name: Governed runtime contract

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  contract:
    runs-on: self-hosted
    steps:
      # The Railiance host runner does not support actions/checkout. Clone the
      # exact pushed revision and the source revisions declared by the lock.
      - name: Verify pinned cross-package runtime
        env:
          FORGE_BASE: ${{ github.server_url }}
          REPO_NAME: ${{ github.repository }}
          REPO_SHA: ${{ github.sha }}
        run: |
          set -eu
          work_dir="$(mktemp -d /tmp/rein-contract.XXXXXX)"
          trap 'rm -rf "${work_dir}"' EXIT

          git clone "${FORGE_BASE}/${REPO_NAME}.git" "${work_dir}/rein-aharness"
          git -C "${work_dir}/rein-aharness" checkout --detach "${REPO_SHA}"

          lock="${work_dir}/rein-aharness/deploy/runtime-contract-lock.json"
          llm_sha="$(python3 -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "llm-connect"))' "${lock}")"
          glas_sha="$(python3 -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "glas-harness"))' "${lock}")"
          sandbox_sha="$(python3 -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "sandboxer"))' "${lock}")"

          git clone "${FORGE_BASE}/coulomb/llm-connect.git" "${work_dir}/llm-connect"
          git -C "${work_dir}/llm-connect" checkout --detach "${llm_sha}"
          git clone "${FORGE_BASE}/coulomb/glas-harness.git" "${work_dir}/glas-harness"
          git -C "${work_dir}/glas-harness" checkout --detach "${glas_sha}"
          git clone "${FORGE_BASE}/coulomb/sand-boxer.git" "${work_dir}/sand-boxer"
          git -C "${work_dir}/sand-boxer" checkout --detach "${sandbox_sha}"

          cd "${work_dir}/rein-aharness"
          python3 -m venv .venv
          .venv/bin/pip install --disable-pip-version-check 'uv==0.8.0'
          .venv/bin/uv sync --frozen --no-editable --extra glas --extra llm --extra dev
          make contract-test