name: Mainnet Sovereign CI

on:
  pull_request:
    branches:
      - main
  workflow_dispatch:

env:
  BASE_RPC_URL: https://mainnet.base.org
  BASE_CHAIN_ID: "8453"

jobs:
  sovereign-stack:
    runs-on: ubuntu-latest
    timeout-minutes: 45

    steps:
      - uses: actions/checkout@v4

      - name: Use Node.js 18
        uses: actions/setup-node@v4
        with:
          node-version: 18

      - name: Install Node dependencies
        run: npm ci

      - name: Guardrails (no KYC / no surveillance)
        run: |
          npm run lint:guardrails
          npm run lint:values
          npm run lint:privileged-surface
          npm run lint:events-surface
          npm run lint:external-calls
          npm run lint:storage-growth

      - name: Run Jest with coverage gate
        env:
          VAULTFIRE_TEST_QUIET: "1"
        run: npm test

      - name: Hardhat unit tests
        run: npx hardhat test

      - name: Deploy smoke (local hardhat)
        run: npx hardhat run scripts/deploy-covenant.js
        env:
          GHOSTKEY_ECHO: "0xfA15Ee28939B222B0448261A22156070f0A7813C"

      - name: Setup Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Python dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt

      - name: Pytest Core Innovations (RBB + Thriving Bonds)
        run: pytest tests/rbb/ tests/thriving_bonds/ -v --tb=short

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.9.2

      - name: Terraform plan (informational)
        continue-on-error: true
        run: |
          cd infra
          set +e
          terraform init -backend=false -input=false
          if [ $? -ne 0 ]; then
            echo "::warning::Terraform init failed against the Base provider stub; skipping plan."
            exit 0
          fi
          terraform validate || echo "::warning::Terraform validate failed"
          terraform plan -lock=false -input=false || echo "::warning::Terraform plan failed"

      - name: Guardian echo smoke hook
        continue-on-error: true
        run: node tools/guardian_echo.js --dry-run
