name: Coding Plan credential contract
on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
    paths:
      - 'src/main/zcode/**'
      - 'src/shared/node-bounded-file-reader*'
      - 'src/main/rate-limits/**'
      - 'src/shared/secure-file*'
      - 'src/shared/secure-path-windows-acl*'
      - 'src/shared/windows-security-descriptor*'
      - '.github/workflows/zcode-account-contract.yml'
      - '.github/workflows/zcode-credential-contract.yml'
      - 'config/scripts/zcode-credential-workflow.test.mjs'
  workflow_dispatch:
  workflow_call:
    inputs:
      contract:
        description: Keep the account workflow's manual entry point on its original test group.
        type: string
        default: credentials
permissions:
  contents: read
concurrency:
  group: coding-plan-contract-${{ github.event.pull_request.number || github.ref }}-${{ inputs.contract || 'credentials' }}
  cancel-in-progress: true
jobs:
  credential-files:
    if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
    name: ZCode credentials (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04, macos-15, windows-2022]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    env:
      ORCA_BACKGROUND_LAUNCH: '1'
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 2
          persist-credentials: false
      - name: Select credential test groups
        id: scope
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          MANUAL_ACCOUNT: ${{ inputs.contract == 'account' }}
          MANUAL_CREDENTIALS: ${{ inputs.contract != 'account' }}
        run: |
          if [ "$EVENT_NAME" != pull_request ]; then
            echo "account=$MANUAL_ACCOUNT" >> "$GITHUB_OUTPUT"
            echo "credentials=$MANUAL_CREDENTIALS" >> "$GITHUB_OUTPUT"
          else
            account=true
            credentials=true
            diff_status=2
            if git rev-parse --verify HEAD^1 >/dev/null 2>&1; then
              diff_status=0
              git diff --quiet --no-renames HEAD^1 HEAD || diff_status=$?
            fi
            if [ "$diff_status" = 1 ]; then
              if git diff --quiet --no-renames HEAD^1 HEAD -- \
                src/main/zcode/ ':(glob)src/shared/node-bounded-file-reader*' src/main/rate-limits/ \
                .github/workflows/zcode-account-contract.yml \
                .github/workflows/zcode-credential-contract.yml \
                config/scripts/zcode-credential-workflow.test.mjs; then
                account=false
              fi
              if git diff --quiet --no-renames HEAD^1 HEAD -- \
                src/main/zcode/ ':(glob)src/shared/secure-file*' ':(glob)src/shared/secure-path-windows-acl*' \
                ':(glob)src/shared/windows-security-descriptor*' \
                .github/workflows/zcode-credential-contract.yml \
                config/scripts/zcode-credential-workflow.test.mjs; then
                credentials=false
              fi
            fi
            echo "account=$account" >> "$GITHUB_OUTPUT"
            echo "credentials=$credentials" >> "$GITHUB_OUTPUT"
          fi
      - uses: ./.github/actions/install-node-dependencies
        id: dependencies
        with:
          native-runtime: node
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        id: bun
        with:
          bun-version-file: config/.bun-version
          no-cache: true
      - name: Verify read-only credentials and account changes
        if: ${{ !cancelled() && steps.scope.outputs.account == 'true' && steps.dependencies.outcome == 'success' && steps.bun.outcome == 'success' }}
        run: pnpm test src/main/zcode/zcode-v2-plan-credentials.test.ts src/main/zcode/zcode-v2-personal-overlay-raw-json.test.ts src/main/rate-limits/service-zcode-usage.test.ts src/shared/node-bounded-file-reader-sync.test.ts
      - name: Verify rollback and native Windows permissions
        if: ${{ !cancelled() && steps.scope.outputs.credentials == 'true' && steps.dependencies.outcome == 'success' && steps.bun.outcome == 'success' }}
        run: pnpm test src/main/zcode/zcode-plan-api-key-store.test.ts src/main/zcode/zcode-plan-api-key-store-plaintext-rollback.test.ts src/main/zcode/zcode-plan-api-key-store-publication-race.test.ts src/main/zcode/zcode-plan-api-key-store-native-windows.test.ts src/shared/secure-file.test.ts