# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
name: Governance

on:
  push:
    branches: [main, master]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

# Self-contained execution of the shared estate governance policies pinned to
# metadatastician/standards@8e48b1caade08a552646adeab66558ac43b4360d
# (replacing the retired runtime-policy.yml workflow per PR #244).
jobs:
  governance:
    name: Estate Governance Policy
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read
    env:
      STANDARDS_PIN: '8e48b1caade08a552646adeab66558ac43b4360d'
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Checkout pinned standards policy scripts
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: metadatastician/standards
          ref: 8e48b1caade08a552646adeab66558ac43b4360d
          path: .standards-checkout
          sparse-checkout: |
            scripts
            0-canon
          sparse-checkout-cone-mode: true
          persist-credentials: false

      - name: Enforce TypeScript and npm/yarn runtime policy
        run: |
          set -euo pipefail
          if [ -f .standards-checkout/scripts/check-ts-allowlist.sh ]; then
            bash .standards-checkout/scripts/check-ts-allowlist.sh
          fi
          rm -rf .standards-checkout

          bad_ts="$(git ls-files '*.ts' '*.tsx' | grep -vE '^(archetypes/|templates/|tests/fixtures/)' || true)"
          if [ -n "$bad_ts" ]; then
            echo "::error::Unallowlisted TypeScript files detected:"
            printf '%s\n' "$bad_ts"
            exit 1
          fi

          bad_locks="$(git ls-files 'package-lock.json' '**/package-lock.json' 'yarn.lock' '**/yarn.lock' 'pnpm-lock.yaml' '**/pnpm-lock.yaml' || true)"
          if [ -n "$bad_locks" ]; then
            echo "::error::Banned npm/yarn/pnpm lockfiles detected (use Deno or Bun per LANGUAGE-POLICY):"
            printf '%s\n' "$bad_locks"
            exit 1
          fi

          if [ -f tsconfig.json ] || [ -f Makefile ] || [ -f GNUmakefile ]; then
            echo "::error::Banned root config (tsconfig.json / Makefile) detected"
            exit 1
          fi
          echo "Governance runtime and language anti-pattern checks passed."