name: DAST smoke (PR)
on:
  pull_request:
    branches: ["main", "release/**"]
permissions:
  contents: read
jobs:
  dast-smoke:
    runs-on: ubuntu-latest
    # ADVISORY while this new gate matures (repo convention: advisory -> blocking).
    # Flip to blocking (remove continue-on-error) once it's proven stable across a few PRs.
    continue-on-error: true
    timeout-minutes: 12
    env:
      JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
      API_KEY_SECRET: ci-api-key-secret-with-sufficient-length-aaaa
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "24"
          cache: npm
      - run: npm ci
      - name: Build CLI bundle
        run: npm run build:cli
      - name: Start OmniRoute
        env:
          PORT: "20128"
          INJECTION_GUARD_MODE: block
        run: |
          node dist/server.js > server.log 2>&1 &
          echo $! > server.pid
          for _ in $(seq 1 30); do
            if curl -sf http://localhost:20128/api/monitoring/health >/dev/null; then echo up; break; fi
            sleep 2
          done
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"
      - run: pip install schemathesis
      - name: Schemathesis smoke (high-risk endpoints, blocking)
        run: |
          schemathesis run docs/openapi.yaml --url http://localhost:20128 \
            --include-path-regex '^/v1/(chat/completions|models)$|^/api/(auth|keys)' \
            --max-examples 8 --workers 4 --checks all --max-response-time 30 \
            --request-timeout 20 --suppress-health-check all --no-color
      - name: promptfoo injection-guard (blocking)
        env:
          OMNIROUTE_URL: http://localhost:20128
          OMNIROUTE_API_KEY: not-needed-blocked-before-upstream
        run: npx --yes promptfoo@latest eval -c promptfooconfig.yaml --no-cache
      - name: Stop server
        if: always()
        run: kill "$(cat server.pid)" || true
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: dast-smoke-logs
          path: server.log
          retention-days: 7