name: Cloud readiness
run-name: Cloud readiness ${{ github.sha }}

on:
  push:
    branches: [master]
  workflow_dispatch:

permissions: {}

# Source verification stays independent of npm publication and image builds.
concurrency:
  group: cloud-readiness-${{ github.sha }}
  cancel-in-progress: false

jobs:
  admission:
    name: Cloud candidate admission v1
    if: github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master'
    runs-on: ${{ vars.AWS_POST_MERGE_CI_ENABLED == 'true' && github.run_attempt >= 1 && github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && 'runs-on/fleet=paperclip-post-merge-x64/env=public-ci' || 'ubuntu-latest' }}
    timeout-minutes: 5
    permissions:
      contents: read
      actions: read
    outputs:
      admitted: ${{ steps.admission.outputs.admitted }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
          sparse-checkout: scripts
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
          node-version: 24
      - id: admission
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: node scripts/cloud-release-admission.mjs

  verify:
    needs: admission
    if: github.repository == 'paperclipai/paperclip' && github.ref == 'refs/heads/master' && needs.admission.outputs.admitted == 'true'
    permissions:
      contents: read
    uses: ./.github/workflows/release-verify.yml
    with:
      ref: ${{ github.sha }}

  source_verified:
    # npm canary publication reuses this exact-source verification proof.
    # Keep it independent of image/migrator availability, and fail closed when
    # any source check fails, is cancelled, or is skipped.
    name: Cloud source verified v1
    needs: [verify]
    if: github.repository == 'paperclipai/paperclip' && github.ref == 'refs/heads/master'
    # Keep the final proof off the shared hosted queue too. The protected
    # fleet has a separate job ceiling and launches Spot workers on demand.
    runs-on: ${{ vars.AWS_POST_MERGE_CI_ENABLED == 'true' && github.run_attempt >= 1 && github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && 'runs-on/fleet=paperclip-post-merge-x64/env=public-ci' || 'ubuntu-latest' }}
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24
      - name: Check the source verification consumer
        run: node --test scripts/cloud-source-verification.test.mjs
      - name: Record source verification
        env:
          SOURCE_SHA: ${{ github.sha }}
        run: |
          echo "Cloud source verified v1: $SOURCE_SHA" >> "$GITHUB_STEP_SUMMARY"