# Iterpec — Production Readiness Gate for CI
#
# Blocks a production deploy until the Iterpec MCP confirms the workspace is
# ready. Uses the public authenticated endpoint /api/public/production-readiness
# with the workspace token (wsk_*).
#
# Setup:
#   Settings → Secrets and variables → Actions → New repository secret
#     ITERPEC_WORKSPACE_TOKEN = wsk_********   (ask comercial@iterpec.com)
#
# Behavior:
#   - The endpoint aggregates homologation steps, live probe, GitHub audit,
#     session trace and smoke report.
#   - With ?fail_if_not_ready=1 it returns HTTP 409 when not ready, so the
#     step fails and the deploy job is skipped.

name: iterpec-production-gate

on:
  workflow_dispatch:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - name: Check Iterpec production readiness
        env:
          TOKEN: ${{ secrets.ITERPEC_WORKSPACE_TOKEN }}
        run: |
          set -e
          curl -fsS \
            -H "Authorization: Bearer $TOKEN" \
            "https://iterpec.com/api/public/production-readiness?fail_if_not_ready=1&repo=${{ github.repository }}" \
            | tee readiness.json
          ready=$(jq -r '.report.ready' readiness.json)
          score=$(jq -r '.report.score' readiness.json)
          echo "ready=$ready score=$score"
          if [ "$ready" != "true" ]; then
            echo "::error::Iterpec gate blocked the deploy. Check blockers in readiness.json."
            jq '.report.blockers' readiness.json
            exit 1
          fi

      - name: Upload readiness report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: iterpec-readiness
          path: readiness.json
