name: Dada P0-A isolated Windows CI

on:
  push:
  pull_request:
  workflow_dispatch:

jobs:
  validate-and-package:
    runs-on: [self-hosted, windows, x64, dada-isolated]
    timeout-minutes: 60
    env:
      CI: "true"
      DADA_EXTERNAL_MODE: mock
    steps:
      - name: Check out frozen revision
        uses: actions/checkout@v4
      - name: Verify frozen package manager
        shell: powershell
        run: |
          $ErrorActionPreference = "Stop"
          $expectedPackageManager = (Get-Content package.json -Raw | ConvertFrom-Json).packageManager
          if ($expectedPackageManager -notmatch '^pnpm@(?<version>.+)$') {
            throw "package.json must pin pnpm with packageManager"
          }
          $expectedVersion = $Matches.version
          $actualVersion = (pnpm --version).Trim()
          if ($actualVersion -ne $expectedVersion) {
            throw "Expected pnpm $expectedVersion, got $actualVersion"
          }
      - name: Install frozen dependencies
        shell: powershell
        run: pnpm install --frozen-lockfile
      - name: Verify isolated CI policy
        shell: powershell
        run: node scripts/verify-ci-isolation.mjs
      - name: Run complete automated suite
        shell: powershell
        run: pnpm test:all
      - name: Build candidate portable package
        shell: powershell
        run: pnpm package:portable
      - name: Upload candidate package and evidence
        uses: actions/upload-artifact@v3
        with:
          name: dada-p0a-candidate-${{ gitea.sha }}
          path: |
            .build/portable-release/*.zip
            .build/portable-release/*.sha256
            artifacts/tdd/**
          if-no-files-found: error