ci-verify.yml

name: "CI Verify"
run-name: >-
  ${{
    github.event_name == 'pull_request' && format('CI Verify — PR #{0}: {1}', github.event.pull_request.number, github.event.pull_request.title) ||
    github.event_name == 'push' && format('CI Verify — {0}', github.event.head_commit.message) ||
    github.event_name == 'merge_group' && format('CI Verify — Merge Queue: {0}', github.ref_name) ||
    github.event_name == 'workflow_call' && format('CI Verify — workflow_call ({0})', github.sha) ||
    format('CI Verify — {0}', github.ref_name)
  }}

on:
  # Release candidates use this trigger to run the complete matrix against the
  # frozen branch before the final NAS acceptance starts.
  workflow_dispatch:
  push:
    # Only `main` — release/** branches reach main via a PR (covered by
    # `pull_request` below) and post-merge `push: main` drives release-cut
    # polling. Triggering on `push: release/**` produced a duplicate run that
    # the concurrency group cancelled, and the cancelled run blocked the PR's
    # required-status rollup. See DEPRECATIONS/CI notes.
    branches:
      - main
  pull_request:
    # `dev/**` too: v1.6 work landed on dev/v1.6 via PRs that ran no backend or
    # frontend CI at all, because this only ever fired for PRs targeting main.
    # The integration branch is where features are supposed to land, so it needs
    # the same gate main gets — otherwise dev is only as good as whatever the
    # author happened to run locally.
    branches: [main, 'dev/**']
  schedule:
    # Both schedules now run the full security sweep: CodeQL, Fuzz, DAST
    # (ZAP baseline + Nuclei), plus the lint/test/build chain DAST depends on.
    # Twice-weekly cadence catches drift in external CodeQL queries, Nuclei
    # templates, and ZAP signatures between merges to main.
    - cron: '30 6 * * 1'  # Monday 06:30 UTC
    - cron: '0 6 * * 0'   # Sunday 06:00 UTC
  merge_group:
    branches: [main]
  workflow_call:
    secrets:
      CODECOV_TOKEN:
        required: false

concurrency:
  # Key on the source branch name (`head_ref` on PRs, `ref_name` on
  # main/release pushes and merge_group) so rapid successive pushes to
  # the same branch cancel the in-flight run.
  group: ci-verify-${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

permissions: {}

env:
  # npm's default fetch-timeout is 300000ms, the same as the retry wrapper's
  # timeout_minutes, so a stalled registry fetch always burned the whole
  # attempt before either side gave up (runner image 20260831 / npm 11.19.0,
  # 2026-09-03). Fail the fetch at 60s and let npm retry it itself.
  NPM_CONFIG_FETCH_TIMEOUT: "60000"
  NPM_CONFIG_FETCH_RETRIES: "5"
  # Every host-side npm ci on that image still stalled exactly once per install
  # (61s flat with the timeout above) while the Dockerfile's
  # `npm ci --no-audit --no-fund` never did. Skip the audit and fund lookups
  # here too; they add nothing in CI.
  NPM_CONFIG_AUDIT: "false"
  NPM_CONFIG_FUND: "false"

jobs:
  security-actions:
    name: "Security: Actions"
    # go-ci.yml's nested codeql job declares security-events: write even
    # though run-codeql stays unset here — GitHub validates a called
    # workflow's job-level permissions statically, regardless of if:
    # gating, so the caller must still grant it.
    permissions:
      actions: read
      contents: read
      security-events: write
    # The org's .github repo has no tags; pinned to a commit on its main
    # branch as of 2026-08-16, verified by
    # .github/tests/reusable-ci-config.test.ts. Re-check the org's .github
    # commit history periodically and bump this pin if the reusable
    # workflow's inputs change.
    uses: CodesWhat/.github/.github/workflows/go-ci.yml@47820bd85d49eb6cd0a935c31789c7d7ce037401  # main, 2026-08-16
    with:
      run-workflow-security: true
      workflow-security-egress-policy: block
      workflow-security-allowed-endpoints: "ghcr.io:443 github.com:443 pkg-containers.githubusercontent.com:443"
      run-test: false
      run-lint: false

  secrets:
    name: "Security: Secrets"
    needs: [security-actions]
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            objects.githubusercontent.com:443
            release-assets.githubusercontent.com:443
            *.actions.githubusercontent.com:443
          disable-sudo: true

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Restore scanner policy from a protected ref
        # A PR must not be able to alter the gate that scans it: restore the
        # scanner script and ignore policy from protected, merged content.
        # An exact dev-tree promotion on the same or newer release base can
        # use that protected dev commit's policy. Ordinary PRs keep the base
        # policy, including older lines or unreviewed changes. Capture the
        # selected commit before checkout.
        #
        # pull_request only. push/schedule/workflow_dispatch/workflow_call all
        # run already-trusted content, where head and base are the same trust
        # domain. `merge_group` is deliberately NOT covered: no ruleset enables
        # a merge queue today, so those events never fire, and `github.base_ref`
        # is empty there anyway. If a merge queue is ever turned on, extend this
        # to merge_group via `github.event.merge_group.base_ref` — until then a
        # queue would evaluate the PR's own unmerged scanner policy.
        if: github.event_name == 'pull_request'
        env:
          BASE_REF: ${{ github.base_ref }}
        run: |
          set -euo pipefail
          git fetch --no-tags origin "refs/heads/${BASE_REF}"
          policy_commit="$(git rev-parse FETCH_HEAD)"
          policy_ref="${BASE_REF}"

          if [ "${BASE_REF}" = "main" ]; then
            if version="$(git show HEAD:package.json | jq -er '.version | select(type == "string")')" \
              && [[ "${version}" =~ ^([0-9]+)\.([0-9]+)\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
              dev_ref="dev/v${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
              if git fetch --no-tags origin "refs/heads/${dev_ref}"; then
                dev_commit="$(git rev-parse FETCH_HEAD)"
                if [ "$(git rev-parse 'HEAD^{tree}')" = "$(git rev-parse "${dev_commit}^{tree}")" ]; then
                  if base_version="$(git show "${policy_commit}:package.json" | jq -er '.version | select(type == "string")')" \
                    && jq -en --arg candidate "${version}" --arg base "${base_version}" '
                      # Compare integer components by decimal length and digits.
                      def parts:
                        split("-")[0] | split("+")[0] | split(".")
                        | if length == 3 and all(.[]; test("^[0-9]+$"))
                          then map(sub("^0+"; "") | [length, .])
                          else error("Invalid release base version")
                          end;
                      ($candidate | parts) >= ($base | parts)
                    ' >/dev/null; then
                    policy_commit="${dev_commit}"
                    policy_ref="${dev_ref}"
                  fi
                fi
              fi
            fi
          fi

          echo "Restoring secret scanner policy from ${policy_ref} (${policy_commit})"
          git checkout "${policy_commit}" -- scripts/scan-secrets.sh .gitleaks.toml .gitleaksignore

      - name: Install Gitleaks
        env:
          GITLEAKS_VERSION: '8.30.1'
          GITLEAKS_LINUX_X64_SHA256: '551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb'
        run: |
          set -euo pipefail

          archive="${RUNNER_TEMP}/gitleaks.tar.gz"
          install_dir="${RUNNER_TEMP}/gitleaks-bin"
          mkdir -p "${install_dir}"
          curl --proto '=https' --tlsv1.2 --retry 3 --fail --silent --show-error --location \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
            --output "${archive}"
          printf '%s  %s\n' "${GITLEAKS_LINUX_X64_SHA256}" "${archive}" | sha256sum --check --strict
          tar -xzf "${archive}" -C "${install_dir}" gitleaks
          "${install_dir}/gitleaks" version
          printf '%s\n' "${install_dir}" >> "${GITHUB_PATH}"

      - name: Scan secrets
        # On pull_request the git-history scan covers base..HEAD only. The
        # checkout above has fetch-depth 0, so with --log-opts=--all every
        # branch ever pushed to the repo was scanned under the base branch's
        # ignore file: an unannotated fixture on any other branch failed
        # Secrets on every open PR, and a branch could never fix its own
        # finding. push, schedule, workflow_dispatch and workflow_call keep
        # scanning full history; head and base are the same trust domain
        # there. Policy files still come from the base ref (step above).
        env:
          BASE_REF: ${{ github.base_ref }}
          SCAN_SECRETS_LOG_OPTS: >-
            ${{ github.event_name == 'pull_request' && format('origin/{0}..HEAD', github.base_ref) || '--all' }}
        run: |
          set -euo pipefail
          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
            # Make sure origin/<base> resolves with full history even if the
            # checkout's remote refs were trimmed.
            git fetch --no-tags origin "refs/heads/${BASE_REF}:refs/remotes/origin/${BASE_REF}"
          fi
          scripts/scan-secrets.sh

  changes:
    name: "Changes: Path Filter"
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: read
      pull-requests: read
    outputs:
      runtime: ${{ steps.filter.outputs.runtime }}
      web: ${{ steps.filter.outputs.web }}

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            api.github.com:443
            *.actions.githubusercontent.com:443
          disable-sudo: true

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Filter paths
        id: filter
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d  # v4.0.3
        with:
          # On push events, diff against the ref's previous SHA so we get
          # per-push changes. dorny/paths-filter's default on non-default
          # branches is to diff against the repository's default branch,
          # which on a long-lived release branch means every commit sees
          # the entire branch diff and runtime is always true. Pull
          # request events leave base unset so the action falls back to
          # the PR target diff (the correct behavior there).
          base: ${{ github.event_name == 'push' && github.event.before || github.event_name == 'workflow_dispatch' && 'main' || '' }}
          # runtime=true when the changeset touches anything that can affect
          # runtime behavior. Keep this shared with e2e-playwright.yml so both
          # heavy E2E gates short-circuit symmetrically on pure docs/changelog
          # edits.
          filters: .github/filters/runtime.yml

  codeql:
    name: "SAST: CodeQL"
    if: github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request' || github.event_name == 'schedule' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
    needs: [security-actions]
    runs-on: ubuntu-24.04
    timeout-minutes: 60  # CodeQL init/autobuild/analyze can be long on cache misses
    permissions:
      security-events: write
      contents: read
      actions: read
    strategy:
      fail-fast: false
      matrix:
        language: [javascript-typescript]

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
        with:
          languages: ${{ matrix.language }}
          config-file: ./.github/codeql/codeql-config.yml

      - name: Autobuild
        uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
        with:
          category: /language:${{ matrix.language }}

  fuzz:
    name: "Fuzz Testing"
    if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
    needs: [security-actions]
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    permissions:
      contents: read
      issues: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            registry.npmjs.org:443
            nodejs.org:443
            api.github.com:443
            *.actions.githubusercontent.com:443
          disable-sudo: true

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38  # v6.5.0
        with:
          node-version: 24
          package-manager-cache: true
          cache-dependency-path: app/package-lock.json

      - name: Install dependencies
        run: npm ci
        working-directory: app

      - name: Run fuzz tests
        id: fuzz-run
        continue-on-error: true
        run: |
          set -euo pipefail
          mkdir -p ../artifacts/fuzz
          npx vitest run --reporter=verbose '.fuzz.test.ts' 2>&1 | tee ../artifacts/fuzz/fuzz-test.log
        working-directory: app

      - name: Summarize fuzz result
        id: fuzz-status
        if: always()
        env:
          FUZZ_OUTCOME: ${{ steps.fuzz-run.outcome }}
        run: |
          set -euo pipefail

          if [ "${FUZZ_OUTCOME}" = "success" ]; then
            echo "failed=false" >> "$GITHUB_OUTPUT"
            {
              echo "### Fuzz Testing"
              echo "- Result: PASS"
              echo "- Log artifact: \`fuzz-log-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}\`"
            } >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          echo "failed=true" >> "$GITHUB_OUTPUT"
          {
            echo "### Fuzz Testing"
            echo "- Result: FAIL"
            echo "- AI_ACTION_REQUIRED: inspect fuzz log artifact and failing seed/case before merge."
            echo "- Log artifact: \`fuzz-log-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}\`"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload fuzz log artifact
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: fuzz-log-${{ github.run_id }}-${{ github.run_attempt }}
          path: artifacts/fuzz/fuzz-test.log
          if-no-files-found: warn
          retention-days: 14

      - name: Notify via issue on unattended failure
        if: steps.fuzz-status.outputs.failed == 'true' && github.event_name == 'schedule'
        env:
          GH_TOKEN: ${{ github.token }}
          ISSUE_TITLE: "CI: Fuzz tests failing on main"
          # The title this step used before the emoji rename. This step both
          # writes a title and matches on it, so dropping the old value would
          # orphan an issue an earlier run filed and start posting duplicates
          # beside it. Matching both, and retitling what it finds, closes that
          # window instead of relying on none existing at merge time.
          LEGACY_ISSUE_TITLE: "🚨 CI: Fuzz tests failing on main"
          RUN_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          set -euo pipefail

          api_headers=(
            -H "Authorization: Bearer ${GH_TOKEN}"
            -H "Accept: application/vnd.github+json"
          )

          issues_url="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/issues?state=open&per_page=100"
          open_issues="$(curl -fsSL "${api_headers[@]}" "${issues_url}")"

          # Two single-purpose lookups rather than one filter held in a shell
          # variable: a jq filter in a variable puts `$title` inside single
          # quotes, which is SC2016 and makes a reader stop to check whether
          # the non-expansion is deliberate.
          existing_number="$(echo "${open_issues}" | jq -r --arg title "${ISSUE_TITLE}" '.[] | select(.title == $title and (.pull_request | not)) | .number' | head -n1)"
          legacy_number="$(echo "${open_issues}" | jq -r --arg legacy "${LEGACY_ISSUE_TITLE}" '.[] | select(.title == $legacy and (.pull_request | not)) | .number' | head -n1)"

          comment_body=$(
            cat <<EOF
          Fuzz job failed again.

          - Workflow run: ${RUN_URL}
          - Commit: \`${GITHUB_SHA}\`
          - Ref: \`${GITHUB_REF}\`
          - Log artifact: \`fuzz-log-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}\`
          EOF
          )

          # Retitle a legacy-named issue in place, so the next run matches on
          # the new title and this branch stops firing. Done before the comment
          # so a failure here surfaces rather than being masked by a successful
          # comment on a still-legacy title. If BOTH titles are somehow open,
          # the new-named one is canonical and the legacy one is left alone
          # rather than merged, since this step can't know which has the
          # history worth keeping.
          if [ -z "${existing_number}" ] && [ -n "${legacy_number}" ]; then
            issue_url="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/issues/${legacy_number}"
            curl -fsSL -X PATCH "${api_headers[@]}" "${issue_url}" \
              -d "$(jq -n --arg title "${ISSUE_TITLE}" '{title: $title}')" >/dev/null
            existing_number="${legacy_number}"
          fi

          if [ -n "${existing_number}" ]; then
            comment_url="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/issues/${existing_number}/comments"
            curl -fsSL -X POST "${api_headers[@]}" "${comment_url}" \
              -d "$(jq -n --arg body "${comment_body}" '{body: $body}')" >/dev/null
            exit 0
          fi

          issue_body=$(
            cat <<EOF
          Fuzz tests are failing on unattended runs.

          - Latest failing run: ${RUN_URL}
          - Commit: \`${GITHUB_SHA}\`
          - Ref: \`${GITHUB_REF}\`
          - Log artifact: \`fuzz-log-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}\`

          Keep this issue open until fuzz is green again.
          EOF
          )

          create_url="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/issues"
          curl -fsSL -X POST "${api_headers[@]}" "${create_url}" \
            -d "$(jq -n --arg title "${ISSUE_TITLE}" --arg body "${issue_body}" '{title: $title, body: $body}')" >/dev/null

      - name: Fail workflow on fuzz failure
        if: steps.fuzz-status.outputs.failed == 'true'
        run: exit 1

  dependency-review:
    name: "Security: Dependency Review"
    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: read

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
        with:
          egress-policy: block
          # api.deps.dev: dependency-review-action fetches changed-package
          # metadata there, but only on PRs that actually change dependencies,
          # so the gap stays invisible on dependency-neutral PRs.
          allowed-endpoints: >
            github.com:443
            api.github.com:443
            api.deps.dev:443
            *.actions.githubusercontent.com:443
          disable-sudo: true

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
        with:
          persist-credentials: false

      - name: Dependency review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294  # v5.0.0
        with:
          base-ref: ${{ github.event_name == 'push' && github.event.before || '' }}
          head-ref: ${{ github.event_name == 'push' && github.sha || '' }}

  lint:
    name: "Quality: Lint"
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
        with:
          persist-credentials: false

      - name: Setup Node
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38  # v6.5.0
        with:
          node-version: 24
          package-manager-cache: true
          cache-dependency-path: |
            package-lock.json
            app/package-lock.json
            ui/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Block new @ts-nocheck usage
        run: node scripts/check-ts-nocheck-allowlist.mjs

      - name: Biome check
        run: npx biome check .

      - name: Install app dependencies
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
        with:
          timeout_minutes: 3
          max_attempts: 3
          retry_wait_seconds: 30
          command: cd app && npm ci

      - name: Install ui dependencies
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
        with:
          timeout_minutes: 3
          max_attempts: 3
          retry_wait_seconds: 30
          command: cd ui && npm ci

      - name: Knip (app)
        run: npm run knip
        working-directory: app

      - name: Knip (ui)
        run: npm run knip
        working-directory: ui

      - name: Setup Qlty
        uses: qltysh/qlty-action/install@08a0a862c159eae9b9003081da6663d96efef637  # v2.3.0

      - name: Qlty check (all plugins, enforced)
        run: ./scripts/qlty-check-gate.sh all

      - name: Qlty smells report (advisory)
        run: |
          mkdir -p artifacts/qlty
          node scripts/qlty-smells-gate.mjs \
            --scope=all \
            --sarif-output=artifacts/qlty/qlty-smells-all.sarif \
            --summary-output=artifacts/qlty/qlty-smells-summary.md

      - name: Upload Qlty smells report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: qlty-smells-${{ github.run_id }}-${{ github.run_attempt }}
          path: artifacts/qlty
          if-no-files-found: warn
          retention-days: 14

  test:
    name: "Quality: Test & Coverage"
    runs-on: ubuntu-24.04
    # The app and UI coverage shards plus the Codecov upload reached 19 to 20
    # minutes on dev/v1.8 and the job was cancelled mid-upload twice (#1324).
    timeout-minutes: 30
    permissions:
      contents: read

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            registry.npmjs.org:443
            nodejs.org:443
            cli.codecov.io:443
            api.codecov.io:443
            ingest.codecov.io:443
            storage.googleapis.com:443
            *.actions.githubusercontent.com:443
          disable-sudo: true

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38  # v6.5.0
        with:
          node-version: 24
          package-manager-cache: true
          cache-dependency-path: |
            package-lock.json
            app/package-lock.json
            apps/demo/package-lock.json
            ui/package-lock.json

      - name: Install repository dependencies
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
        with:
          timeout_minutes: 3
          max_attempts: 3
          retry_wait_seconds: 30
          command: npm ci --ignore-scripts

      - name: Run scripts tests
        run: node --test scripts/*.test.mjs

      - name: Install app dependencies
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
        with:
          timeout_minutes: 3
          max_attempts: 3
          retry_wait_seconds: 30
          command: cd app && npm ci

      - name: Run workflow tests
        run: npm run test:workflows

      - name: Install demo dependencies
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
        with:
          timeout_minutes: 3
          max_attempts: 3
          retry_wait_seconds: 30
          command: cd apps/demo && npm ci --ignore-scripts

      - name: Run demo contract and security tests
        run: npm test
        working-directory: apps/demo

      - name: Install ui dependencies
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
        with:
          timeout_minutes: 3
          max_attempts: 3
          retry_wait_seconds: 30
          command: cd ui && npm ci

      - name: Run app tests
        run: npm test
        working-directory: app

      - name: Typecheck ui
        run: npm run typecheck
        working-directory: ui

      - name: Run ui tests
        # CI-17: three runs on 2026-09-07 (plus #1102) had this step marked
        # `cancelled` after 2.5-6 min with no timeout hit and no concurrency
        # group -- the 7 GB ubuntu-latest runner most likely ran the vitest
        # coverage pass out of memory and the runner service died, which
        # GitHub reports as a cancel rather than an OOM. Budget: 1536 MiB
        # heap cap * 2 processes (the main vitest process plus the single
        # worker fork --maxWorkers=1 allows) = 3 GiB worst case, comfortably
        # under the 7 GiB runner with headroom left for non-heap V8
        # overhead, npm, and the OS.
        env:
          NODE_OPTIONS: --max-old-space-size=1536
        run: |
          # Emit bounded numeric resource evidence before an abrupt runner exit.
          # No environment, command arguments or application data is collected.
          node ../scripts/ci-resource-sampler.mjs "$$" &
          resource_sampler_pid=$!
          trap 'kill "$resource_sampler_pid" 2>/dev/null || true; wait "$resource_sampler_pid" 2>/dev/null || true' EXIT
          npm run test:unit -- --maxWorkers=1
        working-directory: ui

      - name: Normalize coverage paths
        # Rewrites lcov SF: paths to be repo-root-relative (app/…, ui/…) so
        # Codecov resolves them against the checkout.
        run: node scripts/prepare-codecov-reports.mjs

      - name: Upload app coverage to Codecov
        # Coverage upload moved from Qlty Cloud to Codecov (2026-08-16 house
        # decision — see codeswhat-ops/standards/quality.md). The Qlty Cloud
        # app, dashboard, and maintainability badge stay installed with
        # non-gating checks; only the coverage-cloud upload path moves.
        # Tokenless for public-repo PRs (including forks, which don't get
        # secrets anyway); secrets.CODECOV_TOKEN is optional and covers
        # private-context uploads. Advisory (continue-on-error plus
        # fail_ci_if_error: false): an upload hiccup never blocks CI — the
        # Vitest's configured coverage thresholds enforced in app/ui tests
        # above are the real gate.
        continue-on-error: true
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v6.0.2
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: coverage/codecov-app.lcov.info
          flags: app
          fail_ci_if_error: false

      - name: Upload ui coverage to Codecov
        continue-on-error: true
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v6.0.2
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: coverage/codecov-ui.lcov.info
          flags: ui
          fail_ci_if_error: false

  web:
    name: "Web: Site Build & Scripts Tests"
    # apps/web ships via Vercel (separate from the Docker image), and Vercel only
    # runs `next build` — never the node:test scripts suite. This job is that gate.
    # Path-filtered: skips (→ counts as pass) on changesets that don't touch the
    # site, so it never blocks backend-only PRs.
    needs: [changes]
    if: github.event_name == 'workflow_dispatch' || needs.changes.outputs.web == 'true' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
        with:
          egress-policy: block
          # fonts.googleapis.com + fonts.gstatic.com: next/font/google in
          # apps/web/src/app/layout.tsx downloads IBM Plex at build time, but
          # the web job only runs on web-path changes, so the gap stayed
          # invisible on every non-web PR after the block-mode flip.
          allowed-endpoints: >
            github.com:443
            registry.npmjs.org:443
            nodejs.org:443
            fonts.googleapis.com:443
            fonts.gstatic.com:443
            *.actions.githubusercontent.com:443
          disable-sudo: true

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38  # v6.5.0
        with:
          node-version: 24
          package-manager-cache: true
          cache-dependency-path: apps/web/package-lock.json

      - name: Install apps/web dependencies
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
        with:
          timeout_minutes: 3
          max_attempts: 3
          retry_wait_seconds: 30
          command: cd apps/web && npm ci

      - name: Run scripts tests
        run: npm run test:scripts
        working-directory: apps/web

      - name: Typecheck
        run: npx tsc --noEmit
        working-directory: apps/web

      - name: Build site (Next.js)
        run: npm run build
        working-directory: apps/web

  build:
    name: "Build"
    needs: [lint, test]
    runs-on: ubuntu-24.04
    timeout-minutes: 35  # Includes UI build + single-arch QA image + multi-arch smoke build
    permissions:
      contents: read

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38  # v6.5.0
        with:
          node-version: 24
          package-manager-cache: true
          cache-dependency-path: |
            ui/package-lock.json
            apps/demo/package-lock.json

      - name: Install ui dependencies
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
        with:
          timeout_minutes: 3
          max_attempts: 3
          retry_wait_seconds: 30
          command: cd ui && npm ci

      - name: Build ui
        run: npm run build
        working-directory: ui

      - name: Install demo dependencies
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
        with:
          timeout_minutes: 3
          max_attempts: 3
          retry_wait_seconds: 30
          command: cd apps/demo && npm ci --ignore-scripts

      - name: Build demo
        run: npm run build
        working-directory: apps/demo

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0

      # The multi-arch smoke build below cannot catch a base image pinned to a
      # per-platform manifest digest: buildx resolves a digest identically for
      # every --platform, so the arm64 stage builds green on an amd64 rootfs and
      # the resulting image is x86-64 under an arm64 label (#1021). Check the
      # pins on the PR that changes them.
      - name: Verify base image pins are multi-arch indexes
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
        with:
          timeout_minutes: 3
          max_attempts: 3
          command: scripts/check-dockerfile-base-indexes.sh Dockerfile linux/amd64,linux/arm64

      - name: Docker build (QA image + smoke test)
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
        with:
          context: .
          push: false
          load: true
          tags: drydock:dev
          build-args: DD_VERSION=ci
          # load: true uses the docker exporter, which can't accept the OCI
          # manifest list produced by provenance attestations. The release-cut
          # workflow keeps provenance because it actually pushes to registries.
          provenance: false
          cache-from: type=gha,scope=drydock
          cache-to: type=gha,mode=max,scope=drydock,ignore-error=true

      - name: Set up QEMU (multi-arch smoke build)
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0

      # moby/buildkit#7089 (open, fix unmerged in #7092): ExecOp mutates its own
      # Meta.Args in place to prepend the QEMU emulator path, so when the solver
      # cancels an in-flight arm64 op and a later caller re-executes it, the
      # emulator path gets prepended twice, QEMU tries to exec itself, and the
      # build dies 0.078s in with "Invalid ELF image for this architecture"
      # before apk or anything else has produced a line of output.
      #
      # It is a scheduler-timing race inside buildkit, not something this build
      # config controls, and it is frequent rather than rare: three failures in
      # six runs measured on 2026-08-29, roughly a coin flip. It is not tied to
      # one RUN either. It hit `apk add` in the healthcheck stage once and
      # `npm run build && npm prune` in a build stage the next time, which is
      # what you would expect from a race on whichever op the solver happens to
      # cancel and re-execute.
      #
      # Retrying the whole build is mechanism-agnostic, because each attempt is
      # a fresh Solve() that reparses the LLB graph from the Dockerfile, so a
      # mutated Meta.Args from a canceled attempt cannot carry over. Three
      # attempts, not two: at an observed ~50% rate, two attempts still fail a
      # quarter of the time, which is not a gate. The failure is also cheap to
      # absorb, dying 0.083s into the RUN.
      #
      # The real fix is to stop emulating these stages at all. The build stages
      # produce architecture-independent JavaScript, so they could run natively
      # with `FROM --platform=$BUILDPLATFORM`, leaving only the healthcheck
      # stage (which compiles C) genuinely per-target. That is a Dockerfile
      # change with its own release risk and does not belong days before a cut.
      # Tracked separately.
      #
      # Raw CLI rather than docker/build-push-action because nick-fields/retry
      # wraps a shell command, not a `uses:` step. Safe here specifically
      # because nothing downstream reads this step's outputs. Same idiom this
      # job already uses for npm ci and the Playwright pull. Drop it once
      # buildkit ships the fix.
      - name: Docker build (multi-arch smoke)
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 5
          # Smoke build never lands in a registry, so attesting it adds noise
          # without value. Real attestations live on release-cut.yml.
          command: |
            docker buildx build . \
              --platform linux/amd64,linux/arm64 \
              --build-arg DD_VERSION=ci-multiarch-smoke \
              --provenance=false \
              --cache-from type=gha,scope=drydock \
              --cache-to type=gha,mode=max,scope=drydock,ignore-error=true

      - name: Export QA image artifact
        run: |
          mkdir -p artifacts/qa
          docker save drydock:dev | gzip > artifacts/qa/drydock-dev-image.tar.gz

      - name: Upload QA image artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: qa-image-${{ github.run_id }}
          path: artifacts/qa/drydock-dev-image.tar.gz
          if-no-files-found: error
          retention-days: 1

  grype-image:
    name: "Security: Grype Image"
    # security-grype.yml's own grype-image job only runs on workflow_dispatch
    # and schedule, so the image every PR actually ships is never scanned
    # pre-merge. This job closes that gap by scanning the same QA image
    # `build` already produced instead of building a second time. Path-
    # filtered like e2e/dast so it skips cleanly on docs-only PRs.
    if: github.event_name == 'workflow_dispatch' || (github.event_name != 'schedule' && needs.changes.outputs.runtime == 'true')
    needs: [build, changes]
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
        with:
          egress-policy: block
          # raw.githubusercontent.com: anchore/scan-action pulls its grype
          # installer from there before get.anchore.io is ever consulted —
          # blocking it fails the scan step with a bare ECONNREFUSED.
          allowed-endpoints: >
            github.com:443
            api.github.com:443
            raw.githubusercontent.com:443
            get.anchore.io:443
            grype.anchore.io:443
            objects.githubusercontent.com:443
            release-assets.githubusercontent.com:443
            *.actions.githubusercontent.com:443
          disable-sudo: true

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
        with:
          persist-credentials: false

      - name: Download QA image artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: qa-image-${{ github.run_id }}
          path: artifacts/qa

      - name: Load QA image
        run: docker load < artifacts/qa/drydock-dev-image.tar.gz

      - name: Run Grype vulnerability scanner
        # Scans the exact image the PR built (drydock:dev, loaded from the
        # build job's artifact) — the same severity gate as the periodic
        # image scan, applied to what a merge would actually ship.
        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2  # v7.4.0
        id: grype
        env:
          # Load the repo-root .grype.yaml explicitly — see security-grype.yml
          # for why the bundled cosign/trivy vendored Go-module CVEs are triaged.
          GRYPE_CONFIG: ${{ github.workspace }}/.grype.yaml
        with:
          image: drydock:dev
          severity-cutoff: high
          fail-build: true
          output-format: sarif

      - name: Upload Grype SARIF to code scanning
        # Code scanning uploads need a public repo or GHAS. Drydock is public,
        # so this runs; the guard keeps the job green on a fork/private mirror.
        # Distinct category from security-grype.yml's `grype-image` so the two
        # scans (PR-built vs. periodic) don't collide in the same ref's results.
        if: always() && github.event.repository.visibility == 'public'
        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
        with:
          sarif_file: ${{ steps.grype.outputs.sarif }}
          category: grype-image-pr

      - name: Summarize
        if: always()
        run: |
          {
            echo "### Grype Container Scan (PR-built image)"
            echo "- Scanned the PR-built image's shipped dependency set for HIGH/CRITICAL CVEs"
          } >> "$GITHUB_STEP_SUMMARY"

  dast-zap-baseline:
    name: "DAST: ZAP + Nuclei"
    runs-on: ubuntu-24.04
    timeout-minutes: 25  # Includes QA stack startup and scanner container runtime
    # Run on every merge to main (gates the next release-cut), on legacy
    # release branches (back-compat), and on the existing weekly schedules
    # so external-template/signature drift is caught between merges.
    if: |
      github.event_name == 'workflow_dispatch'
      || (github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')))
      || github.event_name == 'schedule'
    needs: [build]
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
        with:
          persist-credentials: false

      - name: Download QA image artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: qa-image-${{ github.run_id }}
          path: artifacts/qa

      - name: Load QA image
        run: docker load < artifacts/qa/drydock-dev-image.tar.gz

      - name: Start QA stack
        run: docker compose -p drydock-zap -f test/qa-compose.yml up -d

      - name: Wait for QA health
        run: |
          set -euo pipefail
          for _ in $(seq 1 90); do
            if curl -sf http://localhost:3333/health >/dev/null 2>&1; then
              echo "Drydock is healthy"
              exit 0
            fi
            sleep 2
          done

          echo "Drydock failed to become healthy after 180 seconds."
          docker compose -p drydock-zap -f test/qa-compose.yml ps
          docker compose -p drydock-zap -f test/qa-compose.yml logs --no-color --tail=30
          exit 1

      - name: Create ZAP authenticated session
        id: zap_auth
        run: |
          set -euo pipefail

          cookie_jar="$(mktemp)"
          trap 'rm -f "${cookie_jar}"' EXIT

          # qa-compose.yml DD_AUTH_BASIC_ADMIN_HASH verifies 'admin' (matches
          # Playwright DD_PASSWORD default in e2e/playwright/helpers/test-helpers.ts).
          # ci-compose.yml uses a different hash that verifies 'password'.
          basic_auth="$(printf 'admin:admin' | base64 | tr -d '\n')"
          echo "::add-mask::${basic_auth}"
          curl -fsS \
            -c "${cookie_jar}" \
            -H "Authorization: Basic ${basic_auth}" \
            -H 'Content-Type: application/json' \
            --data '{"remember":false}' \
            http://localhost:3333/auth/login >/dev/null

          curl -fsS -b "${cookie_jar}" http://localhost:3333/auth/user >/dev/null

          cookie_header="$(
            awk '
              /^#HttpOnly_/ { sub(/^#HttpOnly_/, "") }
              /^#/ || NF < 7 { next }
              { printf "%s%s=%s", sep, $6, $7; sep="; " }
            ' "${cookie_jar}"
          )"

          if [ -z "${cookie_header}" ]; then
            echo "::error::Authenticated ZAP login did not produce a session cookie."
            exit 1
          fi

          echo "::add-mask::${cookie_header}"
          printf 'cookie_header=%s\n' "${cookie_header}" >> "${GITHUB_OUTPUT}"

      - name: Run ZAP baseline scan
        uses: zaproxy/action-baseline@de8ad967d3548d44ef623df22cf95c3b0baf8b25  # v0.15.0
        env:
          ZAP_AUTH_HEADER: Cookie
          ZAP_AUTH_HEADER_VALUE: ${{ steps.zap_auth.outputs.cookie_header }}
          ZAP_AUTH_HEADER_SITE: localhost:3333
        with:
          target: http://localhost:3333
          docker_name: ghcr.io/zaproxy/zaproxy@sha256:2ec1d5d5b44d55cfd02ba9b89cd26852f06d92b7fc0ce9f064b9463babc73074  # stable digest, 2026-05-28
          rules_file_name: .zap/rules.tsv
          allow_issue_writing: false
          fail_action: true

      - name: Convert ZAP JSON report to SARIF
        if: always() && hashFiles('report_json.json') != ''
        run: |
          node scripts/zap-json-to-sarif.mjs \
            --input=report_json.json \
            --output=artifacts/zap/zap-baseline.sarif

      - name: Upload ZAP SARIF
        if: always() && hashFiles('artifacts/zap/zap-baseline.sarif') != ''
        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
        with:
          sarif_file: artifacts/zap/zap-baseline.sarif
          category: zap-baseline

      - name: Upload ZAP HTML report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: zap-baseline-html-${{ github.run_id }}-${{ github.run_attempt }}
          path: report_html.html
          if-no-files-found: warn
          retention-days: 30

      - name: Summarize ZAP findings
        if: always()
        run: |
          set -uo pipefail

          report="report_json.json"
          artifact_name="zap-baseline-html-${{ github.run_id }}-${{ github.run_attempt }}"
          artifact_url="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }}#artifacts"
          auth_mode="Basic session cookie"

          high=0
          medium=0
          low=0
          info=0
          total=0
          parse_error=0

          if [ -f "${report}" ] && [ -s "${report}" ]; then
            if jq -e . "${report}" >/dev/null 2>&1; then
              high="$(jq '[.site[]?.alerts[]? | select((.riskcode // "") == "3")] | length' "${report}")"
              medium="$(jq '[.site[]?.alerts[]? | select((.riskcode // "") == "2")] | length' "${report}")"
              low="$(jq '[.site[]?.alerts[]? | select((.riskcode // "") == "1")] | length' "${report}")"
              info="$(jq '[.site[]?.alerts[]? | select((.riskcode // "") == "0")] | length' "${report}")"
              total=$((high + medium + low + info))
            else
              parse_error=1
            fi
          fi

          {
            echo "### DAST: ZAP Baseline"
            if [ ! -f "${report}" ]; then
              echo "- Report: JSON output not found (\`${report}\`)."
            elif [ ! -s "${report}" ]; then
              echo "- Report: JSON output is empty (\`${report}\`)."
            elif [ "${parse_error}" -eq 1 ]; then
              echo "- Report: JSON output could not be parsed (\`${report}\`)."
            fi
            echo "- Findings: **${total}**"
            echo "- Severity breakdown: high=${high}, medium=${medium}, low=${low}, info=${info}"
            echo "- Auth: ${auth_mode}"
            echo "- Artifact: [${artifact_name}](${artifact_url})"
          } >> "${GITHUB_STEP_SUMMARY}"

      - name: Create Nuclei report directory
        if: always()
        run: mkdir -p artifacts/dast

      - name: Run unauthenticated metrics exposure scan
        # This template checks public exposure. Run it without the admin
        # session that the remaining vulnerability templates use below.
        id: nuclei_exposure_scan
        if: always()
        continue-on-error: true
        uses: projectdiscovery/nuclei-action@cc153d0541e1adf8a42bbe31c0a4fb2376147538  # v3.1.1
        with:
          version: v3.8.0
          args: >-
            -u http://localhost:3333
            -severity medium,high,critical
            -type http
            -id prometheus-metrics
            -json-export artifacts/dast/nuclei-exposure-report.json
            -sarif-export artifacts/dast/nuclei-exposure-report.sarif
            -silent

      - name: Create Nuclei authenticated session
        id: nuclei_auth
        if: always()
        run: |
          set -euo pipefail

          cookie_jar="$(mktemp)"
          trap 'rm -f "${cookie_jar}"' EXIT

          # qa-compose.yml DD_AUTH_BASIC_ADMIN_HASH verifies 'admin' (matches
          # Playwright DD_PASSWORD default in e2e/playwright/helpers/test-helpers.ts).
          # ci-compose.yml uses a different hash that verifies 'password'.
          basic_auth="$(printf 'admin:admin' | base64 | tr -d '\n')"
          echo "::add-mask::${basic_auth}"
          curl -fsS \
            -c "${cookie_jar}" \
            -H "Authorization: Basic ${basic_auth}" \
            -H 'Content-Type: application/json' \
            --data '{"remember":false}' \
            http://localhost:3333/auth/login >/dev/null

          curl -fsS -b "${cookie_jar}" http://localhost:3333/auth/user >/dev/null

          cookie_header="$(
            awk '
              /^#HttpOnly_/ { sub(/^#HttpOnly_/, "") }
              /^#/ || NF < 7 { next }
              { printf "%s%s=%s", sep, $6, $7; sep="; " }
            ' "${cookie_jar}"
          )"

          if [ -z "${cookie_header}" ]; then
            echo "::error::Authenticated Nuclei login did not produce a session cookie."
            exit 1
          fi

          echo "::add-mask::${cookie_header}"
          printf 'cookie_header=%s\n' "${cookie_header}" >> "${GITHUB_OUTPUT}"

      - name: Run Nuclei scan
        id: nuclei_scan
        if: always()
        continue-on-error: true
        uses: projectdiscovery/nuclei-action@cc153d0541e1adf8a42bbe31c0a4fb2376147538  # v3.1.1
        with:
          version: v3.8.0
          args: >-
            -u http://localhost:3333
            -severity medium,high,critical
            -type http
            -exclude-id prometheus-metrics
            -H "Cookie: ${{ steps.nuclei_auth.outputs.cookie_header }}"
            -json-export artifacts/dast/nuclei-authenticated-report.json
            -sarif-export artifacts/dast/nuclei-authenticated-report.sarif
            -silent

      - name: Merge Nuclei scan reports
        id: nuclei_reports
        if: always()
        env:
          SCAN_OUTCOME: >-
            ${{ steps.nuclei_auth.outcome == 'success' && steps.nuclei_exposure_scan.outcome == 'success' &&
                steps.nuclei_scan.outcome == 'success' && 'success' || 'failure' }}
        run: |
          set -euo pipefail

          if [ "${SCAN_OUTCOME}" != "success" ]; then
            echo "Nuclei scans did not complete successfully; keeping raw reports without publishing analyses."
            exit 1
          fi

          json_reports=()
          for context in authenticated exposure; do
            report="artifacts/dast/nuclei-${context}-report.json"
            if [ -s "${report}" ]; then
              json_reports+=("${report}")
            fi
            sarif="artifacts/dast/nuclei-${context}-report.sarif"
            if [ -s "${sarif}" ]; then
              jq -e '.version == "2.1.0" and (.runs | type == "array")' "${sarif}" >/dev/null
            else
              jq -n '{"$schema": "https://json.schemastore.org/sarif-2.1.0.json", version: "2.1.0", runs: [{tool: {driver: {name: "Nuclei", rules: []}}, results: []}]}' > "${sarif}"
            fi
          done

          if [ "${#json_reports[@]}" -gt 0 ]; then
            jq -s '[.[] | if type == "array" then .[] else . end]' "${json_reports[@]}" > artifacts/dast/nuclei-report.json
          else
            printf '[]\n' > artifacts/dast/nuclei-report.json
          fi

          cp artifacts/dast/nuclei-authenticated-report.sarif artifacts/dast/nuclei-report.sarif

      - name: Enforce Nuclei severity gate (medium+)
        if: always()
        env:
          SCAN_OUTCOME: >-
            ${{ steps.nuclei_auth.outcome == 'success' && steps.nuclei_exposure_scan.outcome == 'success' &&
                steps.nuclei_scan.outcome == 'success' && steps.nuclei_reports.outcome == 'success' && 'success' || 'failure' }}
        run: |
          set -euo pipefail

          report="artifacts/dast/nuclei-report.json"

          if [ ! -f "${report}" ]; then
            echo "Nuclei did not produce a JSON report."
            if [ "${SCAN_OUTCOME}" != "success" ]; then
              echo "Nuclei action failed before report generation."
              exit 1
            fi
            exit 0
          fi

          if [ ! -s "${report}" ]; then
            echo "No medium+ findings detected."
            if [ "${SCAN_OUTCOME}" != "success" ]; then
              echo "Nuclei action did not succeed."
              exit 1
            fi
            exit 0
          fi

          finding_count="$(jq -s '[.[] | (if type == "array" then .[] else . end) | select(((.info.severity // .severity // "") | ascii_downcase | test("^(medium|high|critical)$")))] | length' "${report}")"
          echo "Medium+ findings: ${finding_count}"

          if [ "${SCAN_OUTCOME}" != "success" ]; then
            echo "Nuclei action did not complete successfully."
            exit 1
          fi

          if [ "${finding_count}" -gt 0 ]; then
            echo "Nuclei reported medium+ severity findings."
            exit 1
          fi

      - name: Prepare Nuclei SARIF report
        id: nuclei_sarif
        if: always()
        env:
          SCAN_OUTCOME: >-
            ${{ steps.nuclei_auth.outcome == 'success' && steps.nuclei_exposure_scan.outcome == 'success' &&
                steps.nuclei_scan.outcome == 'success' && steps.nuclei_reports.outcome == 'success' && 'success' || 'failure' }}
        run: |
          set -euo pipefail

          sarif="artifacts/dast/nuclei-report.sarif"

          if [ "${SCAN_OUTCOME}" != "success" ]; then
            echo "Nuclei did not complete successfully; skipping Code Scanning upload."
            echo "upload=false" >> "${GITHUB_OUTPUT}"
            exit 0
          fi

          if [ -s "${sarif}" ]; then
            if jq -e '.version == "2.1.0" and (.runs | type == "array")' "${sarif}" >/dev/null; then
              echo "upload=true" >> "${GITHUB_OUTPUT}"
              exit 0
            fi

            echo "::warning::Nuclei SARIF output is not valid SARIF 2.1.0; skipping Code Scanning upload."
            echo "upload=false" >> "${GITHUB_OUTPUT}"
            exit 0
          fi

          cat > "${sarif}" <<'JSON'
          {
            "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
            "version": "2.1.0",
            "runs": [
              {
                "tool": {
                  "driver": {
                    "name": "Nuclei",
                    "informationUri": "https://github.com/projectdiscovery/nuclei",
                    "semanticVersion": "3.8.0",
                    "rules": []
                  }
                },
                "results": []
              }
            ]
          }
          JSON

          echo "upload=true" >> "${GITHUB_OUTPUT}"

      - name: Upload Nuclei SARIF to code scanning
        if: always() && steps.nuclei_sarif.outputs.upload == 'true'
        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
        with:
          sarif_file: artifacts/dast/nuclei-report.sarif
          category: nuclei

      - name: Upload unauthenticated metrics SARIF
        if: always() && steps.nuclei_reports.outcome == 'success' && hashFiles('artifacts/dast/nuclei-exposure-report.sarif') != ''
        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
        with:
          sarif_file: artifacts/dast/nuclei-exposure-report.sarif
          category: nuclei-metrics-unauthenticated

      - name: Upload Nuclei reports
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dast-nuclei-report-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            artifacts/dast/nuclei-report.json
            artifacts/dast/nuclei-report.sarif
            artifacts/dast/nuclei-authenticated-report.json
            artifacts/dast/nuclei-authenticated-report.sarif
            artifacts/dast/nuclei-exposure-report.json
            artifacts/dast/nuclei-exposure-report.sarif
          if-no-files-found: warn
          retention-days: 30

      - name: Summarize Nuclei findings
        if: always()
        run: |
          set -uo pipefail

          report="artifacts/dast/nuclei-report.json"
          sarif="artifacts/dast/nuclei-report.sarif"
          artifact_name="dast-nuclei-report-${{ github.run_id }}-${{ github.run_attempt }}"
          artifact_url="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }}#artifacts"

          critical=0
          high=0
          medium=0
          low=0
          info=0
          total=0
          parse_error=0

          if [ -f "${report}" ] && [ -s "${report}" ]; then
            if jq -e -s . "${report}" >/dev/null 2>&1; then
              total="$(jq -s '[.[] | (if type == "array" then .[] else . end)] | length' "${report}")"
              critical="$(jq -s '[.[] | (if type == "array" then .[] else . end) | select(((.info.severity // .severity // "") | ascii_downcase) == "critical")] | length' "${report}")"
              high="$(jq -s '[.[] | (if type == "array" then .[] else . end) | select(((.info.severity // .severity // "") | ascii_downcase) == "high")] | length' "${report}")"
              medium="$(jq -s '[.[] | (if type == "array" then .[] else . end) | select(((.info.severity // .severity // "") | ascii_downcase) == "medium")] | length' "${report}")"
              low="$(jq -s '[.[] | (if type == "array" then .[] else . end) | select(((.info.severity // .severity // "") | ascii_downcase) == "low")] | length' "${report}")"
              info="$(jq -s '[.[] | (if type == "array" then .[] else . end) | select(((.info.severity // .severity // "") | ascii_downcase) == "info")] | length' "${report}")"
            else
              parse_error=1
            fi
          fi

          {
            echo "### DAST: Nuclei"
            if [ ! -f "${report}" ]; then
              echo "- Report: JSON output not found (\`${report}\`)."
            elif [ ! -s "${report}" ]; then
              echo "- Report: JSON output is empty (\`${report}\`)."
            elif [ "${parse_error}" -eq 1 ]; then
              echo "- Report: JSON output could not be parsed (\`${report}\`)."
            fi
            echo "- Findings: **${total}**"
            echo "- Severity breakdown: critical=${critical}, high=${high}, medium=${medium}, low=${low}, info=${info}"
            echo "- Auth: Basic session cookie; metrics exposure probe without credentials"
            echo "- Templates: HTTP templates at medium+ severity"
            if [ -s "${sarif}" ]; then
              echo "- SARIF: \`${sarif}\`"
            else
              echo "- SARIF: not produced"
            fi
            echo "- Artifact: [${artifact_name}](${artifact_url})"
          } >> "${GITHUB_STEP_SUMMARY}"

      - name: Show QA logs on failure
        if: failure()
        run: docker compose -p drydock-zap -f test/qa-compose.yml logs --no-color

      - name: Stop QA stack
        if: always()
        run: docker compose -p drydock-zap -f test/qa-compose.yml down -v --remove-orphans

  e2e:
    name: "E2E: Cucumber"
    if: github.event_name == 'workflow_dispatch' || (github.event_name != 'schedule' && needs.changes.outputs.runtime == 'true')
    runs-on: ubuntu-24.04
    # Covers the bounded npm/setup retry budgets, readiness waits, scenario
    # execution, and post-failure evidence collection without racing job expiry.
    timeout-minutes: 40
    needs: [build, changes]
    permissions:
      actions: read
      contents: read
    env:
      # Browser coverage belongs to the separately release-gated Playwright
      # workflow. Do not download Chromium for Cucumber's API/stream contracts.
      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1'

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38  # v6.5.0
        with:
          node-version: 24
          package-manager-cache: true
          cache-dependency-path: e2e/package-lock.json

      - name: Download QA image
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: qa-image-${{ github.run_id }}
          path: artifacts/qa

      - name: Load QA image
        run: docker load < artifacts/qa/drydock-dev-image.tar.gz

      - name: Install e2e dependencies
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
        with:
          timeout_minutes: 3
          max_attempts: 3
          retry_wait_seconds: 15
          command: cd e2e && npm ci --no-audit --no-fund

      - name: Run Cucumber support tests
        run: npm run test:support
        working-directory: e2e

      - name: Setup test containers
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
        with:
          timeout_minutes: 6
          max_attempts: 2
          retry_wait_seconds: 10
          command: ./scripts/setup-test-containers.sh

      - name: Start drydock
        id: drydock
        env:
          DD_E2E_IMAGE: drydock:dev
          DD_E2E_SKIP_BUILD: 'true'
        run: ./scripts/start-drydock.sh

      - name: Run Cucumber e2e tests
        # The gitlab_test container needs a private-registry token that is not
        # available in CI, so setup-test-containers.sh skips it; exclude the
        # @requires_gitlab scenarios here to match, otherwise they fail looking
        # for a missing container. The token-gated local path that runs them
        # lives in scripts/run-e2e-tests.sh.
        env:
          DD_PORT: ${{ steps.drydock.outputs.dd_port }}
        working-directory: e2e
        run: |
          mkdir -p reports
          npm run cucumber -- --tags "not @requires_gitlab" --format progress --format json:reports/cucumber.json --format junit:reports/cucumber.xml --format html:reports/cucumber.html

      - name: Collect Cucumber diagnostics
        if: failure() || cancelled()
        env:
          DD_PASSWORD: doe
          DD_PORT: ${{ steps.drydock.outputs.dd_port }}
          DD_USERNAME: john
        run: |
          set +e
          diagnostics=artifacts/cucumber
          mkdir -p "$diagnostics/fixtures"

          docker ps -a --no-trunc > "$diagnostics/docker-ps.txt" 2>&1
          docker logs --timestamps drydock > "$diagnostics/drydock.log" 2>&1
          curl --silent --show-error \
            --max-time 10 \
            --output "$diagnostics/health.json" \
            --write-out '%{http_code}\n' \
            "http://localhost:${DD_PORT}/health" > "$diagnostics/health-status.txt" 2>&1
          curl --silent --show-error \
            --max-time 10 \
            --user "${DD_USERNAME}:${DD_PASSWORD}" \
            "http://localhost:${DD_PORT}/api/v1/containers" \
            > "$diagnostics/containers.json" 2> "$diagnostics/containers-curl-error.txt"

          while IFS= read -r container_id; do
            [ -n "$container_id" ] || continue
            container_name="$(docker inspect --format '{{.Name}}' "$container_id" | sed 's#^/##' | tr -c 'A-Za-z0-9_.-' '_')"
            docker inspect --format '{{json .State}}' "$container_id" \
              > "$diagnostics/fixtures/${container_name}.state.json" 2>&1
            docker logs --timestamps --tail 200 "$container_id" \
              > "$diagnostics/fixtures/${container_name}.log" 2>&1
          done < <(docker ps -aq --filter label=dd.watch=true)

      - name: Upload Cucumber diagnostics
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: cucumber-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            e2e/reports
            artifacts/cucumber
          if-no-files-found: warn
          retention-days: 14

      - name: Cleanup
        if: always()
        run: ./scripts/cleanup-test-containers.sh

  # Playwright lives in its own workflow file (.github/workflows/e2e-playwright.yml)
  # so a single failing UI assertion doesn't drag this workflow's Check
  # Suite to "failure" — which had been making OpenSSF Scorecard's
  # CI-Tests check mark merged PRs as untested (alert #43). Releases
  # still gate on it via release-cut.yml's second wait step.

  load-test-ci:
    name: "Load Test: CI"
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')))
    needs: [build]
    # Load tests hit the API with Artillery; no browser needed. Skip the
    # @playwright/test postinstall chromium download (167 MiB from
    # cdn.playwright.dev, frequently throttled) for every `npm ci` in e2e/.
    env:
      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1'
    permissions:
      contents: read

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38  # v6.5.0
        with:
          node-version: 24
          package-manager-cache: true
          cache-dependency-path: e2e/package-lock.json

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0

      - name: Install e2e dependencies
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
        with:
          timeout_minutes: 3
          max_attempts: 3
          retry_wait_seconds: 30
          command: cd e2e && npm ci

      - name: Run Artillery load test
        id: run-load-test-ci
        env:
          ARTILLERY_ENV: ci
          DD_LOAD_TEST_BUILD_CACHE: gha
          DD_LOAD_TEST_ARTIFACT_DIR: artifacts/load-test/ci
        run: ./scripts/run-load-test.sh

      - name: Summarize load test metrics (ci)
        if: always()
        run: |
          report="$({ find artifacts/load-test/ci -maxdepth 1 -name '*.json' -printf '%T@ %p\n' 2>/dev/null || true; } | sort -rn | head -n1 | cut -d' ' -f2-)"
          ./scripts/summarize-load-test-report.sh "$report" "Load Test (CI)" "test/load-test-baselines/ci.json"

      - name: Correctness check (ci, enforced)
        if: always()
        env:
          DD_LOAD_TEST_CORRECTNESS_ENFORCE: 'true'
          DD_LOAD_TEST_MAX_5XX: '0'
          DD_LOAD_TEST_MAX_VUSERS_FAILED: '0'
          DD_LOAD_TEST_MIN_429: '0'
          DD_LOAD_TEST_MAX_429: '0'
        run: |
          report="$({ find artifacts/load-test/ci -maxdepth 1 -name '*.json' -printf '%T@ %p\n' 2>/dev/null || true; } | sort -rn | head -n1 | cut -d' ' -f2-)"
          ./scripts/check-load-test-correctness.sh "$report" "Load Test Correctness (CI)"

      - name: Resolve committed load test baseline (ci)
        id: load-test-baseline-ci
        if: ${{ always() && steps.run-load-test-ci.conclusion == 'success' }}
        run: |
          set -euo pipefail

          baseline_report="test/load-test-baselines/ci.json"
          if [ ! -f "${baseline_report}" ]; then
            echo "::error::Committed baseline not found at ${baseline_report}."
            exit 1
          fi

          echo "baseline_artifact_name=repo:${baseline_report}" >> "${GITHUB_OUTPUT}"
          echo "baseline_report=${baseline_report}" >> "${GITHUB_OUTPUT}"

      - name: Regression check against committed baseline (ci, enforced)
        if: ${{ always() && steps.run-load-test-ci.conclusion == 'success' }}
        env:
          BASELINE_REPORT: ${{ steps.load-test-baseline-ci.outputs.baseline_report }}
          DD_LOAD_TEST_BASELINE_ARTIFACT_NAME: ${{ steps.load-test-baseline-ci.outputs.baseline_artifact_name }}
          DD_LOAD_TEST_MAX_P95_INCREASE_PCT: '20'
          DD_LOAD_TEST_MAX_P99_INCREASE_PCT: '25'
          DD_LOAD_TEST_MAX_RATE_DECREASE_PCT: '40'
          DD_LOAD_TEST_MAX_P95_MS: '1200'
          DD_LOAD_TEST_MAX_P99_MS: '2500'
          DD_LOAD_TEST_MIN_REQUEST_RATE: '3'
          DD_LOAD_TEST_REGRESSION_ENFORCE: 'true'
        run: |
          set -euo pipefail

          if [ "${DD_LOAD_TEST_REGRESSION_ENFORCE:-}" != "true" ]; then
            echo "::error::Regression gate misconfigured: DD_LOAD_TEST_REGRESSION_ENFORCE must be true in enforced mode."
            exit 1
          fi

          current_report="$({ find artifacts/load-test/ci -maxdepth 1 -name '*.json' -printf '%T@ %p\n' 2>/dev/null || true; } | sort -rn | head -n1 | cut -d' ' -f2-)"
          if [ -z "${current_report}" ]; then
            echo "::error::Current CI report not found; cannot run regression gate."
            exit 1
          fi

          if [ -z "${BASELINE_REPORT}" ]; then
            echo "::error::Baseline report path is empty; expected committed baseline."
            exit 1
          fi

          ./scripts/check-load-test-regression.sh "${current_report}" "${BASELINE_REPORT}"

      - name: Upload load test artifact (ci)
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: load-test-ci-${{ github.run_id }}-${{ github.run_attempt }}
          path: artifacts/load-test/ci/*.json
          if-no-files-found: warn
          retention-days: 30

  load-test-behavior:
    name: "Load Test: Behavior + Stress (Advisory)"
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')))
    needs: [build]
    env:
      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1'
    permissions:
      contents: read

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38  # v6.5.0
        with:
          node-version: 24
          package-manager-cache: true
          cache-dependency-path: e2e/package-lock.json

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0

      - name: Install e2e dependencies
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
        with:
          timeout_minutes: 3
          max_attempts: 3
          retry_wait_seconds: 30
          command: cd e2e && npm ci

      - name: Run Artillery behavior test
        id: run-load-test-behavior
        env:
          ARTILLERY_FILE: ./test/test-behavior.yml
          ARTILLERY_ENV: behavior
          DD_LOAD_TEST_BUILD_CACHE: gha
          DD_LOAD_TEST_ARTIFACT_DIR: artifacts/load-test/behavior
        run: ./scripts/run-load-test.sh

      - name: Summarize load test metrics (behavior)
        if: always()
        run: |
          report="$({ find artifacts/load-test/behavior -maxdepth 1 -name '*.json' -printf '%T@ %p\n' 2>/dev/null || true; } | sort -rn | head -n1 | cut -d' ' -f2-)"
          ./scripts/summarize-load-test-report.sh "$report" "Load Test (Behavior)" "test/load-test-baselines/behavior.json"

      - name: Correctness check (behavior, advisory)
        if: always()
        env:
          DD_LOAD_TEST_CORRECTNESS_ENFORCE: 'false'
          DD_LOAD_TEST_MAX_5XX: '0'
          DD_LOAD_TEST_MAX_VUSERS_FAILED: '0'
          DD_LOAD_TEST_MIN_429: '0'
          DD_LOAD_TEST_MAX_429: '0'
        run: |
          report="$({ find artifacts/load-test/behavior -maxdepth 1 -name '*.json' -printf '%T@ %p\n' 2>/dev/null || true; } | sort -rn | head -n1 | cut -d' ' -f2-)"
          ./scripts/check-load-test-correctness.sh "$report" "Load Test Correctness (Behavior)"

      - name: Resolve committed load test baseline (behavior)
        id: load-test-baseline-behavior
        if: ${{ always() && steps.run-load-test-behavior.conclusion == 'success' }}
        run: |
          set -euo pipefail

          baseline_report="test/load-test-baselines/behavior.json"
          if [ ! -f "${baseline_report}" ]; then
            echo "::error::Committed baseline not found at ${baseline_report}."
            exit 1
          fi

          echo "baseline_artifact_name=repo:${baseline_report}" >> "${GITHUB_OUTPUT}"
          echo "baseline_report=${baseline_report}" >> "${GITHUB_OUTPUT}"

      - name: Regression check against committed baseline (behavior, advisory)
        if: ${{ always() && steps.run-load-test-behavior.conclusion == 'success' }}
        env:
          BASELINE_REPORT: ${{ steps.load-test-baseline-behavior.outputs.baseline_report }}
          DD_LOAD_TEST_BASELINE_ARTIFACT_NAME: ${{ steps.load-test-baseline-behavior.outputs.baseline_artifact_name }}
          DD_LOAD_TEST_MAX_P95_INCREASE_PCT: '30'
          DD_LOAD_TEST_MAX_P99_INCREASE_PCT: '40'
          DD_LOAD_TEST_MAX_RATE_DECREASE_PCT: '50'
          DD_LOAD_TEST_MAX_P95_MS: '1500'
          DD_LOAD_TEST_MAX_P99_MS: '3000'
          DD_LOAD_TEST_MIN_REQUEST_RATE: '1'
          DD_LOAD_TEST_REGRESSION_ENFORCE: 'false'
        run: |
          set -euo pipefail

          current_report="$({ find artifacts/load-test/behavior -maxdepth 1 -name '*.json' -printf '%T@ %p\n' 2>/dev/null || true; } | sort -rn | head -n1 | cut -d' ' -f2-)"
          ./scripts/check-load-test-regression.sh "${current_report}" "${BASELINE_REPORT}"

      - name: Upload load test artifact (behavior)
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: load-test-behavior-${{ github.run_id }}-${{ github.run_attempt }}
          path: artifacts/load-test/behavior/*.json
          if-no-files-found: warn
          retention-days: 30

      - name: Run Artillery stress test (advisory)
        id: run-load-test-stress
        if: always()
        continue-on-error: true
        env:
          ARTILLERY_ENV: stress
          DD_LOAD_TEST_BUILD_CACHE: gha
          DD_LOAD_TEST_ARTIFACT_DIR: artifacts/load-test/stress
        run: ./scripts/run-load-test.sh

      - name: Summarize load test metrics (stress)
        if: always()
        run: |
          report="$({ find artifacts/load-test/stress -maxdepth 1 -name '*.json' -printf '%T@ %p\n' 2>/dev/null || true; } | sort -rn | head -n1 | cut -d' ' -f2-)"
          ./scripts/summarize-load-test-report.sh "$report" "Load Test (Stress)"

      - name: Correctness check (stress, advisory)
        if: always()
        env:
          DD_LOAD_TEST_CORRECTNESS_ENFORCE: 'false'
          DD_LOAD_TEST_MAX_5XX: '0'
          DD_LOAD_TEST_MAX_VUSERS_FAILED: '0'
          DD_LOAD_TEST_MIN_429: '0'
          DD_LOAD_TEST_MAX_429: '0'
        run: |
          report="$({ find artifacts/load-test/stress -maxdepth 1 -name '*.json' -printf '%T@ %p\n' 2>/dev/null || true; } | sort -rn | head -n1 | cut -d' ' -f2-)"
          ./scripts/check-load-test-correctness.sh "$report" "Load Test Correctness (Stress)"

      - name: Upload load test artifact (stress)
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: load-test-stress-${{ github.run_id }}-${{ github.run_attempt }}
          path: artifacts/load-test/stress/*.json
          if-no-files-found: warn
          retention-days: 30