name: HFT System Validation Pipeline
# Critical production safety pipeline for Foxhunt HFT System
# Agent 7 - System Validator Implementation

on:
  push:
    branches: [ "main", "master", "develop" ]
  pull_request:
    branches: [ "main", "master" ]

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  # CRITICAL GATE 1: Zero-Tolerance Compilation Check
  compilation_gate:
    name: "🚨 CRITICAL: Zero-Tolerance Compilation Gate"
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        
      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: stable
          override: true
          components: rustfmt, clippy
          
      - name: Cache cargo registry
        uses: actions/cache@v3
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          
      - name: 🔥 CRITICAL CHECK - Workspace Compilation (ZERO ERRORS ALLOWED)
        run: |
          echo "::error::Testing workspace compilation - ANY ERROR WILL FAIL THE BUILD"
          cargo check --workspace --all-targets --verbose
          echo "::notice::✅ Compilation check passed - proceeding to next gate"
          
      - name: 🔥 CRITICAL CHECK - Individual Service Compilation
        run: |
          echo "::group::Testing individual services"
          services=("trading-engine" "broker-connector" "persistence" "market-data" "risk-management" "data-aggregator")
          failed_services=()
          
          for service in "${services[@]}"; do
            echo "Testing service: $service"
            if [ -f "services/$service/Cargo.toml" ]; then
              if ! cargo check --manifest-path="services/$service/Cargo.toml" --verbose; then
                failed_services+=("$service")
              fi
            else
              echo "::warning::Service $service does not have Cargo.toml"
            fi
          done
          
          if [ ${#failed_services[@]} -ne 0 ]; then
            echo "::error::Services failed compilation: ${failed_services[*]}"
            exit 1
          fi
          echo "::endgroup::"

  # CRITICAL GATE 2: Code Quality Enforcement
  quality_gate:
    name: "🔍 CRITICAL: Code Quality Gate"
    runs-on: ubuntu-latest
    needs: compilation_gate
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        
      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: stable
          override: true
          components: rustfmt, clippy
          
      - name: Cache cargo registry
        uses: actions/cache@v3
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          
      - name: 🚨 CRITICAL CHECK - Strict Linting (ZERO WARNINGS ALLOWED)
        run: |
          echo "::error::Running clippy with ZERO tolerance for warnings"
          cargo clippy --workspace --all-targets --all-features -- -D warnings
          echo "::notice::✅ Clippy check passed with zero warnings"
          
      - name: 🚨 CRITICAL CHECK - Code Formatting
        run: |
          echo "::error::Checking code formatting"
          cargo fmt --all -- --check
          echo "::notice::✅ Code formatting check passed"

  # CRITICAL GATE 3: Placeholder Detection (Production Safety)
  placeholder_detection:
    name: "🚫 CRITICAL: Placeholder Implementation Detection"
    runs-on: ubuntu-latest
    needs: compilation_gate
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        
      - name: 🚨 CRITICAL CHECK - TODO/FIXME Detection (ZERO ALLOWED)
        run: |
          echo "::group::Searching for placeholder implementations"
          
          # Search for TODO/FIXME/unimplemented patterns
          todo_count=$(git grep -E 'TODO|FIXME|unimplemented!|panic!' -- '*.rs' | wc -l || echo "0")
          
          if [ "$todo_count" -gt 0 ]; then
            echo "::error::Found $todo_count placeholder implementations - NOT PRODUCTION READY"
            echo "::group::Placeholder implementations found:"
            git grep -n -E 'TODO|FIXME|unimplemented!|panic!' -- '*.rs' || true
            echo "::endgroup::"
            exit 1
          else
            echo "::notice::✅ No placeholder implementations found"
          fi
          echo "::endgroup::"
          
      - name: 🚨 CRITICAL CHECK - Production Warning Detection
        run: |
          echo "::group::Searching for production warning comments"
          
          # Search for production-specific warning comments
          prod_warnings=$(git grep -i -E 'in real production|for production|production only|prod.*todo' -- '*.rs' | wc -l || echo "0")
          
          if [ "$prod_warnings" -gt 0 ]; then
            echo "::error::Found $prod_warnings production warning comments"
            echo "::group::Production warnings found:"
            git grep -n -i -E 'in real production|for production|production only|prod.*todo' -- '*.rs' || true
            echo "::endgroup::"
            exit 1
          else
            echo "::notice::✅ No production warning comments found"
          fi
          echo "::endgroup:"

  # GATE 4: Security Audit
  security_audit:
    name: "🔒 Security Audit Gate"
    runs-on: ubuntu-latest
    needs: [compilation_gate, quality_gate]
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        
      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: stable
          override: true
          
      - name: Install cargo-audit
        run: cargo install cargo-audit
        
      - name: 🔍 Security Vulnerability Scan
        run: |
          echo "::group::Running security audit"
          cargo audit
          echo "::endgroup::"
          
      - name: 🔍 Dependency License Check
        run: |
          echo "::group::Checking dependency licenses"
          # Install cargo-license if needed for license checking
          # This is optional but recommended for HFT systems
          cargo tree --format "{p} {l}" | grep -v "^[[:space:]]*$" > licenses.txt
          echo "::notice::Dependency licenses logged"
          echo "::endgroup::"

  # GATE 5: Testing Gate
  testing_gate:
    name: "🧪 Comprehensive Testing Gate"
    runs-on: ubuntu-latest
    needs: [compilation_gate, quality_gate, placeholder_detection]
    
    strategy:
      matrix:
        rust: [stable]
        
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        
      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: ${{ matrix.rust }}
          override: true
          
      - name: Cache cargo registry
        uses: actions/cache@v3
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          
      - name: 🧪 Run Unit Tests
        run: |
          echo "::group::Running unit tests"
          cargo test --workspace --lib --bins --verbose
          echo "::endgroup::"
          
      - name: 🧪 Run Integration Tests
        run: |
          echo "::group::Running integration tests"
          cargo test --workspace --test '*' --verbose
          echo "::endgroup::"
          
      - name: 🧪 Run Documentation Tests
        run: |
          echo "::group::Running documentation tests"
          cargo test --workspace --doc --verbose
          echo "::endgroup::"

  # GATE 6: Build Verification
  build_verification:
    name: "🔨 Build Verification Gate"
    runs-on: ubuntu-latest
    needs: [compilation_gate, quality_gate, placeholder_detection]
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        
      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: stable
          override: true
          
      - name: Cache cargo registry
        uses: actions/cache@v3
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          
      - name: 🔨 Build All Targets
        run: |
          echo "::group::Building all workspace targets"
          cargo build --workspace --all-targets --verbose
          echo "::endgroup::"
          
      - name: 🔨 Build Release Mode
        run: |
          echo "::group::Building in release mode"
          cargo build --workspace --release --verbose
          echo "::endgroup::"

  # FINAL GATE: Production Readiness Assessment
  production_readiness:
    name: "🚀 Production Readiness Assessment"
    runs-on: ubuntu-latest
    needs: [compilation_gate, quality_gate, placeholder_detection, security_audit, testing_gate, build_verification]
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        
      - name: 📊 Generate System Health Report
        run: |
          echo "::group::System Health Assessment"
          echo "=== FOXHUNT HFT SYSTEM - PRODUCTION READINESS REPORT ==="
          echo "Date: $(date)"
          echo "Commit: ${{ github.sha }}"
          echo "Branch: ${{ github.ref_name }}"
          echo
          echo "✅ Compilation Gate: PASSED"
          echo "✅ Code Quality Gate: PASSED" 
          echo "✅ Placeholder Detection: PASSED"
          echo "✅ Security Audit: PASSED"
          echo "✅ Testing Gate: PASSED"
          echo "✅ Build Verification: PASSED"
          echo
          echo "🎉 ALL CRITICAL GATES PASSED - SYSTEM READY FOR NEXT PHASE"
          echo "::endgroup::"
          
      - name: 🚨 Critical Reminder
        run: |
          echo "::notice title=Production Deployment Reminder::⚠️ PASSING CI DOES NOT MEAN PRODUCTION READY ⚠️"
          echo "::notice::Additional validation required: End-to-end testing, performance validation, disaster recovery testing"
          echo "::notice::See SYSTEM_VALIDATION_STRATEGY.md for complete production readiness checklist"

  # NOTIFICATION: Results Summary  
  notify_results:
    name: "📢 Results Notification"
    runs-on: ubuntu-latest
    if: always()
    needs: [compilation_gate, quality_gate, placeholder_detection, security_audit, testing_gate, build_verification, production_readiness]
    
    steps:
      - name: 📊 Pipeline Results Summary
        run: |
          echo "=== PIPELINE EXECUTION SUMMARY ==="
          echo "Compilation Gate: ${{ needs.compilation_gate.result }}"
          echo "Quality Gate: ${{ needs.quality_gate.result }}"  
          echo "Placeholder Detection: ${{ needs.placeholder_detection.result }}"
          echo "Security Audit: ${{ needs.security_audit.result }}"
          echo "Testing Gate: ${{ needs.testing_gate.result }}"
          echo "Build Verification: ${{ needs.build_verification.result }}"
          echo "Production Readiness: ${{ needs.production_readiness.result }}"
          echo
          if [ "${{ needs.compilation_gate.result }}" != "success" ] || 
             [ "${{ needs.quality_gate.result }}" != "success" ] || 
             [ "${{ needs.placeholder_detection.result }}" != "success" ]; then
            echo "🚨 CRITICAL FAILURES DETECTED - DEPLOYMENT BLOCKED"
            exit 1
          else
            echo "✅ All critical gates passed - System validation successful"
          fi