pr-checks.yml

name: Misaka Network Agent Auditor

on:
  pull_request:
    types: [opened, synchronize, reopened]
  workflow_dispatch:
    inputs:
      pr_number:
        description: "PR number to audit"
        required: false
        type: string

jobs:
  audit:
    permissions:
      contents: read
      issues: write
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      # ── Scope Detection (Issue #230) ──
      - name: Detect Change Scope
        id: scope
        run: |
          BASE_SHA="${{ github.event.pull_request.base.sha }}"
          HEAD_SHA="${{ github.event.pull_request.head.sha }}"

          # workflow_dispatch has no PR context — always full
          if [ -z "$BASE_SHA" ] || [ -z "$HEAD_SHA" ]; then
            echo "scope=full" >> "$GITHUB_OUTPUT"
            echo "Scope: full (workflow_dispatch)"
            exit 0
          fi

          CHANGED=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")
          NON_LESSON=$(echo "$CHANGED" | grep -Ev '^(lessons/|\.github/workflows/(lesson-quality|pr-checks)\.ya?ml$)' || true)
          NON_WORKFLOW=$(echo "$CHANGED" | grep -Ev '^\.github/workflows/[^/]+\.ya?ml$' || true)
          NON_JS_DEPS=$(echo "$CHANGED" | grep -Ev '^(package|package-lock)\.json$' || true)

          if [ -z "$NON_LESSON" ]; then
            echo "scope=lessons-only" >> "$GITHUB_OUTPUT"
            echo "Scope: lessons-only"
          elif [ -z "$NON_WORKFLOW" ]; then
            echo "scope=ci-only" >> "$GITHUB_OUTPUT"
            echo "Scope: ci-only (GitHub Actions/workflow changes)"
          elif [ -z "$NON_JS_DEPS" ]; then
            echo "scope=js-deps-only" >> "$GITHUB_OUTPUT"
            echo "Scope: js-deps-only (root package manifest/lockfile changes)"
          else
            echo "scope=full" >> "$GITHUB_OUTPUT"
            echo "Scope: full (code or mixed changes)"
          fi

      - name: Setup Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.10"
          cache: pip

      - name: Install Dependencies
        if: steps.scope.outputs.scope == 'full'
        run: |
          echo "=== Installing core dependencies ==="
          pip install -r requirements.txt || { echo "::error::Core dependency install failed"; exit 1; }
          echo "=== Installing optional dependencies ==="
          find . -path ./venv -prune -o -name "requirements.txt" -print | while IFS= read -r req; do
            dir=$(dirname "$req")
            if [ "$dir" != "." ]; then
              echo "  Installing $req ..."
              pip install -r "$req" 2>&1 || echo "  ⚠️ Optional install failed: $req"
            fi
          done
          echo "=== Test dependencies ==="
          pip install pytest pytest-cov
          echo "PYTHONPATH=$(pwd):$PYTHONPATH" >> "$GITHUB_ENV"
          echo "=== Dependency install complete ==="

      - name: Install Schema Dependencies
        if: steps.scope.outputs.scope == 'lessons-only'
        run: |
          pip install pyyaml jsonschema
          echo "PYTHONPATH=$(pwd):$PYTHONPATH" >> "$GITHUB_ENV"

      # ── Quality Score Gate (full scope only) ──
      - name: Agent Quality Score
        if: steps.scope.outputs.scope == 'full'
        id: score
        continue-on-error: true
        uses: ./.github/actions/score-agent
        with:
          pr-number: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
          repo: "Ikalus1988/MisakaNet"
          threshold: "50"
          gh-token: ${{ secrets.SHELDON_PAT || secrets.GITHUB_TOKEN }}

      - name: Reject Low-Quality PR
        if: steps.scope.outputs.scope == 'full' && steps.score.outcome == 'success' && steps.score.outputs.verdict == 'fail'
        env:
          GH_TOKEN: ${{ secrets.SHELDON_PAT || secrets.GITHUB_TOKEN }}
        run: |
          PR_NUM="${{ github.event.pull_request.number }}"
          echo "=== Low-Quality PR #$PR_NUM Rejected ==="
          echo "Score: ${{ steps.score.outputs.score }}/100"
          gh pr close "$PR_NUM" --repo Ikalus1988/MisakaNet \
            --comment "### Quality Score Failed

          Your PR scored ${{ steps.score.outputs.score }}/100 (minimum: 50).

          Issues detected:
          ${{ steps.score.outputs.reasons }}

          Please clean up formatting noise and resubmit."
          exit 1

      # ── DCO Audit Gate (all PRs) ──
      - name: DCO Audit
        id: dco
        uses: Ikalus1988/dco-audit@v1
        with:
          base-sha: ${{ github.event.pull_request.base.sha }}
          head-sha: ${{ github.event.pull_request.head.sha }}
          token: ${{ secrets.SHELDON_PAT || secrets.GITHUB_TOKEN }}
          repo: "Ikalus1988/MisakaNet"
          pr-number: ${{ github.event.pull_request.number || '' }}

      - name: Fail on DCO Violation
        if: steps.dco.outputs.dco-passed == 'false' && !contains(github.event.pull_request.user.login, 'dependabot')
        run: |
          echo "DCO check failed: ${{ steps.dco.outputs.failed-count }} commit(s) without sign-off."
          exit 1

      # ── PR Size Check (full scope only) ──
      - name: Check PR Size
        if: steps.scope.outputs.scope == 'full'
        id: prsize
        run: |
          CHANGED=${{ github.event.pull_request.changed_files || 0 }}
          ADDITIONS=${{ github.event.pull_request.additions || 0 }}
          SUSPICIOUS=false
          NOTES=""
          if [ "$CHANGED" -gt 10 ]; then
            SUSPICIOUS=true
            NOTES="Warn ${CHANGED} files changed (threshold: 10)"
          fi
          if [ "$ADDITIONS" -gt 500 ]; then
            SUSPICIOUS=true
            NOTES="${NOTES}; ${ADDITIONS} lines added (threshold: 500)"
          fi
          echo "suspicious=${SUSPICIOUS}" >> "$GITHUB_OUTPUT"
          echo "notes=${NOTES}" >> "$GITHUB_OUTPUT"
          printf '## PR Size Check\n\n| Metric | Value |\n|--------|-------|\n| Files Changed | %s |\n| Lines Added | %s |\n| Suspicious | %s |\n\n' "${CHANGED}" "${ADDITIONS}" "${SUSPICIOUS}" >> "$GITHUB_STEP_SUMMARY"

      # ── Secret Scanning (full scope only) ──
      - name: Secret Scan
        id: secrets
        if: steps.scope.outputs.scope == 'full'
        run: |
          echo "=== Scanning for hardcoded secrets ==="
          if python3 scripts/check_worker_secrets.py; then
            echo "secrets_result=pass" >> "$GITHUB_OUTPUT"
          else
            echo "secrets_result=fail" >> "$GITHUB_OUTPUT"
            echo "::error::Secret scan found hardcoded secrets — blocking merge"
            exit 1
          fi

      # ── Security Checks (full scope, non-blocking advisory) ──
      - name: Security Advisory Checks
        if: steps.scope.outputs.scope == 'full'
        run: |
          echo "=== Security Advisory Checks ==="
          ISSUES=0

          # 1. CI/CD pinned actions (check workflow files use SHA)
          echo "--- Checking workflow action pinning ---"
          for wf in .github/workflows/*.yml .github/workflows/*.yaml; do
            [ -f "$wf" ] || continue
            UNPINNED=$(grep -E 'uses: [a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+@v[0-9]' "$wf" | grep -v '@[a-f0-9]{40}' || true)
            if [ -n "$UNPINNED" ]; then
              echo "::warning file=$wf::Unpinned actions (should use SHA): $UNPINNED"
              ISSUES=$((ISSUES + 1))
            fi
          done

          # 2. Overly broad permissions
          echo "--- Checking workflow permissions ---"
          for wf in .github/workflows/*.yml .github/workflows/*.yaml; do
            [ -f "$wf" ] || continue
            if grep -q 'permissions:.*write-all' "$wf" 2>/dev/null; then
              echo "::warning file=$wf::Overly broad permissions (write-all)"
              ISSUES=$((ISSUES + 1))
            fi
          done

          # 3. README quality
          echo "--- Checking README quality ---"
          if [ -f README.md ]; then
            HAS_DESCRIPTION=$(grep -c "## What is this\|## Quick Start\|## Try it" README.md || echo "0")
            if [ "$HAS_DESCRIPTION" -eq 0 ]; then
              echo "::warning::README missing description/quickstart section"
              ISSUES=$((ISSUES + 1))
            fi
          fi

          # 4. Code style (TODOs, debug code)
          echo "--- Checking code style ---"
          TODOS=$(grep -rn "TODO\|FIXME\|HACK\|XXX" scripts/ --include="*.py" 2>/dev/null | grep -v "test" | wc -l || echo "0")
          if [ "$TODOS" -gt 5 ]; then
            echo "::warning::Found $TODOS TODO/FIXME items in scripts/"
            ISSUES=$((ISSUES + 1))
          fi

          if [ "$ISSUES" -gt 0 ]; then
            echo "security_advisory=$ISSUES issues found (non-blocking)" >> "$GITHUB_OUTPUT"
          else
            echo "security_advisory=pass" >> "$GITHUB_OUTPUT"
          fi

      # ── Dependency Audit (dependency scopes only) ──
      - name: Dependency Audit
        id: depaudit
        if: steps.scope.outputs.scope == 'full' || steps.scope.outputs.scope == 'js-deps-only'
        run: |
          # Only audit ecosystems whose dependency files changed
          BASE_SHA="${{ github.event.pull_request.base.sha }}"
          HEAD_SHA="${{ github.event.pull_request.head.sha }}"
          CHANGED=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")
          PY_DEPS_CHANGED=false
          JS_DEPS_CHANGED=false
          if echo "$CHANGED" | grep -qE '(^|/)requirements\.txt$|^pyproject\.toml$'; then
            PY_DEPS_CHANGED=true
          fi
          if echo "$CHANGED" | grep -qE '^(package|package-lock)\.json$'; then
            JS_DEPS_CHANGED=true
          fi

          if [ "$PY_DEPS_CHANGED" != "true" ] && [ "$JS_DEPS_CHANGED" != "true" ]; then
            echo "No Python/JS dependency files changed — dependency audit skipped"
            echo "depaudit_result=skipped" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          AUDIT_FAIL=false
          if [ "$PY_DEPS_CHANGED" = "true" ]; then
            echo "=== Python dependency audit ==="
            pip install pip-audit 2>/dev/null || true
            if ! pip-audit --requirement requirements.txt 2>&1; then
              AUDIT_FAIL=true
              echo "::error::pip-audit found vulnerabilities in changed Python dependencies"
            fi
          else
            echo "Python dependency files unchanged — skipping pip-audit"
          fi

          if [ "$JS_DEPS_CHANGED" = "true" ]; then
            echo "=== JS dependency audit ==="
            if [ -f package.json ]; then
              if ! npm audit --audit-level=high 2>&1; then
                AUDIT_FAIL=true
                echo "::error::npm audit found high-severity issues in changed JS dependencies"
              fi
            fi
          else
            echo "JS dependency files unchanged — skipping npm audit"
          fi

          if [ "$AUDIT_FAIL" = "true" ]; then
            echo "depaudit_result=fail" >> "$GITHUB_OUTPUT"
            exit 1
          else
            echo "depaudit_result=pass" >> "$GITHUB_OUTPUT"
          fi

      # ── Test Suite (full scope only) ──
      - name: Run Test Suite
        if: steps.scope.outputs.scope == 'full'
        id: pytest
        run: |
          set +e
          pytest --cov=scripts --cov=misakanet --cov-report=term --cov-report=xml --cov-fail-under=20 \
            --ignore=tests/test_voice_hooks.py \
            --ignore=tests/test_voice_prompts.py \
            --ignore=tests/test_benchmark_fixtures.py \
            --ignore=tests/test_phase_b_orchestrator.py \
            --ignore=tests/test_queue_lesson_dry_run.py \
            --ignore=tests/test_ci_self_heal.py \
            --ignore=tests/test_evidence_levels.py \
            --ignore=tests/test_intake_spam_guard.py \
            tests/ 2>&1 | tee pytest_report.txt
          PYTEST_EXIT=${PIPESTATUS[0]}
          echo "pytest_exit=$PYTEST_EXIT"
          exit $PYTEST_EXIT
        continue-on-error: true

      - name: Upload Coverage to Codecov
        if: steps.scope.outputs.scope == 'full'
        uses: codecov/codecov-action@v7
        with:
          files: ./coverage.xml
          fail_ci_if_error: false

      - name: Parse Coverage
        if: steps.scope.outputs.scope == 'full'
        id: coverage
        run: |
          coverage=$(grep -oP 'TOTAL\s+\d+\s+\d+\s+\K\d+(?=%)' pytest_report.txt || echo "0")
          echo "rate=$coverage" >> "$GITHUB_OUTPUT"
          echo "Coverage: ${coverage}%"
          OUTCOME="${{ steps.pytest.outcome }}"
          if [ "$OUTCOME" = "success" ]; then
            RESULT="PASS"
          else
            RESULT="FAIL"
          fi
          printf '## Test Suite\n\n| Metric | Value |\n|--------|-------|\n| Outcome | %s |\n| Coverage | %s%% |\n\n' "${RESULT}" "${coverage}" >> "$GITHUB_STEP_SUMMARY"

      # ── Type Checking (full scope only) ──
      - name: Type Check (mypy)
        if: steps.scope.outputs.scope == 'full'
        id: mypy
        continue-on-error: true
        run: |
          pip install mypy
          mypy misakanet/ --ignore-missing-imports 2>&1 | tee mypy_report.txt
          MYPY_EXIT=${PIPESTATUS[0]}
          echo "mypy_exit=$MYPY_EXIT" >> "$GITHUB_OUTPUT"
          if [ "$MYPY_EXIT" -eq 0 ]; then
            echo "✅ mypy passed"
          else
            echo "⚠️ mypy found issues (non-blocking)"
          fi

      # ── Lesson Schema Validation (all PRs) ──
      - name: Validate Lesson Schema
        id: schema
        continue-on-error: true
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            BASE_SHA="${{ github.event.pull_request.base.sha }}"
            HEAD_SHA="${{ github.event.pull_request.head.sha }}"
            mapfile -t TARGETS < <(git diff --name-only "$BASE_SHA" "$HEAD_SHA" -- 'lessons/**/*.md' 'lessons/*.md')
          else
            mapfile -t TARGETS < <(find lessons -name '*.md' 2>/dev/null | sort)
          fi

          RESULT=pass
          if [ "${#TARGETS[@]}" -eq 0 ]; then
            echo "No changed lesson markdown files."
          else
            for target in "${TARGETS[@]}"; do
              [ -f "$target" ] || continue
              if ! python3 scripts/validate_lessons.py "$target"; then
                RESULT=fail
              fi
            done
          fi

          if [ "$RESULT" = "pass" ]; then
            echo "schema_result=pass" >> "$GITHUB_OUTPUT"
          else
            echo "schema_result=fail" >> "$GITHUB_OUTPUT"
            echo "⚠️ Schema validation produced warnings or errors" >> "$GITHUB_STEP_SUMMARY"
          fi

      # ── Lesson Count Consistency Check ──
      - name: Lesson Count Check
        if: steps.scope.outputs.scope == 'full'
        run: |
          echo "=== Lesson Count Consistency ==="
          # Count actual lesson files (excluding README, TEMPLATE, etc.)
          ACTUAL=$(find lessons/core lessons/contrib -name "*.md" \
            ! -name "README.md" \
            ! -name "TEMPLATE.md" \
            ! -name "LESSON_QUALITY_SCORING.md" \
            | wc -l)
          # Count entries in lessons.json
          JSON_COUNT=$(python3 -c "import json; print(len(json.load(open('data/lessons.json', encoding='utf-8'))))")
          echo "Actual .md files: $ACTUAL"
          echo "lessons.json entries: $JSON_COUNT"
          if [ "$ACTUAL" -ne "$JSON_COUNT" ]; then
            echo "::warning::Lesson count mismatch: actual=$ACTUAL, lessons.json=$JSON_COUNT"
          fi
          echo "✅ Lesson count: $ACTUAL files, $JSON_COUNT indexed"

      # ── Audit Report (all PRs) ──
      - name: Post Audit Report
        if: always()
        env:
          GH_TOKEN: ${{ secrets.SHELDON_PAT || secrets.GITHUB_TOKEN }}
        run: |
          SCOPE="${{ steps.scope.outputs.scope }}"
          OUTCOME="${{ steps.pytest.outcome }}"
          COVERAGE="${{ steps.coverage.outputs.rate }}"
          SUSPICIOUS="${{ steps.prsize.outputs.suspicious }}"
          SIZE_NOTES="${{ steps.prsize.outputs.notes }}"
          SCORE="${{ steps.score.outputs.score }}"
          REASONS="${{ steps.score.outputs.reasons }}"
          DCO_RESULT="${{ steps.dco.outputs.dco-passed }}"
          DCO_FAILED="${{ steps.dco.outputs.failed-count }}"
          SCHEMA="${{ steps.schema.outputs.schema_result }}"
          SECRETS="${{ steps.secrets.outputs.secrets_result }}"
          DEPAUDIT="${{ steps.depaudit.outputs.depaudit_result }}"
          PR_NUM="${{ github.event.inputs.pr_number || github.event.pull_request.number }}"
          SHA="${{ github.event.pull_request.head.sha || 'manual' }}"
          SHA_SHORT=$(echo "$SHA" | cut -c1-7)

          # ── Build report ──
          REPORT="## 🧾 Audit Report — PR #${PR_NUM} (${SHA_SHORT})"

          if [ "$SCOPE" = "lessons-only" ]; then
            REPORT+=$'\n\n'
            REPORT+="> 📚 **Lessons-only PR** — skipped: quality score, PR size, dependency audit, test suite"
          elif [ "$SCOPE" = "ci-only" ]; then
            REPORT+=$'\n\n'
            REPORT+="> ⚙️ **CI-only PR** — skipped Python/JS dependency audit and test suite; DCO + schema still run."
          elif [ "$SCOPE" = "js-deps-only" ]; then
            REPORT+=$'\n\n'
            REPORT+="> 📦 **JS dependency-only PR** — runs JS dependency audit; skips unrelated Python tests."
          fi
          REPORT+=$'\n\n'


          # 1. Quality Score (full scope only)
          if [ "$SCOPE" = "full" ]; then
            REPORT+="### 📊 Quality Score"
            REPORT+=$'\n\n'
            if [ -z "$SCORE" ]; then
              REPORT+="⚠️ Quality score unavailable; continuing with hard gates."
            elif [ -n "$REASONS" ]; then
              REPORT+="Score: ${SCORE}/100"
              REPORT+=$'\n\n'
              REPORT+="**Deductions:**"
              REPORT+=$'\n'
              echo "$REASONS" | while IFS= read -r line; do
                [ -n "$line" ] && REPORT+="- ${line}"$'\n'
              done
            else
              REPORT+="Score: ${SCORE}/100 — no deductions."
            fi
            REPORT+=$'\n\n'
          fi

          # 2. DCO Audit
          REPORT+="### 🔏 DCO Audit"
          REPORT+=$'\n\n'
          if [ "$DCO_RESULT" = "true" ]; then
            REPORT+="✅ All commits signed-off."
          else
            REPORT+="❌ **${DCO_FAILED} commit(s)** missing Signed-off-by."
          fi
          REPORT+=$'\n\n'

          # 3. PR Size (full scope only)
          if [ "$SCOPE" = "full" ]; then
            REPORT+="### 📏 PR Size"
            REPORT+=$'\n\n'
            REPORT+="| Metric | Value |"
            REPORT+=$'\n'
            REPORT+="|--------|-------|"
            REPORT+=$'\n'
            REPORT+="| Files Changed | ${{ github.event.pull_request.changed_files }} |"
            REPORT+=$'\n'
            REPORT+="| Lines Added | ${{ github.event.pull_request.additions }} |"
            REPORT+=$'\n'
            if [ "$SUSPICIOUS" = "true" ]; then
              REPORT+="| ⚠️ Warning | ${SIZE_NOTES} |"
            fi
            REPORT+=$'\n\n'
          fi

          # 4. Secret Scan (full scope only)
          if [ "$SCOPE" = "full" ]; then
            REPORT+="### 🔐 Secret Scan"
            REPORT+=$'\n\n'
            if [ "$SECRETS" = "pass" ]; then
              REPORT+="✅ No hardcoded secrets detected."
            elif [ "$SECRETS" = "fail" ]; then
              REPORT+="❌ **Hardcoded secrets found** — merge blocked."
            else
              REPORT+="⏭️ Skipped."
            fi
            REPORT+=$'\n\n'
          fi

          # 5. Dependency Audit (dependency scopes only)
          if [ "$SCOPE" = "full" ] || [ "$SCOPE" = "js-deps-only" ]; then
            REPORT+="### 📦 Dependency Audit"
            REPORT+=$'\n\n'
            if [ "$DEPAUDIT" = "pass" ]; then
              REPORT+="✅ No known vulnerabilities in changed dependency ecosystem(s)."
            elif [ "$DEPAUDIT" = "fail" ]; then
              REPORT+="❌ **Vulnerabilities found in changed dependencies** — merge blocked."
            else
              REPORT+="⏭️ Skipped; no Python/JS dependency files changed."
            fi
            REPORT+=$'\n\n'
          fi

          # 6. Test Suite (full scope only)
          if [ "$SCOPE" = "full" ]; then
            REPORT+="### 🧪 Test Suite"
            REPORT+=$'\n\n'
            if [ "$OUTCOME" = "success" ]; then
              REPORT+="✅ **PASS** — ${COVERAGE}% coverage"
            else
              REPORT+="❌ **FAIL** — tests have failures"
              if [ -n "$COVERAGE" ]; then
                REPORT+=" (${COVERAGE}% coverage)"
              fi
            fi
            REPORT+=$'\n\n'
          fi

          # 7. Schema Validation
          REPORT+="### 📋 Lesson Schema"
          REPORT+=$'\n\n'
          if [ "$SCHEMA" = "pass" ]; then
            REPORT+="✅ All lessons valid."
          elif [ "$SCHEMA" = "fail" ]; then
            REPORT+="⚠️ Schema validation produced warnings."
          else
            REPORT+="⏭️ Skipped (no lessons changed)."
          fi
          REPORT+=$'\n\n'

          # 8. Verdict
          REPORT+="### ⚖️ Verdict"
          REPORT+=$'\n\n'
          VERDICT_PASS=true

          if [ "$DCO_RESULT" != "true" ]; then
            REPORT+="❌ DCO audit failed."$'\n'
            VERDICT_PASS=false
          fi

          if [ "$SCOPE" = "js-deps-only" ] && [ "$DEPAUDIT" = "fail" ]; then
            REPORT+="❌ Dependency audit found vulnerabilities in changed JS dependencies."$'\n'
            VERDICT_PASS=false
          fi

          if [ "$SCOPE" = "full" ]; then
            if [ -n "$SCORE" ] && [ "$SCORE" -lt 40 ] 2>/dev/null; then
              REPORT+="❌ Quality Score ${SCORE}/40 below threshold."$'\n'
              VERDICT_PASS=false
            fi
            if [ "$SECRETS" = "fail" ]; then
              REPORT+="❌ Secret scan found hardcoded secrets."$'\n'
              VERDICT_PASS=false
            fi
            if [ "$DEPAUDIT" = "fail" ]; then
              REPORT+="❌ Dependency audit found vulnerabilities."$'\n'
              VERDICT_PASS=false
            fi
            if [ "$OUTCOME" != "success" ]; then
              REPORT+="❌ Test suite failed."$'\n'
              VERDICT_PASS=false
            fi
          fi

          if [ "$SCHEMA" = "fail" ]; then
            REPORT+="❌ Lesson schema validation failed."$'\n'
            VERDICT_PASS=false
          fi

          if [ "$VERDICT_PASS" = "true" ]; then
            if [ "$SCOPE" = "lessons-only" ]; then
              REPORT+="✅ DCO + schema passed. Ready for merge."
            elif [ "$SCOPE" = "ci-only" ]; then
              REPORT+="✅ CI-only gates passed. Ready for merge."
            elif [ "$SCOPE" = "js-deps-only" ]; then
              REPORT+="✅ JS dependency audit + DCO + schema passed. Ready for merge."
            else
              REPORT+="✅ All gates passed. Ready for merge."
            fi
          fi
          REPORT+=$'\n\n---\n'
          REPORT+="_Scope: \`${SCOPE}\` | Triggered by \`${SHA_SHORT}\` | [View run](https://github.com/Ikalus1988/MisakaNet/actions/runs/${{ github.run_id }})_"

          # ── Post comment ──
          if [ -n "$PR_NUM" ]; then
            gh pr comment "$PR_NUM" --repo Ikalus1988/MisakaNet --body "$REPORT" 2>/dev/null || \
              gh issue comment "$PR_NUM" --repo Ikalus1988/MisakaNet --body "$REPORT" 2>/dev/null || \
              echo "::warning::Could not post comment to PR #$PR_NUM"
          fi

          # ── Exit with failure if any hard gate fails ──
          if [ "$SCOPE" = "full" ] && [ "$SECRETS" = "fail" ]; then
            echo "Audit failed: hardcoded secrets detected."
            exit 1
          fi
          # Note: dep audit blocking is handled in the dep audit step itself
          # (only blocks when dependency files actually changed)
          if [ "$SCOPE" = "full" ] && [ "$OUTCOME" != "success" ]; then
            echo "Audit failed: test suite has issues."
            exit 1
          fi
          if [ "$DCO_RESULT" != "true" ]; then
            echo "Audit failed: DCO violations."
            exit 1
          fi
          if [ "$SCHEMA" = "fail" ]; then
            echo "Audit failed: lesson schema validation failed."
            exit 1
          fi

      # ── Auto-Merge Gate (all PRs) ──
      - name: Auto-Merge Gate
        if: success() && github.event_name == 'pull_request'
        env:
          GH_TOKEN: ${{ secrets.SHELDON_PAT || secrets.GITHUB_TOKEN }}
          PR_NUM: ${{ github.event.pull_request.number }}
          PR_TITLE: ${{ github.event.pull_request.title }}
        run: |
          echo "=== Auto-Merge Gate for PR #$PR_NUM ==="

          if [ -z "$GH_TOKEN" ] || [ "$GH_TOKEN" = "" ]; then
            echo "  SKIP: GH_TOKEN not available for fork PR"
            exit 0
          fi

          MERGEABLE=$(gh api repos/Ikalus1988/MisakaNet/pulls/$PR_NUM --jq '.mergeable')
          echo "Mergeable: $MERGEABLE"
          [ "$MERGEABLE" != "MERGEABLE" ] && { echo "Not mergeable. Skipping."; exit 0; }

          # Security gate (2026-08-30): lessons/ changes must never auto-merge.
          # Lesson content is executed by agents; auto-merging attacker-authored
          # lesson files (e.g. from auto-generated intake PRs) is a poisoning
          # vector. Any PR touching lessons/ requires human merge.
          CHANGED_LESSONS=$(gh pr diff "$PR_NUM" --repo Ikalus1988/MisakaNet --name-only 2>/dev/null \
            | grep -c "^lessons/" || true)
          echo "Changed lesson files: $CHANGED_LESSONS"
          [ "$CHANGED_LESSONS" -gt 0 ] && { echo "PR touches lessons/ — human merge required. Skipping auto-merge."; exit 0; }

          BODY=$(gh api repos/Ikalus1988/MisakaNet/pulls/$PR_NUM --jq '.body')
          UNCHECKED=$(echo "$BODY" | grep -c "\[ \]" || true)
          echo "Unchecked AC items: $UNCHECKED"
          [ "$UNCHECKED" -gt 0 ] && { echo "AC not all checked. Skipping."; exit 0; }

          gh pr merge "$PR_NUM" --repo Ikalus1988/MisakaNet --merge --auto \
            --subject "Auto-merge #$PR_NUM: $PR_TITLE"
          echo "Auto-merge enabled for PR #$PR_NUM"