# Source-discipline gate — server-side backstop for rule-doc-only commits.
#
# §M-DISCIPLINE.SOURCE [2]: node id / file key are "project material" (三问判据 ②)
# and must not accumulate in the cross-product rule sources. The named sets in
# scripts/audit-source-discipline-identifiers.mjs are shrink-only.
#
# Why a server-side job (same reasoning as stale-anchors.yml, and this round it
# was demonstrated the hard way): the local pre-commit hook is bypassable with
# --no-verify — the agent landing this very gate used --no-verify once — and
# Owner-direct-master is the default. ci.yml's on.push.paths does not include
# docs/internal/*.md, so a rule-doc-only commit would not trigger the matrix.
# This job closes that gap.
#
# Zero-install BY DESIGN: audit-source-discipline-identifiers.mjs is zero-dep
# (node: builtins only, plus the in-repo scripts/lib/is-cli-entry.mjs), so no
# pnpm install — just `node`.
name: Source Discipline

on:
  push:
    branches: [master]
    paths:
      - 'docs/internal/mockup-conventions.md'
      - 'docs/internal/design-process.md'
      - 'docs/internal/code-conventions.md'
      - 'docs/internal/domain-tvu.md'
      - 'scripts/audit-source-discipline-identifiers.mjs'
      - 'scripts/lib/is-cli-entry.mjs'
      - 'package.json'
      - '.github/workflows/source-discipline.yml'

permissions:
  contents: read

jobs:
  source-discipline:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Node 20
        uses: actions/setup-node@v5
        with:
          node-version: '20'
          # Zero-install by design (see header): no pnpm on this runner, so disable
          # setup-node@v5's default package-manager-cache, which auto-detects the
          # `packageManager: pnpm@…` field and fails with "Unable to locate pnpm".
          package-manager-cache: false

      - name: Audit source-discipline identifiers (offline)
        run: node scripts/audit-source-discipline-identifiers.mjs