ci.yml

name: CI

on:
  pull_request:
    branches: [main, master, develop]
  push:
    branches: [main, master, develop]
  workflow_dispatch:

permissions: read-all

concurrency:
  # PRs group by ref so rapid pushes cancel superseded runs (saves minutes).
  # Non-PR events (main push, version-bump push, dispatch) group by SHA so each
  # commit gets its own group and can neither cancel nor be cancelled, even in a
  # burst. A cancelled run is what makes the branch CI badge flash "failing".
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  lint:
    name: Lint & Format
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install uv
        uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
        with:
          enable-cache: true
          cache-dependency-glob: "uv.lock"

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"

      # Before `uv sync`, which rewrites the lock and would mask the drift.
      # uv.lock carries its own copy of the project version; when a release
      # bumps pyproject.toml without it the two disagree on committed main,
      # and every clone then shows a spurious uv.lock diff as soon as any uv
      # command resolves the workspace (issue #1432). Runs per PR rather than
      # at release time so a reintroduced drift fails on the PR that causes
      # it, instead of surfacing during someone else's release.
      - name: Check uv.lock is in sync with pyproject.toml
        run: |
          uv lock --check

      - name: Install dependencies
        run: |
          uv sync --group dev

      - name: Run ruff check
        run: |
          uv run ruff check . --output-format=github

      - name: Run ruff format check
        run: |
          uv run ruff format --check .

      # label-sync.yml runs only on push to main, so a malformed manifest
      # would fail after merge rather than on the PR that broke it. Checking
      # it here puts the failure on the change that causes it (issue #1434).
      - name: Validate labels.yml
        run: |
          uv run python scripts/validate_labels.py

  typecheck:
    name: Type Check
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install uv
        uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
        with:
          enable-cache: true
          cache-dependency-glob: "uv.lock"

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          uv sync --extra treesitter-full --extra semantic --extra milvus --extra test --group dev

      - name: Run type checking
        run: |
          uv run ty check codebase_rag --exclude codebase_rag/tests/

  test-unit:
    name: Unit Tests (${{ matrix.os }}, py${{ matrix.python-version }})
    runs-on: ${{ matrix.os }}
    # Slow runners (ubuntu/windows py3.13) can exceed 20 min on the full -n auto
    # suite and hit the cap as a spurious CANCELLED; 30 min absorbs the variance
    # while still bounding a genuine hang.
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        python-version: ["3.12", "3.13"]

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          fetch-depth: 0

      - name: Install uv
        uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
        with:
          enable-cache: true
          cache-dependency-glob: "uv.lock"

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        run: |
          uv sync --python ${{ matrix.python-version }} --extra treesitter-full --extra test --extra semantic --extra milvus --group dev

      # Three unit tests embed for real. Without a cache each job pulled
      # microsoft/unixcoder-base from HuggingFace mid-suite, so a 429 or an
      # outage failed PRs for reasons unrelated to the change under test
      # (issue #1092). Cached per model id, and prefetched in an explicit step
      # so a hub problem is an attributable failure here rather than a
      # mysterious one inside pytest.
      - name: Cache HuggingFace hub
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: ~/.cache/huggingface
          key: hf-unixcoder-base-${{ runner.os }}-v1

      # A warm cache makes this a no-op with no network at all; a cold one
      # retries, because 429 Too Many Requests is exactly the transient the
      # issue reported. A genuine outage still fails here, loudly and in a
      # step whose name says what broke.
      - name: Prefetch embedding model
        shell: bash
        run: |
          for attempt in 1 2 3; do
            if uv run --no-sync python -c "
          from huggingface_hub import snapshot_download
          snapshot_download('microsoft/unixcoder-base')
          "; then
              exit 0
            fi
            echo "prefetch attempt $attempt failed; retrying"
            sleep $((attempt * 15))
          done
          echo "could not fetch the embedding model after 3 attempts"
          exit 1

      # --no-sync is required: a bare `uv run` re-syncs to .python-version
      # (3.12) with default deps only, so on a 3.13 matrix (and on Windows,
      # where interpreter discovery mismatches the venv) it silently rebuilds
      # the venv without the test extra and pytest loses the xdist -n flag.
      - name: Run unit tests (parallel, with coverage)
        if: matrix.os == 'macos-latest' && matrix.python-version == '3.12'
        run: |
          uv run --no-sync pytest -n auto -m "not integration" --tb=short --cov=codebase_rag --cov-report=xml --cov-report=term

      - name: Run unit tests (parallel, no coverage)
        if: matrix.os != 'macos-latest' || matrix.python-version != '3.12'
        run: |
          uv run --no-sync pytest -n auto -m "not integration" --tb=short

      - name: Upload coverage to Codecov
        if: always() && matrix.os == 'macos-latest' && matrix.python-version == '3.12'
        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
        with:
          files: ./coverage.xml
          flags: unit-${{ matrix.os }}
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}

  test-unit-base:
    name: Unit Tests (base install)
    runs-on: ubuntu-latest
    # A base install ships only the test extra: no treesitter-full, semantic
    # or milvus. Grammar- and optional-dependency-gated tests must SKIP here,
    # not fail (issues #1371 and #1410); this job keeps that enforced.
    timeout-minutes: 30

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          fetch-depth: 0
          # No later step performs authenticated Git operations, and pytest
          # runs repository-controlled code, so the token must not persist
          # into the local Git config.
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
        with:
          enable-cache: true
          cache-dependency-glob: "uv.lock"

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"

      - name: Install base dependencies only
        run: |
          uv sync --extra test --group dev

      - name: Run unit tests on the base install
        run: |
          uv run --no-sync pytest -n auto -m "not integration" --tb=short

  test-integration:
    name: Integration Tests (ubuntu-latest)
    runs-on: ubuntu-latest
    timeout-minutes: 25

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          fetch-depth: 0

      - name: Start Memgraph
        run: |
          docker run -d --name memgraph -p 7687:7687 memgraph/memgraph-platform:latest
          echo "Waiting for Memgraph to start..."
          for i in {1..30}; do
            if docker exec memgraph mgconsole --no-history -c "RETURN 1;" 2>/dev/null; then
              echo "Memgraph is ready!"
              break
            fi
            echo "Attempt $i/30: Memgraph not ready yet..."
            sleep 2
          done

      - name: Install uv
        uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
        with:
          enable-cache: true
          cache-dependency-glob: "uv.lock"

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          uv sync --extra treesitter-full --extra test --extra semantic --extra milvus --group dev

      - name: Run integration tests
        env:
          MEMGRAPH_HOST: localhost
          MEMGRAPH_PORT: 7687
        run: |
          uv run pytest -m "integration" -v --tb=short --cov=codebase_rag --cov-report=xml --cov-report=term

      - name: Upload coverage to Codecov
        if: always()
        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
        with:
          files: ./coverage.xml
          flags: integration-ubuntu-latest
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Stop Memgraph
        if: always()
        run: |
          docker stop memgraph || true
          docker rm memgraph || true
        shell: bash

  binary-smoke:
    name: Binary Smoke Test
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          fetch-depth: 0

      - name: Install uv
        uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
        with:
          enable-cache: true
          cache-dependency-glob: "uv.lock"

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          uv sync --extra treesitter-full
          uv add --dev pyinstaller

      - name: Build binary
        run: uv run python build_binary.py

      - name: Test binary
        run: ./dist/code-graph-rag-* --version

  # Every other job installs from uv.lock, so no job exercises the dependency
  # resolution a real `pip install code-graph-rag` performs: newest versions
  # satisfying the pyproject.toml floors. This job does, so a dependency that
  # ships a breaking major inside our declared range fails here instead of in a
  # user's terminal a week later (#1096).
  wheel-fresh-resolution:
    name: Wheel Smoke (unlocked resolution)
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      # This job installs freshly resolved third-party packages and then runs
      # repository code, so it must not leave the workflow token in the local
      # git config for that code to read.
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"

      - name: Build wheel
        run: uv build --wheel

      # Deliberately plain venv + pip: uv.lock must not participate.
      - name: Install the wheel with unlocked resolution
        run: |
          python -m venv .fresh-venv
          ./.fresh-venv/bin/python -m pip install --upgrade pip
          ./.fresh-venv/bin/python -m pip install dist/*.whl

      - name: Record resolved dependency versions
        run: ./.fresh-venv/bin/python -m pip list

      - name: Smoke the freshly resolved install
        run: |
          ./.fresh-venv/bin/python -c "import codebase_rag"
          ./.fresh-venv/bin/cgr --version
          ./.fresh-venv/bin/python scripts/smoke_wheel.py

  pr-title-check:
    name: PR Title Convention
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    timeout-minutes: 5

    steps:
      - name: Check PR title format
        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          types: |
            build
            chore
            ci
            docs
            feat
            fix
            perf
            refactor
            prefactor
            revert
            style
            test
          requireScope: false
          subjectPattern: ^.+$
          subjectPatternError: |
            The subject "{subject}" found in the pull request title "{title}"
            didn't match the configured pattern. Please ensure that the subject
            starts with a lowercase letter.
          wip: false
          validateSingleCommit: false
          validateSingleCommitMatchesPrTitle: false

  go-frontend:
    name: Go Frontend
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version: "1.23"
          cache-dependency-path: codebase_rag/parsers/go_frontend/gotypes/go.sum

      - name: Install uv
        uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
        with:
          enable-cache: true
          cache-dependency-glob: "uv.lock"

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          uv sync --extra treesitter-full --extra test --group dev

      # Build the bundled tool explicitly so a Go compile error is an
      # attributable failure here, not a mysterious skip inside pytest. Deps
      # resolve from the module cache, pinned by go.sum.
      - name: Build the bundled gotypes tool
        working-directory: codebase_rag/parsers/go_frontend/gotypes
        env:
          GOTOOLCHAIN: local
        run: go build ./...

      - name: Run Go frontend tests
        run: |
          uv run --no-sync pytest codebase_rag/tests/test_go_frontend.py -v --tb=short

  greptile-gate:
    name: Greptile 5/5 Gate
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    timeout-minutes: 65
    permissions:
      # contents: read backs the commits API call that resolves an
      # abbreviated reviewed-commit reference to a full SHA.
      contents: read
      pull-requests: read
      issues: read

    steps:
      - name: Require a 5/5 Greptile review of the head commit
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO: ${{ github.repository }}
          PR: ${{ github.event.pull_request.number }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          # The merge gate: a pull request is mergeable ONLY when Greptile has
          # reviewed the CURRENT head commit and scored it 5/5. A stale review,
          # a missing review, or any lower score fails this job, which fails
          # "All Checks Pass", which the branch ruleset requires. Greptile
          # posts its review minutes after a push, so poll until its summary
          # comment covers this exact commit. The deadline leaves headroom
          # over Greptile's slowest observed review (37 minutes on PR #1404).
          deadline=$(( $(date +%s) + 3600 ))
          while :; do
            # --jq would run per page; slurp the pages so every scored comment
            # is considered across all of them. Walk candidates NEWEST FIRST
            # and act on the first one that reviewed the head commit: picking
            # the globally latest comment instead would let a late update to
            # an old-commit review mask a valid 5/5 review of head. Bodies are
            # multiline, so ship them through base64.
            candidates=$(gh api "repos/$REPO/issues/$PR/comments" --paginate \
              | jq -rs 'add
                        | [.[] | select(.user.login == "greptile-apps[bot]")
                               | select(.body | contains("Confidence Score:"))]
                        | sort_by(.updated_at) | reverse | .[].body | @base64')
            score=""
            for encoded in $candidates; do
              body=$(printf '%s' "$encoded" | base64 -d)
              # Greptile sometimes prints an abbreviated commit instead of a
              # full-SHA link, so accept 7-40 hex chars.
              reviewed=$(printf '%s' "$body" \
                | grep -o 'Last reviewed commit.*' \
                | grep -oE '[0-9a-f]{7,40}' | head -1 || true)
              if [ -n "$reviewed" ] && [ "${#reviewed}" -lt 40 ]; then
                # Resolve to the full SHA so the comparison below is exact
                # equality, never a prefix guess; an unresolvable reference
                # just skips this candidate.
                reviewed=$(gh api "repos/$REPO/commits/$reviewed" \
                  --jq .sha 2>/dev/null || true)
              fi
              [ "$reviewed" = "$HEAD_SHA" ] || continue
              score=$(printf '%s' "$body" \
                | grep -oE 'Confidence Score: [0-9]+/5' | tail -1 \
                | grep -oE '[0-9]+' | head -1 || true)
              [ -n "$score" ] && break
            done
            if [ -n "$score" ]; then
              if [ "$score" = "5" ]; then
                echo "✅ Greptile scored $HEAD_SHA at 5/5"
                exit 0
              fi
              echo "❌ Greptile scored $HEAD_SHA at $score/5 — 5/5 is required to merge."
              echo "Fix Greptile's findings and push; the next review must reach 5/5."
              exit 1
            fi
            echo "No Greptile review of $HEAD_SHA yet, waiting ..."
            if [ "$(date +%s)" -ge "$deadline" ]; then
              echo "❌ No Greptile review of $HEAD_SHA appeared within 60 minutes."
              echo "Re-trigger the Greptile review, then re-run this job."
              exit 1
            fi
            sleep 60
          done

  sonar-gate:
    name: Sonar Zero Issues Gate
    runs-on: ubuntu-latest
    # Mirror the eligibility of the SonarCloud Analysis job in
    # sonarcloud.yml (PRs targeting main, excluding Dependabot and fork
    # heads): a PR that never gets analyzed must skip the gate instead of
    # polling for an analysis that cannot exist.
    if: >-
      github.event_name == 'pull_request'
      && github.event.pull_request.base.ref == 'main'
      && github.event.pull_request.user.login != 'dependabot[bot]'
      && github.event.pull_request.head.repo.full_name == github.repository
    timeout-minutes: 45
    permissions:
      # checks: read backs the check-runs API call that detects a failed
      # SonarCloud Analysis job, so the gate fails fast instead of waiting
      # out the full deadline for an analysis that will never arrive.
      checks: read
      contents: read

    steps:
      - name: Require a SonarCloud analysis of the head commit with zero open issues
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO: ${{ github.repository }}
          PROJECT_KEY: vitali87_code-graph-rag
          PR: ${{ github.event.pull_request.number }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          # The merge gate: a pull request is mergeable ONLY when SonarCloud
          # has analyzed the CURRENT head commit and reports zero open issues
          # on the pull request. The built-in "Sonar way" quality gate passes
          # with new issues of low severity (its conditions are ratings, not
          # counts), so this job enforces the stricter bar the project wants:
          # every issue fixed, or explicitly resolved (accepted / false
          # positive) in the SonarCloud UI. Both endpoints are public for
          # public projects, so no token is needed. Analysis lands minutes
          # after the SonarCloud Analysis job finishes, so poll until the
          # reported analyzed commit is this exact commit.
          deadline=$(( $(date +%s) + 2400 ))
          while :; do
            analyzed=$(curl -sf "https://sonarcloud.io/api/project_pull_requests/list?project=$PROJECT_KEY" \
              | jq -r --arg pr "$PR" \
                  '.pullRequests[] | select(.key == $pr) | .commit.sha // empty' \
              || true)
            if [ "$analyzed" = "$HEAD_SHA" ]; then
              issues=$(curl -sf "https://sonarcloud.io/api/issues/search?componentKeys=$PROJECT_KEY&pullRequest=$PR&resolved=false&ps=100" \
                || true)
              total=$(printf '%s' "$issues" | jq -r '.total // empty' || true)
              if [ -z "$total" ]; then
                echo "Issue search returned no usable payload, retrying ..."
              elif [ "$total" = "0" ]; then
                echo "✅ SonarCloud analyzed $HEAD_SHA and reports zero open issues"
                exit 0
              else
                echo "❌ SonarCloud reports $total open issue(s) on this pull request:"
                printf '%s' "$issues" | jq -r \
                  '.issues[] | "  - [\(.severity)] \(.component | sub("^[^:]*:"; "")):\(.line // "?") \(.message) (\(.rule))"'
                echo "Fix them and push, or resolve them as accepted/false positive in SonarCloud."
                exit 1
              fi
            else
              # Fail fast when the producer is already dead: a SonarCloud
              # Analysis job that completed without success will never
              # publish an analysis of this commit, so waiting out the
              # deadline would only delay the same failure. A queued or
              # in-progress run holds the verdict open: a rerun sits at
              # started_at null while queued, which jq sorts before every
              # real timestamp, so only the completed runs are ranked and
              # any active run suppresses the fast fail until it finishes.
              runs=$(gh api "repos/$REPO/commits/$HEAD_SHA/check-runs?per_page=100" \
                --jq '[.check_runs[] | select(.name == "SonarCloud Analysis")]' \
                2>/dev/null || echo '[]')
              active=$(printf '%s' "$runs" \
                | jq '[.[] | select(.status != "completed")] | length' \
                2>/dev/null || echo 1)
              producer=$(printf '%s' "$runs" \
                | jq -r 'map(select(.status == "completed"))
                         | sort_by(.started_at) | last
                         | .conclusion // empty' \
                2>/dev/null || true)
              if [ "$active" = "0" ] && [ -n "$producer" ] && [ "$producer" != "success" ]; then
                echo "❌ The SonarCloud Analysis job concluded '$producer', so no analysis of $HEAD_SHA is coming."
                echo "Fix or re-run SonarCloud Analysis, then re-run this job."
                exit 1
              fi
              echo "No SonarCloud analysis of $HEAD_SHA yet (last analyzed: ${analyzed:-none}), waiting ..."
            fi
            if [ "$(date +%s)" -ge "$deadline" ]; then
              echo "❌ No SonarCloud analysis of $HEAD_SHA appeared within 40 minutes."
              echo "Check the SonarCloud Analysis job, then re-run this job."
              exit 1
            fi
            sleep 60
          done

  all-checks-pass:
    name: All Checks Pass
    runs-on: ubuntu-latest
    if: always()
    needs:
      [
        lint,
        typecheck,
        test-unit,
        test-unit-base,
        test-integration,
        binary-smoke,
        wheel-fresh-resolution,
        go-frontend,
        greptile-gate,
        sonar-gate,
      ]
    timeout-minutes: 5

    steps:
      - name: Check all jobs
        run: |
          echo "Lint: ${{ needs.lint.result }}"
          echo "Typecheck: ${{ needs.typecheck.result }}"
          echo "Unit Tests: ${{ needs.test-unit.result }}"
          echo "Integration Tests: ${{ needs.test-integration.result }}"
          echo "Binary Smoke: ${{ needs.binary-smoke.result }}"
          echo "Wheel Smoke: ${{ needs.wheel-fresh-resolution.result }}"
          echo "Go Frontend: ${{ needs.go-frontend.result }}"

          if [[ "${{ needs.lint.result }}" != "success" ]]; then
            echo "❌ Lint failed"
            exit 1
          fi
          if [[ "${{ needs.typecheck.result }}" != "success" ]]; then
            echo "❌ Type check failed"
            exit 1
          fi
          if [[ "${{ needs.test-unit.result }}" != "success" ]]; then
            echo "❌ Unit tests failed"
            exit 1
          fi
          if [[ "${{ needs.test-unit-base.result }}" != "success" ]]; then
            echo "❌ Base-install unit tests failed"
            exit 1
          fi
          if [[ "${{ needs.test-integration.result }}" != "success" ]]; then
            echo "❌ Integration tests failed"
            exit 1
          fi
          if [[ "${{ needs.binary-smoke.result }}" != "success" ]]; then
            echo "❌ Binary smoke test failed"
            exit 1
          fi
          if [[ "${{ needs.wheel-fresh-resolution.result }}" != "success" ]]; then
            echo "❌ Wheel smoke test (unlocked resolution) failed"
            exit 1
          fi
          if [[ "${{ needs.go-frontend.result }}" != "success" ]]; then
            echo "❌ Go frontend job failed"
            exit 1
          fi
          # Skipped on push events (Greptile only reviews pull requests); on a
          # pull request anything but success blocks the merge.
          if [[ "${{ needs.greptile-gate.result }}" != "success" \
             && "${{ needs.greptile-gate.result }}" != "skipped" ]]; then
            echo "❌ Greptile gate failed: a 5/5 review of the head commit is required"
            exit 1
          fi
          # Same skip semantics: the gate is skipped on non-PR events and on
          # PRs SonarCloud never analyzes (Dependabot, forks, non-main base);
          # wherever it does run, anything but success blocks the merge.
          if [[ "${{ needs.sonar-gate.result }}" != "success" \
             && "${{ needs.sonar-gate.result }}" != "skipped" ]]; then
            echo "❌ Sonar gate failed: zero open SonarCloud issues on the head commit are required"
            exit 1
          fi
          echo "✅ All checks passed!"