name: Verify Frame Flow
on:
  push:
    # Branch verification gates releases; tags do not duplicate the same build.
    branches: ["**"]
  pull_request:
  workflow_dispatch:
jobs:
  verify:
    # The NAS Docker runner must never execute code from external forks.
    if: github.server_url != 'https://github.com' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
    runs-on: ubuntu-latest
    env:
      DOCKER_PIP_INDEX_URL: ${{ vars.DOCKER_PIP_INDEX_URL }}
      DOCKER_PIP_FALLBACK_INDEX_URL: ${{ vars.DOCKER_PIP_FALLBACK_INDEX_URL }}
      CI_PIP_INDEX_URL: ${{ vars.CI_PIP_INDEX_URL }}
      CI_PIP_FALLBACK_INDEX_URL: ${{ vars.CI_PIP_FALLBACK_INDEX_URL }}
      ALPINE_MIRROR: ${{ vars.ALPINE_MIRROR }}
    steps:
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: https://github.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: '3.14'
      - name: Install CI dependencies with index diagnostics and fallback
        run: python scripts/ci-install.py
      - run: python -m ruff check pigway_frame_flow tests scripts
      - run: python -m ruff format --check pigway_frame_flow tests scripts
      - run: python -m mypy pigway_frame_flow
      - run: python -m pytest -q
      - name: Complete vulnerability audit with bounded network retries
        run: python scripts/ci-audit.py
      - name: Isolated Docker build, smoke and restart verification
        run: |
          . ./deploy/build-cn.env
          python scripts/ci-compose-verify.py
      - name: Cleanup isolated Docker resources
        if: always()
        run: |
          if [ -n "${FRAME_FLOW_CI_COMPOSE:-}" ] && [ -f "$FRAME_FLOW_CI_COMPOSE" ]; then
            python scripts/ci-compose-verify.py --cleanup
          fi

# Production moved to Ubuntu Server. Release manually with scripts/server-release.py;
# the shared NAS runner performs isolated verification only.