glpi-neuroforge-mega/.gitea/workflows/ci.yml

name: mega-ci

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  go-quality:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        module:
          - platform/neuroforge
          - services/agent
          - services/knowledge
          - services/control
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: ${{ matrix.module }}/go.mod
          cache-dependency-path: ${{ matrix.module }}/go.mod

      - name: Test
        working-directory: ${{ matrix.module }}
        run: go test ./...

      - name: Vet
        working-directory: ${{ matrix.module }}
        run: go vet ./...

      - name: Build
        working-directory: ${{ matrix.module }}
        run: go build ./...

  static-release-gates:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install PyYAML
        run: python3 -m pip install --user PyYAML

      - name: Static production preflight
        run: ./scripts/preflight.sh --static

      - name: Compose environment isolation
        run: ./scripts/check-compose-env.py

      - name: Secret scan
        run: ./scripts/secret-scan.sh

      - name: YAML syntax check
        shell: bash
        run: |
          python3 - <<'PY'
          from pathlib import Path
          import yaml
          files = list(Path('.').rglob('*.yml')) + list(Path('.').rglob('*.yaml'))
          for p in files:
              if '.git' in p.parts:
                  continue
              with p.open(encoding='utf-8') as f:
                  yaml.safe_load(f)
          print(f'parsed {len(files)} YAML files')
          PY

  docker-build:
    runs-on: ubuntu-latest
    needs: [go-quality, static-release-gates]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build all project images
        run: docker buildx bake --set '*.output=type=cacheonly'