name: Portfolio Phase 3 Integration Gate

on:
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: portfolio-phase3-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: false

jobs:
  backend-full:
    name: Backend – 659 tests (single run)
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    env:
      PYTHONPATH: src
      JARVIS_FINANCE_ENV: test
      JARVIS_FINANCE_DB_PATH: /tmp/financemanager-phase3-backend/finance.sqlite3
      JARVIS_FINANCE_RUNTIME_DIR: /tmp/financemanager-phase3-backend/runtime
      JARVIS_FINANCE_WRITE_MODE: disabled
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: requirements-ci.txt
      - name: Install pinned CI dependencies
        run: python -m pip install -e . -r requirements-ci.txt
      - name: Run all backend tests in one invocation
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p /tmp/financemanager-phase3-backend/runtime
          python -m pytest tests -q | tee /tmp/financemanager-phase3-backend/pytest.log
          grep -Eq '(^|[^0-9])659 passed' /tmp/financemanager-phase3-backend/pytest.log

  frontend:
    name: Frontend – tests, typecheck, production build
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - name: Install locked frontend dependencies
        working-directory: frontend
        run: npm ci
      - name: Run complete frontend suite
        working-directory: frontend
        run: npm test
      - name: TypeScript typecheck
        working-directory: frontend
        run: npm run typecheck
      - name: Production build
        working-directory: frontend
        run: npm run build

  controls:
    name: Migration, contracts, quality and repository safety
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    env:
      PYTHONPATH: src
      JARVIS_FINANCE_ENV: test
      JARVIS_FINANCE_DB_PATH: /tmp/financemanager-phase3-controls/finance.sqlite3
      JARVIS_FINANCE_RUNTIME_DIR: /tmp/financemanager-phase3-controls/runtime
      JARVIS_FINANCE_CI_ROOT: /tmp/financemanager-phase3-migration
      JARVIS_FINANCE_WRITE_MODE: disabled
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: requirements-ci.txt
      - name: Install pinned CI dependencies
        run: python -m pip install -e . -r requirements-ci.txt
      - name: Git diff check
        run: git diff --check "origin/${GITHUB_BASE_REF:-main}...HEAD"
      - name: Repository safety and secret scan
        run: python -m jarvis_finance.cli.main git-safety-scan .
      - name: Ruff – Phase 3 and integration surfaces
        run: |
          python -m ruff check \
            scripts/ci_portfolio_phase3_gate.py \
            src/jarvis_finance/api/main.py \
            src/jarvis_finance/api/routers/overview.py \
            src/jarvis_finance/api/schemas/portfolio_data.py \
            src/jarvis_finance/api/schemas/portfolio_performance.py \
            src/jarvis_finance/api/schemas/portfolio_policy.py \
            src/jarvis_finance/api/schemas/reconciliation.py \
            src/jarvis_finance/api/security.py \
            src/jarvis_finance/config/settings.py \
            src/jarvis_finance/ledger/cost_basis.py \
            src/jarvis_finance/ledger/performance.py \
            src/jarvis_finance/quality/freshness.py \
            src/jarvis_finance/quality/git_safety.py \
            src/jarvis_finance/services/portfolio_data.py \
            src/jarvis_finance/services/portfolio_performance.py \
            src/jarvis_finance/services/portfolio_policy.py \
            src/jarvis_finance/services/reconciliation_snapshot.py \
            src/jarvis_finance/services/transfer_pairing.py \
            src/jarvis_finance/storage/migrations.py \
            tests/conftest.py \
            tests/unit/test_api_write_security.py \
            tests/unit/test_git_safety.py \
            tests/unit/test_portfolio_data_ingestion_reconciliation.py \
            tests/unit/test_portfolio_performance_foundation.py \
            tests/unit/test_portfolio_policy_foundation.py \
            tests/unit/test_reconciliation_snapshot_foundation.py \
            tests/unit/test_settings.py \
            tests/unit/test_transfer_pairing_v2.py
      - name: Python compileall
        run: python -m compileall -q src tests scripts/ci_portfolio_phase3_gate.py
      - name: Empty and Sprint-5-to-41 migration gates
        run: python scripts/ci_portfolio_phase3_gate.py
      - name: OpenAPI, auth, write, idempotency, reconciliation and performance controls
        run: |
          mkdir -p /tmp/financemanager-phase3-controls/runtime
          python -m pytest -q \
            tests/unit/test_api_write_security.py \
            tests/unit/test_settings.py \
            tests/unit/test_portfolio_data_ingestion_reconciliation.py \
            tests/unit/test_portfolio_performance_foundation.py \
            tests/unit/test_portfolio_policy_foundation.py \
            tests/unit/test_reconciliation_snapshot_foundation.py \
            tests/unit/test_transfer_pairing_v2.py
