: npm run desktop:release:check

      - name: Build unsigned macOS application smoke artifact
        run: npm run desktop:build:app
        env:
          VITE_BUILD_CHANNEL: ${{ github.ref_name }}
          VITE_BUILD_COMMIT: ${{ github.sha }}