gatekeeper_ai.yml

name: Codeijoe Gatekeeper v3.0 (AI-Powered)

# Trigger: pull_request_target mengizinkan akses ke Secrets (Gemini Key)
# Aman karena workflow yang jalan adalah versi dari branch 'main' (milik kita)
on:
  pull_request_target:
    branches: ["main"]
    paths:
      - "src/**"
      - "tests/**"
      - "README.md"

permissions:
  contents: read
  pull-requests: write # Wajib untuk Bot memberi label, komen, dan menutup PR
  issues: write

jobs:
  audit-submission:
    name: Forensic Audit
    runs-on: ubuntu-latest
    steps:
      # 1. Checkout Code Milik Challenger (HEAD)
      - name: Checkout Challenger Code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 2

      # ---------------------------------------------------------
      # GATE 1: ANTI-CHEAT (File Integrity)
      # Memastikan user tidak mengubah Test atau Config Bot
      # ---------------------------------------------------------
      - name: Detect Illegal Modifications
        id: anti_cheat
        uses: tj-actions/changed-files@v41
        with:
          files: |
            tests/**
            .github/**
            GOVERNANCE.md
            LICENSE

      - name: Block Cheaters
        if: steps.anti_cheat.outputs.any_changed == 'true'
        run: |
          echo "::error title=Integrity Violated::You modified restricted files (tests/ or .github/). CHEATING DETECTED."
          exit 1

      # ---------------------------------------------------------
      # GATE 2: THE VOIGHT-KAMPFF TEST (Hybrid AI Audit)
      # Pre-flight check (Length) + Deep Scan (Gemini 1.5 Flash)
      # ---------------------------------------------------------
      - name: AI Forensic Audit (Gemini 1.5 Flash)
        uses: actions/github-script@v7
        env:
          GEMINI_KEY: ${{ secrets.GEMINI_API_KEY }}
          # INJECT SYSTEM CORTEX DARI SECRET
          SYSTEM_PROMPT: ${{ secrets.SYSTEM_CORTEX_PROMPT }}
        with:
          script: |
            const pr = context.payload.pull_request;
            const bodyClean = (pr.body || "").replace(/(\r\n|\n|\r)/gm, " ").trim();

            // Bypass Audit jika Founder/Admin yang submit
            if (pr.user.login === 'codeijoe' || pr.user.login === 'itwahjoedi') {
              console.log("Admin override. Skipping AI Audit.");
              return;
            }

            // --- LEVEL 1: PRE-FLIGHT CHECK (Hemat API Call) ---
            // Tolak jika deskripsi terlalu pendek (< 100 char)
            if (bodyClean.length < 100) {
                const msg = "⛔ **AUDIT REJECTED (LAZINESS DETECTED)**\n\n**Reason:** PR Description is too short.\n\n*Protocol Requirement: Real engineers explain their decisions. Minimum 100 characters required.*";
                await github.rest.issues.createComment({
                  issue_number: context.issue.number,
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  body: msg
                });
                core.setFailed("PR Description too short (<100 chars).");
                return;
            }

            // --- LEVEL 2: DEEP SCAN (Gemini AI) ---
            
            // Ambil System Prompt dari Secret, atau fallback ke default jika kosong
            const systemInstruction = process.env.SYSTEM_PROMPT || "You are a strict code auditor.";

            const userPrompt = `
            INPUT DATA:
            - PR Title: "${pr.title}"
            - PR Body: "${bodyClean}"
            
            Based on the System Instructions provided to you, determine PASS or FAIL.
            OUTPUT FORMAT (JSON ONLY): {"verdict": "PASS"|"FAIL", "reason": "..."}
            `;

            try {
              const response = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/gemini-1.5-flash:generateContent?key=${process.env.GEMINI_KEY}`, {
                method: 'POST',
                headers: {'Content-Type': 'application/json'},
                body: JSON.stringify({
                  contents: [
                    { 
                      role: "user", 
                      parts: [{ text: systemInstruction + "\n\n" + userPrompt }] 
                    }
                  ],
                  generationConfig: { responseMimeType: "application/json" }
                })
              });

              if (!response.ok) {
                 throw new Error(`Gemini API Error: ${response.statusText}`);
              }

              const data = await response.json();
              const textResponse = data.candidates[0].content.parts[0].text;

              // Bersihkan markdown block (```json ... ```) jika ada, agar JSON.parse aman
              const jsonClean = textResponse.replace(/```json/g, "").replace(/```/g, "").trim();
              const analysis = JSON.parse(jsonClean);

              console.log("AI Verdict:", analysis);

              if (analysis.verdict === "FAIL") {
                const failureMsg = `⛔ **AUDIT REJECTED (AI DETECTED)**\n\n**Reason:** ${analysis.reason}\n\n*Protocol Requirement: You must provide a valid 'Trade-off Analysis'. Rewrite your PR description to prove you understand the code.*`;

                await github.rest.issues.createComment({
                  issue_number: context.issue.number,
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  body: failureMsg
                });

                core.setFailed(`Voight-Kampff Failed: ${analysis.reason}`);
              } else {
                console.log("✅ AI Audit Passed: Reasoning verified.");
              }

            } catch (error) {
              console.error("AI Audit Malfunction:", error);
              // Fail Open: Jika API error, kita lanjut ke tes teknikal (opsional)
              console.log("Warning: Proceeding to technical test despite AI outage.");
            }

      # ---------------------------------------------------------
      # GATE 3: TECHNICAL GAUNTLET (Unit Tests)
      # ---------------------------------------------------------
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "18"

      - name: Install Dependencies
        run: npm ci

      - name: Run The Trap (Tests)
        id: run_tests
        # Output disimpan ke file untuk dibaca step berikutnya
        run: npm test > test-results.txt 2>&1
        continue-on-error: true

      # ---------------------------------------------------------
      # GATE 4: JUDGMENT & CLOSURE
      # ---------------------------------------------------------
      - name: Judge & Execute Protocol
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            let testLogs = '';
            try { testLogs = fs.readFileSync('test-results.txt', 'utf8'); } catch (e) { testLogs = 'No logs available.'; }

            const outcome = '${{ steps.run_tests.outcome }}';

            if (outcome === 'success') {
              // --- VERIFIED ---
              const msg = `### ✅ AUDIT PASSED: VERIFIED\n\n` +
                          `**Engineering Judgment Confirmed.**\n` +
                          `Your logic survived the trap and your reasoning passed the AI forensic scan.\n\n` +
                          `🔒 **PROTOCOL:** This PR is now **LOCKED** to preserve solution integrity.\n` +
                          `🏆 **PROOF OF WORK:** This URL is your permanent record.`;

              // Label
              try {
                await github.rest.issues.addLabels({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  issue_number: context.issue.number,
                  labels: ['audit-passed', 'verified']
                });
              } catch(e) {}

              // Comment
              await github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: msg
              });

              // Close PR
              await github.rest.pulls.update({
                owner: context.repo.owner,
                repo: context.repo.repo,
                pull_number: context.issue.number,
                state: 'closed'
              });

            } else {
              // --- REJECTED ---
              // Hanya ambil 1500 karakter terakhir dari log untuk komentar agar tidak spam
              const logSnippet = testLogs.slice(0, 1500);

              const msg = `### ❌ AUDIT FAILED\n\n` +
                          `**System Integrity Check:** FAILED.\n` +
                          `Your code did not pass the automated tests.\n\n` +
                          `<details><summary>Expand Error Logs</summary>\n\n` +
                          `\`\`\`\n${logSnippet}...\n\`\`\`\n` +
                          `\n</details>\n\n` +
                          `**Directive:** Debug locally. Do not waste the Auditor's time.`;

              await github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: msg
              });

              core.setFailed("Technical Audit Failed");
            }

      - name: Fail Workflow if Tests Failed
        if: steps.run_tests.outcome != 'success'
        run: exit 1