name: precision-gate

# Enforces the per-detector precision/recall drift gate that previously only
# ran locally (bench/score_fp.py --gate). Runs on PRs that touch detection or
# scoring code so a precision regression cannot land silently.
#
# Hermetic by design: gates on the committed `security-bugs` corpus against a
# committed security-bugs-scoped baseline (bench/fp-baseline-security-bugs.json).
# Juliet is intentionally NOT used here — it is fetched from NIST and is too
# fragile for a required PR check. The weekly bench.yml job covers Juliet.

on:
  workflow_dispatch:
  pull_request:
    paths:
      - "src/detect/**"
      - "src/symbolic/**"
      - "include/fold/detect/**"
      - "include/fold/symbolic/**"
      - "include/fold/report/**"
      - "bench/score_fp.py"
      - "bench/fp-baseline-security-bugs.json"
      - "bench/corpora/security-bugs/**"

permissions:
  contents: read

concurrency:
  group: precision-gate-${{ github.ref }}
  cancel-in-progress: true

jobs:
  gate:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: Install system deps
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            clang-19 clang-tidy-19 \
            llvm-19-dev libclang-19-dev libclang-cpp19-dev \
            libz3-dev libsqlite3-dev \
            meson ninja-build pkg-config \
            nlohmann-json3-dev \
            libcli11-dev libspdlog-dev libfmt-dev

      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"

      - name: Install Conan
        run: |
          python -m pip install --upgrade pip
          python -m pip install "conan>=2,<3"
          conan profile detect --force

      - name: Cache Conan
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ~/.conan2
          key: conan-precision-gate-${{ hashFiles('conanfile.py') }}

      - name: Configure + build fold (release)
        env:
          CC: clang-19
          CXX: clang++-19
        run: |
          conan install . --output-folder=build/release --build=missing \
              -s build_type=Release -o build_tests=False
          ln -sf /usr/lib/x86_64-linux-gnu/pkgconfig/z3.pc build/release/z3.pc
          meson setup build/release \
              --native-file build/release/conan_meson_native.ini \
              -Dcpp_std=c++23 \
              -Dllvm-config-path="$(command -v llvm-config-19)"
          meson compile -C build/release

      - name: Precision/recall drift gate (security-bugs)
        run: |
          python3 bench/score_fp.py \
              --run --security-bugs \
              --fold-bin build/release/src/cli/fold \
              --processes 1 \
              --gate \
              --baseline bench/fp-baseline-security-bugs.json \
              --tolerance 0.02 \
              --out /tmp/fp-current-security-bugs.json \
              --summary

      - name: Upload drift report
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: precision-gate-report
          path: |
            /tmp/fp-current-security-bugs.json
            /tmp/fp-current-security-bugs.md
          if-no-files-found: ignore