name: Governed runtime contract

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  contract:
    runs-on: self-hosted
    steps:
      # The Railiance host runner does not support actions/checkout. Clone the
      # exact pushed revision and the source revisions declared by the lock.
      - name: Verify pinned cross-package runtime
        env:
          FORGE_BASE: ${{ github.server_url }}
          REPO_NAME: ${{ github.repository }}
          REPO_SHA: ${{ github.sha }}
          UV_VERSION: "0.8.0"
          UV_X86_64_SHA256: "0208cbcb3850bfc69277c9a16c2b0399218b075dc923aca7e4b576ee4228c570"
        run: |
          set -eu
          work_dir="$(mktemp -d /tmp/rein-contract.XXXXXX)"
          trap 'rm -rf "${work_dir}"' EXIT

          download() {
            if command -v curl >/dev/null 2>&1; then
              curl -fsSL "$1" -o "$2"
            elif command -v wget >/dev/null 2>&1; then
              wget -qO "$2" "$1"
            else
              echo "curl or wget is required to bootstrap uv" >&2
              return 1
            fi
          }

          case "$(uname -m)" in
            x86_64|amd64) uv_target="x86_64-unknown-linux-musl" ;;
            *) echo "unsupported contract-runner architecture: $(uname -m)" >&2; exit 1 ;;
          esac
          uv_archive="${work_dir}/uv.tar.gz"
          download \
            "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-${uv_target}.tar.gz" \
            "${uv_archive}"
          printf '%s  %s\n' "${UV_X86_64_SHA256}" "${uv_archive}" | sha256sum -c -
          tar -xzf "${uv_archive}" -C "${work_dir}"
          uv_bin="${work_dir}/uv-${uv_target}/uv"
          export UV_CACHE_DIR="${work_dir}/uv-cache"
          export UV_PYTHON_INSTALL_DIR="${work_dir}/uv-python"
          "${uv_bin}" python install 3.12
          python_bin="$("${uv_bin}" python find 3.12)"

          git clone "${FORGE_BASE}/${REPO_NAME}.git" "${work_dir}/rein-aharness"
          git -C "${work_dir}/rein-aharness" checkout --detach "${REPO_SHA}"

          lock="${work_dir}/rein-aharness/deploy/runtime-contract-lock.json"
          llm_sha="$("${python_bin}" -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "llm-connect"))' "${lock}")"
          glas_sha="$("${python_bin}" -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "glas-harness"))' "${lock}")"
          sandbox_sha="$("${python_bin}" -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "sandboxer"))' "${lock}")"

          git clone "${FORGE_BASE}/coulomb/llm-connect.git" "${work_dir}/llm-connect"
          git -C "${work_dir}/llm-connect" checkout --detach "${llm_sha}"
          git clone "${FORGE_BASE}/coulomb/glas-harness.git" "${work_dir}/glas-harness"
          git -C "${work_dir}/glas-harness" checkout --detach "${glas_sha}"
          git clone "${FORGE_BASE}/coulomb/sand-boxer.git" "${work_dir}/sand-boxer"
          git -C "${work_dir}/sand-boxer" checkout --detach "${sandbox_sha}"

          cd "${work_dir}/rein-aharness"
          "${uv_bin}" sync --python "${python_bin}" --frozen --no-editable --extra glas --extra llm --extra dev
          ./scripts/verify-runtime-contracts.sh