name: Promotion Gate

on:
  workflow_call:
    inputs:
      pr_number:
        description: "Pull request number"
        required: false
        type: number

jobs:
  promotion-gate:
    name: Promotion Gate
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - name: Check promotion approval
        env:
          GH_TOKEN: ${{ github.token }}
          PR_NUMBER: ${{ inputs.pr_number }}
          REPO: ${{ github.repository }}
          BASE_REF: ${{ github.base_ref }}
        run: |
          if [ -z "${PR_NUMBER}" ] || [ "${PR_NUMBER}" = "null" ]; then
            echo "::notice::No PR number in context. Skipping promotion gate."
            exit 0
          fi

          echo "Checking promotion gate for PR #${PR_NUMBER} targeting ${BASE_REF} in ${REPO}"

          # Determine required reviewer based on target branch
          case "${BASE_REF}" in
            dev)
              echo "Target is dev — no review required. Engineers self-merge."
              exit 0
              ;;
            uat)
              REQUIRED_REVIEWER="privilegedescalation-qa"
              GATE_NAME="QA"
              ;;
            main)
              REQUIRED_REVIEWER="privilegedescalation-qa"
              GATE_NAME="QA"
              # For plugin repos (Pipeline A), UAT approval is needed for uat→main
              # Check if the source branch is uat
              SOURCE_REF=$(curl -sf \
                -H "Authorization: Bearer ${GH_TOKEN}" \
                -H "Accept: application/vnd.github.v3+json" \
                "https://api.github.com/repos/${REPO}/pulls/${PR_NUMBER}" | jq -r '.head.ref')

              if [ "${SOURCE_REF}" = "uat" ]; then
                REQUIRED_REVIEWER="privilegedescalation-uat"
                GATE_NAME="UAT"
              fi
              ;;
            *)
              echo "::notice::Target branch '${BASE_REF}' has no promotion gate configured."
              exit 0
              ;;
          esac

          echo "Required reviewer: ${REQUIRED_REVIEWER} (${GATE_NAME})"

          REVIEWS=$(curl -sf \
            -H "Authorization: Bearer ${GH_TOKEN}" \
            -H "Accept: application/vnd.github.v3+json" \
            "https://api.github.com/repos/${REPO}/pulls/${PR_NUMBER}/reviews")

          if [ -z "${REVIEWS}" ] || [ "${REVIEWS}" = "null" ]; then
            echo "::warning::Could not fetch reviews for PR #${PR_NUMBER}."
            exit 1
          fi

          REVIEWER_APPROVED=$(echo "${REVIEWS}" | jq -r --arg user "${REQUIRED_REVIEWER}" \
            '[.[] | select(.user.login == $user or .user.login == ($user + "[bot]"))] | last | if .state then .state == "APPROVED" else false end')

          echo "${GATE_NAME} (${REQUIRED_REVIEWER}) approved: ${REVIEWER_APPROVED}"

          if [ "${REVIEWER_APPROVED}" = "true" ]; then
            echo "Promotion gate passed: ${GATE_NAME} has approved."
          else
            echo "Promotion gate failed: waiting for ${GATE_NAME} approval from ${REQUIRED_REVIEWER}."
            exit 1
          fi