entry-push-latest.yml

name: "📤 Push"

concurrency:
  group: global-ci-${{ github.repository }}-${{ github.ref_name }}
  cancel-in-progress: ${{ github.ref_name != 'main' || (github.ref_name == 'main' && startsWith(github.event.head_commit.message, 'Release version ')) }}

on:
  push:
    branches:
      - main
      - "feature/**"
      - "hotfix/**"
      - "fix/**"
      - "update/**"
      - "chore/**"
      - "alert-autofix-*"

permissions:
  contents: read

jobs:
  run-policy:
    name: 🧭 Decide CI policy
    runs-on: ubuntu-26.04
    permissions:
      contents: read
      pull-requests: read
    outputs:
      should_run: ${{ steps.decide.outputs.should_run }}
      skip_reason: ${{ steps.decide.outputs.skip_reason }}
      commit_in_main: ${{ steps.decide.outputs.commit_in_main }}
    steps:
      - name: ⬇️ Checkout repository
        uses: actions/checkout@v7.0.0
        with:
          fetch-depth: 0

      - name: ⬇️ Fetch main
        if: github.event.created == true
        shell: bash
        env:
          CI_SYNC_MAIN_SOURCE_REPOSITORY_DEFAULT: infinito-nexus/core
          CI_SYNC_MAIN_SOURCE_REPOSITORY: ${{ vars.CI_SYNC_MAIN_SOURCE_REPOSITORY }}
          CI_SYNC_MAIN_SOURCE_REPOSITORY_IS_SET: ${{ contains(toJSON(vars), '"CI_SYNC_MAIN_SOURCE_REPOSITORY"') }}
        run: |
          set -euo pipefail
          git fetch "$(./scripts/meta/resolve/baseline_remote.sh)" main:refs/remotes/origin/main --force

      - name: 🤔 Decide whether CI should run for this push
        id: decide
        env:
          GITHUB_EVENT_CREATED: ${{ github.event.created }}
          CI_RUN_ON_MAIN: ${{ vars.CI_RUN_ON_MAIN }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: bash scripts/meta/resolve/push_ci_policy.sh

  skip-ci:
    name: ⏭️ Skip CI
    needs: run-policy
    if: needs.run-policy.outputs.should_run != 'true'
    runs-on: ubuntu-26.04
    steps:
      - name: ⏭️ Explain skip
        shell: bash
        run: |
          set -euo pipefail
          echo "Skipping CI for commit ${GITHUB_SHA}."
          echo "Reason: ${{ needs.run-policy.outputs.skip_reason }}"

  detect-release:
    if: needs.run-policy.outputs.should_run == 'true'
    needs: run-policy
    name: 🏷️ Detect release tag
    runs-on: ubuntu-26.04
    outputs:
      is_version: ${{ steps.pick.outputs.is_version }}
      version_tag: ${{ steps.pick.outputs.version_tag }}
    steps:
      - name: ⬇️ Checkout (with tags)
        uses: actions/checkout@v7.0.0
        with:
          fetch-depth: 0
          fetch-tags: true

      - id: pick
        shell: bash
        run: bash scripts/github/resolve/release/tag.sh

  resolve-priority:
    if: needs.run-policy.outputs.should_run == 'true'
    name: ⭐ Resolve new-role priority
    needs: run-policy
    runs-on: ubuntu-26.04
    outputs:
      priority: ${{ steps.resolve.outputs.priority }}
    steps:
      - name: ⬇️ Checkout (full history)
        uses: actions/checkout@v7.0.0
        with:
          fetch-depth: 0

      - id: resolve
        shell: bash
        run: |
          set -euo pipefail
          echo "priority=$(bash scripts/meta/resolve/diff/new_roles.sh)" >> "$GITHUB_OUTPUT"

  ci-orchestrator:
    if: needs.run-policy.outputs.should_run == 'true'
    name: 🎶 Orchestrate CI
    needs:
      - run-policy
      - detect-release
      - resolve-priority
    permissions:
      actions: read
      contents: read
      packages: write
      security-events: write
      issues: write
    uses: ./.github/workflows/call-orchestrator.yml
    with:
      priority: ${{ needs.resolve-priority.outputs.priority }}
      chunk_gate: ${{ !(github.ref_name == 'main' && needs.detect-release.outputs.is_version == 'true') }}
    secrets: inherit

  release-guard:
    name: "🛡️ Guard release"
    if: needs.run-policy.outputs.should_run == 'true' && needs.detect-release.outputs.is_version == 'true'
    needs:
      - run-policy
      - detect-release
      - ci-orchestrator
    runs-on: ubuntu-26.04
    outputs:
      allowed: ${{ steps.guard.outputs.allowed }}
    steps:
      - name: ⬇️ Checkout (with full history)
        uses: actions/checkout@v7.0.0
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: ⬇️ Fetch main
        shell: bash
        run: |
          set -euo pipefail
          git fetch origin main:refs/remotes/origin/main --force

      - name: "🛡️ Guard: tag commit must be contained in origin/main"
        id: guard
        shell: bash
        env:
          VERSION_TAG: ${{ needs.detect-release.outputs.version_tag }}
        run: bash scripts/github/release/guard.sh

  release-version:
    name: 🚀 Release version
    needs:
      - run-policy
      - detect-release
      - release-guard
    if: needs.run-policy.outputs.should_run == 'true' && needs.release-guard.outputs.allowed == 'true'
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/call-release-version.yml
    with:
      tag: ${{ needs.detect-release.outputs.version_tag }}
    secrets: inherit