name: released-pages-hardening-gates

on:
  pull_request:
    paths:
      - "src/mes_dashboard/**"
      - "frontend/src/job-query/**"
      - "tests/test_query_tool_routes.py"
      - "tests/test_job_query_routes.py"
      - "tests/test_resource_routes.py"
      - "tests/test_rate_limit_identity.py"
      - "tests/test_page_registry.py"
      - "tests/test_redis_client.py"
      - "tests/test_runtime_hardening.py"
      - "tests/test_hold_routes.py"
      - "tests/test_wip_routes.py"
      - "tests/test_job_query_frontend_safety.py"
      - ".github/workflows/released-pages-hardening-gates.yml"
  push:
    branches: [ main ]
    paths:
      - "src/mes_dashboard/**"
      - "frontend/src/job-query/**"
      - "tests/test_query_tool_routes.py"
      - "tests/test_job_query_routes.py"
      - "tests/test_resource_routes.py"
      - "tests/test_rate_limit_identity.py"
      - "tests/test_page_registry.py"
      - "tests/test_redis_client.py"
      - "tests/test_runtime_hardening.py"
      - "tests/test_hold_routes.py"
      - "tests/test_wip_routes.py"
      - "tests/test_job_query_frontend_safety.py"
      - ".github/workflows/released-pages-hardening-gates.yml"

jobs:
  released-pages-hardening:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"
      - name: Install test dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e . pytest
      - name: Run released-pages hardening regression suite
        run: |
          python -m pytest -q \
            tests/test_query_tool_routes.py \
            tests/test_job_query_routes.py \
            tests/test_resource_routes.py \
            tests/test_rate_limit_identity.py \
            tests/test_page_registry.py \
            tests/test_redis_client.py \
            tests/test_runtime_hardening.py \
            tests/test_hold_routes.py \
            tests/test_wip_routes.py \
            tests/test_job_query_frontend_safety.py \
            -k "not TestJobQueryPage and not TestHoldDetailPageRoute and not TestPageRoutes"