# Drift guard for the shipped engineering-skill copies (#2431).
# ci.yml carries `paths-ignore: ['**.md', ...]`, so an md-only skill edit —
# the most common future edit to these trees — would otherwise merge without
# gitnexus/test/unit/shipped-skills-sync.test.ts ever running, and the drift
# would first surface in someone else's CI run. This workflow triggers
# exactly on the guarded trees.
name: Skill copy sync

on:
  pull_request:
    paths:
      - '.claude/skills/gitnexus-*/**'
      - '.claude/skills/gitnexus/**'
      - 'gitnexus/skills/**'
      - 'gitnexus-claude-plugin/skills/**'
      - 'gitnexus-cursor-integration/skills/**'
      - 'gitnexus/test/unit/shipped-skills-sync.test.ts'
      - 'gitnexus/test/unit/skills-steering.test.ts'
      - 'gitnexus/test/unit/engineering-skills-contract.test.ts'
      - 'gitnexus/test/unit/evidence-provenance-helper.test.ts'
      - '.github/workflows/skill-sync.yml'
  push:
    branches: [main]
    paths:
      - '.claude/skills/gitnexus-*/**'
      - '.claude/skills/gitnexus/**'
      - 'gitnexus/skills/**'
      - 'gitnexus-claude-plugin/skills/**'
      - 'gitnexus-cursor-integration/skills/**'
      - 'gitnexus/test/unit/shipped-skills-sync.test.ts'
      - 'gitnexus/test/unit/skills-steering.test.ts'
      - 'gitnexus/test/unit/engineering-skills-contract.test.ts'
      - 'gitnexus/test/unit/evidence-provenance-helper.test.ts'
      - '.github/workflows/skill-sync.yml'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  skill-sync:
    name: shipped skills drift guard
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      # persist-credentials: false — runs a read-only test, never pushes.
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: gitnexus/package-lock.json
      - name: Build gitnexus-shared
        run: npm ci && npm run build
        working-directory: gitnexus-shared
      - name: Install gitnexus
        run: npm ci
        working-directory: gitnexus
      - name: Run distribution, steering, and engineering-contract guards
        run: >-
          npx vitest run
          test/unit/shipped-skills-sync.test.ts
          test/unit/skills-steering.test.ts
          test/unit/engineering-skills-contract.test.ts
          test/unit/evidence-provenance-helper.test.ts
        working-directory: gitnexus