gatekeeper.yml

name: CI Gatekeeper

on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main

concurrency:
  group: ci-gatekeeper-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  changes:
    name: Detect changes
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      js: ${{ steps.filter.outputs.js }}
      contracts: ${{ steps.filter.outputs.contracts }}
      agw-client: ${{ steps.filter.outputs.agw-client }}
      publish-surface: ${{ steps.filter.outputs.publish-surface }}
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Paths filter
        id: filter
        uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
        with:
          filters: |
            js:
              - 'package.json'
              - 'pnpm-lock.yaml'
              - 'pnpm-workspace.yaml'
              - 'turbo.json'
              - 'tsconfig.base.json'
              - 'biome.json'
              - 'vitest.workspace.ts'
              - '.npmrc'
              - 'packages/**'
              - 'apps/**'
              - 'examples/**'
              - '.github/scripts/**'
              - '.github/workflows/ci-verify.yml'
              - '.github/workflows/gatekeeper.yml'
            contracts:
              - 'packages/contracts/**'
              - '.github/workflows/ci-contracts.yml'
              - '.github/workflows/gatekeeper.yml'
            agw-client:
              - 'packages/agw-client/**'
              - '.github/workflows/ci-agw-client.yml'
              - '.github/workflows/gatekeeper.yml'
            publish-surface:
              - 'package.json'
              - 'pnpm-lock.yaml'
              - 'pnpm-workspace.yaml'
              - 'turbo.json'
              - 'tsconfig.base.json'
              - 'biome.json'
              - 'vitest.workspace.ts'
              - '.npmrc'
              - '.changeset/**'
              - 'packages/mpp/**'
              - 'packages/agw-client/**'
              - 'packages/agw-react/**'
              - 'packages/agw-thirdweb/**'
              - 'packages/agw-web/**'
              - 'packages/web3-react-agw/**'
              - 'packages/agw-cli/**'
              - '.github/scripts/**'
              - '.github/workflows/ci-release-surface.yml'
              - '.github/workflows/release-pr.yml'
              - '.github/workflows/publish.yml'
              - '.github/workflows/gatekeeper.yml'

  detect-publishable:
    name: Detect publishable release
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    outputs:
      should_publish: ${{ steps.detect.outputs.should_publish }}
      packages_json: ${{ steps.detect.outputs.packages_json }}
      summary_markdown: ${{ steps.detect.outputs.summary_markdown }}
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24

      - name: Detect publishable packages
        id: detect
        run: node .github/scripts/detect-publishable.mjs

  changesets:
    name: Changeset Check
    if: github.event_name == 'pull_request' && !startsWith(github.head_ref, 'changeset-release/') && needs.changes.outputs.publish-surface == 'true'
    needs: changes
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
        with:
          package_json_file: package.json

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Require changeset for publishable changes
        run: |
          git fetch origin "${{ github.base_ref }}" --depth=1
          pnpm exec changeset status --since="origin/${{ github.base_ref }}"

  verify:
    needs: changes
    if: github.event_name == 'workflow_dispatch' || needs.changes.outputs.js == 'true'
    uses: ./.github/workflows/ci-verify.yml
    with:
      event_name: ${{ github.event_name }}
    secrets: inherit

  contracts:
    needs: changes
    if: github.event_name == 'workflow_dispatch' || needs.changes.outputs.contracts == 'true'
    uses: ./.github/workflows/ci-contracts.yml
    secrets: inherit

  agw-client:
    needs:
      - changes
      - detect-publishable
    if: |
      always() &&
      needs.changes.result == 'success' &&
      (github.event_name == 'workflow_dispatch' ||
        needs.changes.outputs.agw-client == 'true' ||
        needs.detect-publishable.outputs.should_publish == 'true')
    uses: ./.github/workflows/ci-agw-client.yml
    secrets: inherit

  release-surface:
    needs:
      - changes
      - detect-publishable
    if: |
      always() &&
      needs.changes.result == 'success' &&
      (github.event_name == 'workflow_dispatch' ||
        needs.changes.outputs.publish-surface == 'true' ||
        needs.detect-publishable.outputs.should_publish == 'true')
    uses: ./.github/workflows/ci-release-surface.yml
    secrets: inherit

  publish:
    name: Publish
    needs:
      - detect-publishable
      - release-surface
      - agw-client
    if: |
      github.event_name == 'push' &&
      github.ref == 'refs/heads/main' &&
      needs.detect-publishable.outputs.should_publish == 'true' &&
      needs.release-surface.result == 'success' &&
      needs.agw-client.result == 'success'
    permissions:
      contents: write
      id-token: write
    uses: ./.github/workflows/publish.yml
    secrets: inherit

  ci-gatekeeper:
    name: CI Gatekeeper
    runs-on: ubuntu-latest
    if: always()
    needs:
      - changesets
      - verify
      - contracts
      - agw-client
      - release-surface
      - detect-publishable
      - publish
    steps:
      - name: Verify job results
        run: |
          set -euo pipefail
          results="${{ needs.changesets.result || 'skipped' }} ${{ needs.verify.result || 'skipped' }} ${{ needs.contracts.result || 'skipped' }} ${{ needs.agw-client.result || 'skipped' }} ${{ needs.release-surface.result || 'skipped' }} ${{ needs.detect-publishable.result || 'skipped' }} ${{ needs.publish.result || 'skipped' }}"
          echo "Job results: $results"

          if [[ "$results" =~ failure || "$results" =~ cancelled ]]; then
            echo "One or more required jobs failed or were cancelled."
            exit 1
          fi