pr-checks.yml

name: Misaka Network Agent Auditor

on:
  pull_request:
    types: [opened, synchronize, reopened]
  workflow_dispatch:
    inputs:
      pr_number:
        description: "PR number to audit"
        required: false
        type: string

jobs:
  audit:
    permissions:
      contents: read
      issues: write
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"
          cache: pip

      - name: Install Dependencies
        run: |
          pip install -r requirements.txt 2>/dev/null || true
          find . -path ./venv -prune -o -name "requirements.txt" \
            -exec pip install -r {} \; 2>/dev/null || true
          pip install pytest pytest-cov
          echo "PYTHONPATH=$(pwd):$PYTHONPATH" >> "$GITHUB_ENV"

      # ── Quality Score Gate ──
      - name: Agent Quality Score
        id: score
        uses: ./.github/actions/score-agent
        with:
          pr-number: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
          repo: "Ikalus1988/MisakaNet"
          threshold: "40"
          gh-token: ${{ secrets.SHELDON_PAT || secrets.GITHUB_TOKEN }}

      - name: Reject Low-Quality PR
        if: steps.score.outputs.verdict == 'fail'
        env:
          GH_TOKEN: ${{ secrets.SHELDON_PAT || secrets.GITHUB_TOKEN }}
        run: |
          PR_NUM="${{ github.event.pull_request.number }}"
          echo "=== Low-Quality PR #$PR_NUM Rejected ==="
          echo "Score: ${{ steps.score.outputs.score }}/100"
          gh pr close "$PR_NUM" --repo Ikalus1988/MisakaNet \
            --comment "### Quality Score Failed

          Your PR scored ${{ steps.score.outputs.score }}/100 (minimum: 40).

          Issues detected:
          ${{ steps.score.outputs.reasons }}

          Please clean up formatting noise and resubmit."
          exit 1

      # ── DCO Audit Gate ──
      - name: DCO Audit
        id: dco
        uses: Ikalus1988/dco-audit@v1
        with:
          base-sha: ${{ github.event.pull_request.base.sha }}
          head-sha: ${{ github.event.pull_request.head.sha }}
          token: ${{ secrets.SHELDON_PAT || secrets.GITHUB_TOKEN }}
          repo: "Ikalus1988/MisakaNet"
          pr-number: ${{ github.event.pull_request.number || '' }}

      - name: Fail on DCO Violation
        if: steps.dco.outputs.dco-passed == 'false'
        run: |
          echo "DCO check failed: ${{ steps.dco.outputs.failed-count }} commit(s) without sign-off."
          exit 1

      # ── PR Size Check ──
      - name: Check PR Size
        id: prsize
        run: |
          CHANGED=${{ github.event.pull_request.changed_files || 0 }}
          ADDITIONS=${{ github.event.pull_request.additions || 0 }}
          SUSPICIOUS=false
          NOTES=""
          if [ "$CHANGED" -gt 10 ]; then
            SUSPICIOUS=true
            NOTES="Warn ${CHANGED} files changed (threshold: 10)"
          fi
          if [ "$ADDITIONS" -gt 500 ]; then
            SUSPICIOUS=true
            NOTES="${NOTES}; ${ADDITIONS} lines added (threshold: 500)"
          fi
          echo "suspicious=${SUSPICIOUS}" >> "$GITHUB_OUTPUT"
          echo "notes=${NOTES}" >> "$GITHUB_OUTPUT"
          printf '## PR Size Check\n\n| Metric | Value |\n|--------|-------|\n| Files Changed | %s |\n| Lines Added | %s |\n| Suspicious | %s |\n\n' "${CHANGED}" "${ADDITIONS}" "${SUSPICIOUS}" >> "$GITHUB_STEP_SUMMARY"

      # ── Test Suite ──
      - name: Run Test Suite
        id: pytest
        run: |
          pytest --cov=scripts --cov=misakanet --cov-report=term --cov-fail-under=20 tests/ > pytest_report.txt 2>&1 || true
          cat pytest_report.txt
        continue-on-error: true

      - name: Parse Coverage
        id: coverage
        run: |
          coverage=$(grep -oP 'TOTAL\s+\d+\s+\d+\s+\K\d+(?=%)' pytest_report.txt || echo "0")
          echo "rate=$coverage" >> "$GITHUB_OUTPUT"
          echo "Coverage: ${coverage}%"
          OUTCOME="${{ steps.pytest.outcome }}"
          if [ "$OUTCOME" = "success" ]; then
            RESULT="PASS"
          else
            RESULT="FAIL"
          fi
          printf '## Test Suite\n\n| Metric | Value |\n|--------|-------|\n| Outcome | %s |\n| Coverage | %s%% |\n\n' "${RESULT}" "${coverage}" >> "$GITHUB_STEP_SUMMARY"

      # ── Lesson Schema Validation ──
      - name: Validate Lesson Schema
        id: schema
        continue-on-error: true
        run: |
          python3 scripts/validate_lessons.py 2>&1 || echo "schema_result=warnings" >> "$GITHUB_OUTPUT"
          echo "schema_result=pass" >> "$GITHUB_OUTPUT"

      # ── Audit Report ──
      - name: Post Audit Report
        if: always()
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          OUTCOME="${{ steps.pytest.outcome }}"
          COVERAGE="${{ steps.coverage.outputs.rate }}"
          SUSPICIOUS="${{ steps.prsize.outputs.suspicious }}"
          SIZE_NOTES="${{ steps.prsize.outputs.notes }}"
          SCORE="${{ steps.score.outputs.score }}"
          REASONS="${{ steps.score.outputs.reasons }}"
          DCO_RESULT="${{ steps.dco.outputs.dco-passed }}"
          DCO_FAILED="${{ steps.dco.outputs.failed-count }}"
          PR_NUM="${{ github.event.inputs.pr_number || github.event.pull_request.number }}"
          SHA="${{ github.event.pull_request.head.sha || 'manual' }}"
          SHA_SHORT=$(echo "$SHA" | cut -c1-7)

          # ── Build report ──
          REPORT="## 🧾 Audit Report — PR #${PR_NUM} (${SHA_SHORT})"
          REPORT+=$'\n\n'

          # 1. Quality Score
          REPORT+="### 📊 Quality Score: ${SCORE:-?}/100"
          REPORT+=$'\n\n'
          if [ -n "$REASONS" ]; then
            REPORT+="**Deductions:**"
            REPORT+=$'\n'
            echo "$REASONS" | while IFS= read -r line; do
              [ -n "$line" ] && REPORT+="- ${line}"$'\n'
            done
          else
            REPORT+="No deductions."
          fi
          REPORT+=$'\n\n'

          # 2. DCO Audit
          REPORT+="### 🔏 DCO Audit"
          REPORT+=$'\n\n'
          if [ "$DCO_RESULT" = "true" ]; then
            REPORT+="✅ All commits signed-off."
          else
            REPORT+="❌ **${DCO_FAILED} commit(s)** missing Signed-off-by."
          fi
          REPORT+=$'\n\n'

          # 3. PR Size
          REPORT+="### 📏 PR Size"
          REPORT+=$'\n\n'
          REPORT+="| Metric | Value |"
          REPORT+=$'\n'
          REPORT+="|--------|-------|"
          REPORT+=$'\n'
          REPORT+="| Files Changed | ${{ github.event.pull_request.changed_files }} |"
          REPORT+=$'\n'
          REPORT+="| Lines Added | ${{ github.event.pull_request.additions }} |"
          REPORT+=$'\n'
          if [ "$SUSPICIOUS" = "true" ]; then
            REPORT+="| ⚠️ Warning | ${SIZE_NOTES} |"
          fi
          REPORT+=$'\n\n'

          # 4. Test Suite
          REPORT+="### 🧪 Test Suite"
          REPORT+=$'\n\n'
          if [ "$OUTCOME" = "success" ]; then
            REPORT+="✅ **PASS** — ${COVERAGE}% coverage"
          else
            REPORT+="❌ **FAIL** — tests have failures"
            if [ -n "$COVERAGE" ]; then
              REPORT+=" (${COVERAGE}% coverage)"
            fi
          fi
          REPORT+=$'\n\n'

          # 5. Verdict
          REPORT+="### ⚖️ Verdict"
          REPORT+=$'\n\n'
          VERDICT_PASS=true
          if [ "$SCORE" -lt 40 ] 2>/dev/null; then
            REPORT+="❌ Quality Score ${SCORE}/40 below threshold."$'\n'
            VERDICT_PASS=false
          fi
          if [ "$DCO_RESULT" != "true" ]; then
            REPORT+="❌ DCO audit failed."$'\n'
            VERDICT_PASS=false
          fi
          if [ "$OUTCOME" != "success" ]; then
            REPORT+="❌ Test suite failed."$'\n'
            VERDICT_PASS=false
          fi
          if [ "$VERDICT_PASS" = "true" ]; then
            REPORT+="✅ All gates passed. Ready for merge."
          fi
          REPORT+=$'\n\n---\n'
          REPORT+="_Triggered by \`${SHA_SHORT}\` | [View run](https://github.com/Ikalus1988/MisakaNet/actions/runs/${{ github.run_id }})_"

          # ── Post comment ──
          if [ -n "$PR_NUM" ]; then
            gh pr comment "$PR_NUM" --repo Ikalus1988/MisakaNet --body "$REPORT" 2>/dev/null || \
              gh issue comment "$PR_NUM" --repo Ikalus1988/MisakaNet --body "$REPORT" 2>/dev/null || \
              echo "Could not post comment to PR #$PR_NUM"
          fi

          # ── Exit with failure if any hard gate fails ──
          if [ "$OUTCOME" != "success" ]; then
            echo "Audit failed: test suite has issues."
            exit 1
          fi

      # ── Auto-Merge Gate ──
      - name: Auto-Merge Gate
        if: success() && github.event_name == 'pull_request'
        env:
          GH_TOKEN: ${{ secrets.SHELDON_PAT || secrets.GITHUB_TOKEN }}
        run: |
          PR_NUM="${{ github.event.pull_request.number }}"
          echo "=== Auto-Merge Gate for PR #$PR_NUM ==="

          if [ -z "$GH_TOKEN" ] || [ "$GH_TOKEN" = "" ]; then
            echo "  SKIP: GH_TOKEN not available for fork PR"
            exit 0
          fi

          MERGEABLE=$(gh api repos/Ikalus1988/MisakaNet/pulls/$PR_NUM --jq '.mergeable')
          echo "Mergeable: $MERGEABLE"
          [ "$MERGEABLE" != "MERGEABLE" ] && { echo "Not mergeable. Skipping."; exit 0; }

          BODY=$(gh api repos/Ikalus1988/MisakaNet/pulls/$PR_NUM --jq '.body')
          UNCHECKED=$(echo "$BODY" | grep -c "\[ \]" || true)
          echo "Unchecked AC items: $UNCHECKED"
          [ "$UNCHECKED" -gt 0 ] && { echo "AC not all checked. Skipping."; exit 0; }

          gh pr merge "$PR_NUM" --repo Ikalus1988/MisakaNet --merge --auto \
            --subject "Auto-merge #$PR_NUM: ${{ github.event.pull_request.title }}"
          echo "Auto-merge enabled for PR #$PR_NUM"