name: shared gate tests

# The gates in this repo are enforced in ~40 other repos, so a bug here is a
# bug everywhere at once. Until now `md_naming` had a test suite that no
# workflow ran; `dep_freshness` ships with one from day one.
#
# The dependency-freshness suite never touches the network -- every registry
# answer is a fixture, because the gate's worst failure mode (accepting a
# pre-release as "latest stable") fails GREEN and only a fixture can pin it.

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

jobs:
  shared-gate-tests:
    name: gate unit tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.x"

      - name: Install test dependencies
        run: python -m pip install --upgrade pytest pytest-cov pyyaml packaging

      - name: dep_freshness — 100% branch coverage on the gate itself
        run: |
          PYTHONPATH=. python -m pytest dep_freshness/tests -q \
            --cov=dep_freshness --cov-branch \
            --cov-report=term-missing \
            --cov-fail-under=99

      - name: md_naming
        run: PYTHONPATH=. python -m pytest md_naming/tests -q

      # Whole package at 100% branch: the gate is enforced in every repo and
      # now reads a per-repo `.file-length-exempt`, whose fail-closed rule is
      # exactly the kind of branch a partial suite would leave green by accident.
      - name: file_length — 100% branch coverage on the gate itself
        run: |
          PYTHONPATH=. python -m pytest file_length/tests -q \
            --cov=file_length --cov-branch \
            --cov-report=term-missing \
            --cov-fail-under=100

      - name: repo_contract — 100% branch coverage on the gate itself
        run: |
          PYTHONPATH=. python -m pytest repo_contract/tests -q \
            --cov=repo_contract --cov-branch \
            --cov-report=term-missing \
            --cov-fail-under=100

      # Every web repo's pre-commit and CI run this checker against its dist/,
      # so a false green here ships an un-agent-ready site fleet-wide.
      - name: agent_ready — 100% branch coverage on the checker
        run: |
          PYTHONPATH=. python -m pytest agent_ready/tests -q \
            --cov=agent_ready --cov-branch \
            --cov-report=term-missing \
            --cov-fail-under=100

      - name: coverage_gaps — 100% branch coverage on the lister
        run: |
          PYTHONPATH=. python -m pytest coverage_gaps/tests -q \
            --cov=coverage_gaps --cov-branch \
            --cov-report=term-missing \
            --cov-fail-under=100

      # gate_stamp.sh is the pre-push gate in every repo. Its tests drive real
      # pre-commit in throwaway repos, and the hook-id helper runs under
      # /usr/bin/python3 (the deployment interpreter), hence apt's PyYAML.
      - name: gate_stamp (step / full --list)
        run: |
          sudo apt-get update -q && sudo apt-get install -y python3-yaml
          python -m pip install --upgrade pre-commit
          PYTHONPATH=. python -m pytest scripts/tests -q