name: governance
on:
  pull_request:
  push:
    branches: [main]

jobs:
  governance:
    runs-on: ubuntu-latest
    env:
      GOPROXY: https://goproxy.cn,direct
    steps:
      - name: Checkout
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SUBMODULE_TOKEN: ${{ secrets.SUBMODULE_TOKEN }}
        run: |
          set -euo pipefail
          # 只物化两个治理 gitlink（Guidelines 与 deps/development-manager），非递归；
          # 其它 gitlink 不物化、不取回。凭据只以 URL 限定的 extraheader 存在于本进程树内。
          python3 - <<'PY_CHECKOUT'
          import os
          from pathlib import Path
          import re
          import subprocess
          import sys
          from urllib.parse import urlsplit

          # 服务端基址取运行器注入的 GITHUB_SERVER_URL（平台控制、候选 PR 不可影响）。
          SERVER = os.environ.get("GITHUB_SERVER_URL", "").rstrip("/")
          parsed_server = urlsplit(SERVER)
          if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
              sys.exit("Checkout server must be the platform-injected http(s) URL")
          SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
          # 审查过的白名单，独立于候选 .gitmodules：仅列出两个治理 gitlink。
          REPOSITORIES = {
              "deps/development-guidelines": "Development-Guidelines",
              "deps/development-manager": "Development-Manager",
          }
          TARGET = "weichen/Agent-System-Backend"
          root_token = os.environ.pop("TOKEN", "")
          component_token = os.environ.pop("SUBMODULE_TOKEN", "")
          if not root_token or not component_token:
              sys.exit("Checkout requires TOKEN and SUBMODULE_TOKEN")
          if os.environ.get("GITHUB_REPOSITORY") != TARGET:
              sys.exit("Checkout repository is outside the reviewed allowlist")
          sha = os.environ.get("GITHUB_SHA", "")
          if not re.fullmatch(r"[0-9a-fA-F]{40}", sha):
              sys.exit("Checkout requires a fixed commit SHA")

          # 丢弃继承的 Git 追踪/配置/SSH 钩子；凭据只存在于单个 Git 进程树的精确 URL 头中。
          clean_env = {k: v for k, v in os.environ.items() if not k.startswith("GIT_")}
          clean_env.update(GIT_CONFIG_NOSYSTEM="1", GIT_CONFIG_SYSTEM="/dev/null",
                           GIT_CONFIG_GLOBAL="/dev/null", GIT_TERMINAL_PROMPT="0")
          config = {
              "core.hooksPath": "/dev/null", "core.fsmonitor": "false",
              "init.templateDir": "", "credential.helper": "",
              "fetch.recurseSubmodules": "false", "submodule.recurse": "false",
              "http.followRedirects": "false", "protocol.allow": "never",
              "protocol." + urlsplit(SERVER).scheme + ".allow": "always",
          }


          def git(repo, *args, extra=None):
              values = config | (extra or {})
              env = clean_env | {"GIT_CONFIG_COUNT": str(len(values))}
              for index, (key, value) in enumerate(values.items()):
                  env[f"GIT_CONFIG_KEY_{index}"] = key
                  env[f"GIT_CONFIG_VALUE_{index}"] = value
              return subprocess.run(["git", "-C", str(repo), *args], env=env,
                                    check=True, stdout=subprocess.PIPE).stdout


          def materialize_governance(root):
              # -r 列出任意深度的 gitlink，但不进入 submodule 内部；其它 gitlink 只记录、从不取回。
              links = {}
              for entry in git(root, "ls-tree", "-rz", "HEAD").split(b"\0"):
                  if not entry:
                      continue
                  metadata, path = entry.split(b"\t", 1)
                  mode, kind, commit = metadata.decode().split()
                  if mode == "160000":
                      links[path.decode()] = commit
              for name in REPOSITORIES:
                  if name not in links:
                      raise ValueError("Governance gitlink is missing from the fixed commit")
              raw = git(root, "config", "--no-includes", "--blob", "HEAD:.gitmodules", "--null", "--list")
              entries = {}
              for item in raw.split(b"\0"):
                  if not item:
                      continue
                  key, value = item.decode().split("\n", 1)
                  match = re.fullmatch(r"submodule\.(.+)\.(path|url)", key)
                  if not match:
                      continue
                  name, field = match.groups()
                  if name not in REPOSITORIES:
                      continue
                  if field in entries.setdefault(name, {}):
                      raise ValueError("Duplicate candidate .gitmodules setting")
                  entries[name][field] = value
              # 先整体校验两个治理条目，再进行任何带凭据的取回。
              for name, repository in REPOSITORIES.items():
                  fields = entries.get(name, {})
                  if fields.get("path") != name:
                      raise ValueError("Governance submodule path is outside the reviewed allowlist")
                  trusted_url = f"{SERVER}/weichen/{repository}.git"
                  if fields.get("url") not in {SSH + repository + ".git", trusted_url}:
                      raise ValueError("Governance submodule URL is outside the reviewed allowlist")
              for name, repository in REPOSITORIES.items():
                  url = f"{SERVER}/weichen/{repository}.git"
                  # 仅持久化审查过的公开 URL，使 Git 在进程级配置消失后仍识别该 submodule。
                  git(root, "config", f"submodule.{name}.url", url)
                  git(root, "submodule", "update", "--init", "--checkout", "--", name,
                      extra={f"submodule.{name}.url": url,
                             f"submodule.{name}.update": "checkout",
                             f"http.{url}.extraheader": "AUTHORIZATION: token " + component_token})
                  child = root / name
                  if git(child, "rev-parse", "HEAD").decode().strip() != links[name]:
                      raise ValueError("Materialized governance gitlink does not match the fixed SHA")


          try:
              root = Path.cwd()
              # 必须是干净的临时工作区；不复用既有 Git 状态。
              if (root / ".git").exists():
                  raise ValueError("Checkout requires a fresh workspace")
              git(root, "init", "-q")
              url = f"{SERVER}/{TARGET}.git"
              git(root, "remote", "add", "origin", url)
              git(root, "fetch", "--depth=1", "origin", sha,
                  extra={f"http.{url}.extraheader": "AUTHORIZATION: token " + root_token})
              git(root, "checkout", "-q", "--detach", "FETCH_HEAD")
              materialize_governance(root)
          except (ValueError, OSError, subprocess.CalledProcessError) as error:
              sys.exit(f"Checkout refused: {error}")
          print("Checkout complete; credentials were not persisted in Git configuration")
          PY_CHECKOUT
          unset TOKEN SUBMODULE_TOKEN
      - name: Install Go 1.27.1
        run: |
          set -euo pipefail
          curl -fsSL -o "$RUNNER_TEMP/go.tgz" https://mirrors.aliyun.com/golang/go1.27.1.linux-amd64.tar.gz
          tar -C /usr/local -xzf "$RUNNER_TEMP/go.tgz"
          ln -sfn /usr/local/go/bin/go /usr/local/bin/go
          ln -sfn /usr/local/go/bin/gofmt /usr/local/bin/gofmt
      - name: Validate agent execution configuration
        run: scripts/agent-exec validate --repo .
      - name: Governance check
        run: scripts/dm governance check --repo .