name: "[TSM.ID] 3Z Pipeline"
on:
  push:
    branches: [master]

concurrency:
  group: ci-master
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  check:
    name: "Zero Error Check"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        run: |
          set -e
          rm -rf workspace && mkdir -p workspace && cd workspace
          git clone http://supreme_commander:XCU_Forge_2026!@127.0.0.1:3050/supreme_commander/multiverse.git .
      - name: cargo check
        run: |
          set -e
          cd workspace/xcom-ultra
          cargo check --workspace

  test:
    name: "Zero Warning Test"
    runs-on: ubuntu-latest
    needs: check
    steps:
      - name: Checkout
        run: |
          set -e
          rm -rf workspace && mkdir -p workspace && cd workspace
          git clone http://supreme_commander:XCU_Forge_2026!@127.0.0.1:3050/supreme_commander/multiverse.git .
      - name: cargo test
        run: |
          set -e
          cd workspace/xcom-ultra
          cargo test --workspace

  audit:
    name: "3Z Audit"
    runs-on: ubuntu-latest
    needs: check
    steps:
      - name: Checkout
        run: |
          set -e
          rm -rf workspace && mkdir -p workspace && cd workspace
          git clone http://supreme_commander:XCU_Forge_2026!@127.0.0.1:3050/supreme_commander/multiverse.git .
      - name: 3Z Verify
        run: |
          set -e
          cd workspace/xcom-ultra
          total=$(find . -name "lib.rs" -not -path "*/target/*" -not -path "*/bare-metal/*" | wc -l)
          marked=$(grep -rl "TSM.ID.*11031972" --include="lib.rs" -r . --exclude-dir=target --exclude-dir=bare-metal | wc -l)
          deny=$(grep -rl "deny(warnings)" --include="lib.rs" -r . --exclude-dir=target --exclude-dir=bare-metal | wc -l)
          panic=$(grep -rn "panic!(" --include="*.rs" . --exclude-dir=target --exclude-dir=bare-metal | grep -v "mod tests" | grep -v "//" | wc -l)
          modules=$(grep -c '"xcu-' Cargo.toml)
          echo "==============================="
          echo " 3Z AUDIT REPORT"
          echo "==============================="
          echo " Modules:        $modules"
          echo " Watermark:      $marked / $total"
          echo " deny(warnings): $deny / $total"
          echo " panic!():       $panic"
          echo "==============================="
          if [ "$marked" -ne "$total" ]; then echo "FAIL: watermark"; exit 1; fi
          if [ "$deny" -ne "$total" ]; then echo "FAIL: deny"; exit 1; fi
          if [ "$panic" -gt 0 ]; then echo "FAIL: panic"; exit 1; fi
          echo "3Z: PASS"