ctms/.github/workflows/client-quality-gates.yml

name: Client Quality Gates

on:
  pull_request:
    paths:
      - "AGENTS.md"
      - "frontend/**"
      - ".github/workflows/client-quality-gates.yml"
      - "docs/branch-governance.md"
      - "docs/desktop-project-plan.md"
      - "docs/desktop-phase-1-design.md"
      - "docs/desktop-phase-2-design.md"
      - "docs/audits/desktop-release-stabilization-checklist.md"
      - "docs/guides/client-release.md"
      - "docs/guides/branch-maintenance-sop-zh.md"
  push:
    branches:
      - dev
      - main
      - release
    tags:
      - "v*"
    paths:
      - "AGENTS.md"
      - "frontend/**"
      - ".github/workflows/client-quality-gates.yml"
      - "docs/branch-governance.md"
      - "docs/desktop-project-plan.md"
      - "docs/desktop-phase-1-design.md"
      - "docs/desktop-phase-2-design.md"
      - "docs/audits/desktop-release-stabilization-checklist.md"
      - "docs/guides/client-release.md"
      - "docs/guides/branch-maintenance-sop-zh.md"

jobs:
  web:
    name: Shared client and Web
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Resolve build metadata
        id: build-metadata
        shell: bash
        run: |
          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            channel="release"
          elif [[ "${GITHUB_REF_NAME}" == "dev" || "${GITHUB_REF_NAME}" == "main" || "${GITHUB_REF_NAME}" == "release" ]]; then
            channel="${GITHUB_REF_NAME}"
          else
            channel="dev"
          fi
          echo "channel=${channel}" >> "${GITHUB_OUTPUT}"
          echo "commit=${GITHUB_SHA}" >> "${GITHUB_OUTPUT}"

      - name: Check release build metadata
        run: npm run release:env:check
        env:
          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}

      - name: Check synchronized client version
        run: npm run version:check

      - name: Check runtime boundary
        run: npm run runtime:check

      - name: Check desktop release and security gate
        run: npm run desktop:release:check

      - name: Check UI contract
        run: npm run ui:contract

      - name: Type check
        run: npm run type-check

      - name: Unit tests
        run: npm run test:unit

      - name: Build Web artifact
        run: npm run build
        env:
          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}

  desktop:
    name: macOS Desktop
    runs-on: macos-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install dependencies
        run: npm ci

      - name: Resolve build metadata
        id: build-metadata
        shell: bash
        run: |
          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            channel="release"
          elif [[ "${GITHUB_REF_NAME}" == "dev" || "${GITHUB_REF_NAME}" == "main" || "${GITHUB_REF_NAME}" == "release" ]]; then
            channel="${GITHUB_REF_NAME}"
          else
            channel="dev"
          fi
          echo "channel=${channel}" >> "${GITHUB_OUTPUT}"
          echo "commit=${GITHUB_SHA}" >> "${GITHUB_OUTPUT}"

      - name: Check release build metadata
        run: npm run release:env:check
        env:
          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}

      - name: Check synchronized client version
        run: npm run version:check

      - name: Check runtime boundary
        run: npm run runtime:check

      - name: Check desktop release and security gate
        run: npm run desktop:release:check

      - name: Check UI contract
        run: npm run ui:contract

      - name: Build unsigned macOS application smoke artifact
        run: npm run desktop:build:app
        env:
          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}