name: Legacy Eval Flows Removed

on:
  pull_request:

permissions:
  contents: read

jobs:
  guard-legacy-eval-flows:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout pull request head
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Fetch base commit
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: git cat-file -e "$BASE_SHA^{commit}" 2>/dev/null || git fetch --no-tags --depth=1 origin "$BASE_SHA"

      - name: Enforce removed legacy flows
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          if [[ -e evals/flows ]]; then
            printf '%s\n' "Legacy flows were removed; evals/flows/ must not exist."
            exit 1
          fi

          violations=()
          while IFS= read -r -d '' status && IFS= read -r -d '' first_path; do
            second_path=""
            if [[ "$status" == R* || "$status" == C* ]]; then
              IFS= read -r -d '' second_path
            fi

            added_path=""
            if [[ "$status" == A* ]]; then
              added_path="$first_path"
            elif [[ "$status" == R* || "$status" == C* ]]; then
              added_path="$second_path"
            fi

            if [[ "$added_path" == *.flow.mjs || "$added_path" == *.flow.ts ]]; then
              violation="$status"$'\t'"$first_path"
              if [[ -n "$second_path" ]]; then
                violation+=$'\t'"$second_path"
              fi
              violations+=("$violation")
            fi
          done < <(git diff --name-status -z --find-renames --find-copies-harder "$BASE_SHA...$HEAD_SHA")

          if (( ${#violations[@]} > 0 )); then
            printf '%s\n' "Legacy flows were removed; adding *.flow.mjs or *.flow.ts files is not allowed."
            printf '  %s\n' "${violations[@]}"
            printf '%s\n' "Put new executable end-to-end coverage in evals/specs/**/*.test.ts and import test from @openwork/testkit."
            exit 1
          fi
          printf '%s\n' "Legacy flows remain removed and no flow files were added."