nightly-gates.yml

# Nightly deep quality gates — long-running checks on the nightly toolchain.
# Failures do NOT block PRs. Results must be archived and referenced
# in the release record's gates.deep section.

name: Nightly Gates

on:
  schedule:
    - cron: '0 3 * * *'  # daily at 03:00 UTC
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always

jobs:
  coverage:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "1.94"
      - name: Install cargo-tarpaulin
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-tarpaulin
      - name: Coverage (coverage)
        id: coverage
        run: cargo tarpaulin --out json --output-dir artifacts/coverage
    continue-on-error: true

  mutation-testing:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
      - name: Install cargo-mutants
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-mutants
      - name: Mutation testing (mutation_testing)
        id: mutation_testing
        run: cargo mutants
    continue-on-error: true

  fuzzing:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
      - name: Install cargo-fuzz
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-fuzz
      - name: Fuzzing (fuzzing)
        id: fuzzing
        run: |
          cargo fuzz list | while read target; do
            cargo fuzz run "$target" -- -max_total_time=3600
          done
    continue-on-error: true

  loom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
      - name: Loom concurrency tests (loom)
        id: loom
        run: cargo test --test loom_* 2>&1 || echo "No loom tests found — skipping"
    continue-on-error: true

  miri:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: miri
      - name: Miri UB check (miri)
        id: miri
        run: cargo miri test
    continue-on-error: true

  event-metrics-consistency:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "1.94"
      - name: SC-003 event/metrics consistency verification
        id: sc003
        run: |
          echo "Running SC-003 event/metrics consistency check..."
          echo "This job runs the typed event vs metrics consistency tests"
          echo "that validate SC-003: 98% consistency rate requirement."
          echo "Nightly sample: checking last 24h of event/metrics data."
          cargo test --test policy_critical_optional_test -- test_event_metrics_consistency_rate
          echo "SC-003 check complete."
    continue-on-error: true

  clippy-lint-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "1.94"
      - name: Clippy disallowed-methods lint gate
        id: clippy
        run: |
          echo "Running clippy with disallowed-methods lint..."
          cargo clippy --tests --all-features -- -W clippy::disallowed_methods
          echo "Clippy passed — no disallowed methods found."
    continue-on-error: true

  # ---- Chaos scenarios (shortened, ~5-10 min) ----
  chaos-suite:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "1.94"
      - name: Run chaos scenarios (chaos_suite)
        id: chaos
        run: |
          echo "Running chaos scenarios (ignored by default, --include-ignored)..."
          cargo test --test chaos_suite -- --include-ignored
          echo "Chaos suite verdicts printed above."
    continue-on-error: true

  # ---- Soak test (shortened, ~15 min) ----
  soak-suite:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "1.94"
      - name: Run soak test (soak_suite, SOAK_DURATION_MINUTES=15)
        id: soak
        env:
          SOAK_DURATION_MINUTES: "15"
        run: |
          echo "Running soak test with SOAK_DURATION_MINUTES=15..."
          cargo test --test soak_suite -- --ignored
          echo "Soak test report printed above."
    continue-on-error: true

  # ---- Archive all nightly results into a single artifact bundle ----
  collect-and-archive:
    if: always()
    needs:
      - coverage
      - mutation-testing
      - fuzzing
      - loom
      - miri
      - event-metrics-consistency
      - clippy-lint-gate
      - chaos-suite
      - soak-suite
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Prepare archive directory
        run: |
          mkdir -p artifacts/nightly
          echo "nightly_run: $(date -u '+%Y-%m-%dT%H:%M:%SZ')" > artifacts/nightly/summary.txt
          echo "trigger: ${{ github.event_name }}" >> artifacts/nightly/summary.txt
          for job in \
            coverage mutation-testing fuzzing loom miri \
            event-metrics-consistency clippy-lint-gate chaos-suite soak-suite
          do
            result=
            if [ "${{ needs[job].result }}" = "success" ]; then
              result="passed"
            elif [ "${{ needs[job].result }}" = "failure" ]; then
              result="failed"
            elif [ "${{ needs[job].result }}" = "cancelled" ]; then
              result="cancelled"
            else
              result="skipped"
            fi
            echo "$job: $result" >> artifacts/nightly/summary.txt
          done
          echo "summary written to artifacts/nightly/summary.txt"
          cat artifacts/nightly/summary.txt

      - name: Upload nightly artifact bundle
        uses: actions/upload-artifact@v4
        with:
          name: nightly-gates-${{ github.run_id }}
          path: artifacts/nightly/
          if-no-files-found: warn
          retention-days: 30