# .github/workflows/verify-phase-4.yml
# Source: Phase 4 SRV-01..14 composite verify gate.
# Triggered on changes to Phase 4 artifacts; runs `pnpm verify:phase-4`.
#
# Canonical gate runs on ubuntu-latest — that is the determinism reference
# platform. Per Phase 3 plan 03-09 SUMMARY: Windows local execution surfaces
# spurious drift due to `core.autocrlf=true` interaction with verify gates;
# CI on Linux is the source of truth for "green".

name: verify-phase-4

on:
  push:
    branches: [main]
    paths:
      - 'apps/**'
      - 'packages/**'
      - 'tools/room-converter/**'
      - 'tools/scripts/**'
      - 'docs/adr/0004-*.md'
      - 'pnpm-workspace.yaml'
      - 'package.json'
      - 'scripts/verify-phase-4.mjs'
      - 'scripts/verify-phase-4.test.mjs'
      - '.github/workflows/verify-phase-4.yml'
  pull_request:
    paths:
      - 'apps/**'
      - 'packages/**'
      - 'tools/room-converter/**'
      - 'tools/scripts/**'
      - 'docs/adr/0004-*.md'
      - 'pnpm-workspace.yaml'
      - 'package.json'
      - 'scripts/verify-phase-4.mjs'

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: 10
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: 'pnpm'

      # Single root-level install — workspace handles fan-out
      - name: Install workspace
        run: pnpm install --frozen-lockfile

      # Composite verify gate
      - name: pnpm verify:phase-4
        run: pnpm verify:phase-4

      # Post-condition: zero git diff (deterministic regen)
      - name: Confirm no drift after verify
        run: |
          git diff --exit-code docs/extracted-server/ packages/db/migrations/
