name: Verify Data Plane

on:
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: data-plane-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  gateway:
    runs-on: ubuntu-latest-on-demand-xhigh-performance
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version: "1.26.5"
          cache: true
          cache-dependency-path: go.mod
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: "1.3.13"
      - name: Verify Go and OpenSpec
        run: make OPENSPEC='bunx --bun @fission-ai/openspec@1.5.0' verify
      - name: Build and inspect reproducible Linux gateway artifacts
        run: |
          make gateway-linux DIST_DIR=dist
          sha256sum dist/verse-gateway-linux-* | tee dist/SHA256SUMS
          file dist/verse-gateway-linux-* | tee dist/file.txt
          go version -m dist/verse-gateway-linux-amd64 > dist/go-version-amd64.txt
          go version -m dist/verse-gateway-linux-arm64 > dist/go-version-arm64.txt
          make gateway-sbom DIST_DIR=dist
      - uses: christopherhx/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7 # v4
        with:
          name: verse-gateway-linux-${{ gitea.sha }}
          path: dist/*
          if-no-files-found: error
          retention-days: 30
      - name: Verify clean checkout
        run: git diff --exit-code