name: Refresh source-bound baseline

on:
  push:
    branches: [research/connectome-embodiment-20260909]
    paths:
      - ".github/workflows/refresh-source-bound-baseline.yml"
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: baseline-refresh-${{ github.ref }}
  cancel-in-progress: false

jobs:
  refresh:
    if: github.ref_type == 'branch'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          ref: ${{ github.sha }}
      - uses: actions/setup-python@v7
        with:
          python-version: "3.13"
      - name: Install project and development tools
        run: |
          python -m pip install --upgrade pip setuptools wheel
          python -m pip install -e ".[dev,docs]"
      - name: Generate honest source-bound baseline
        run: |
          python -m black --check src tests scripts
          python -m ruff check src tests scripts
          python scripts/generate_baseline.py
          python scripts/generate_determinism_artifact.py
          python scripts/check_doc_consistency.py --check-tests
          python scripts/check_connectome_integrity.py
      - name: Preserve historical scientific records
        run: |
          git diff --exit-code "$GITHUB_SHA" -- research/experiments research/registry/evidence research/publications
      - name: Commit only generated verification without overwriting concurrent work
        env:
          TARGET_BRANCH: ${{ github.ref_name }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add tests/test_baseline.json research/generated/verification
          git diff --cached --check
          if git diff --cached --quiet; then
            exit 0
          fi
          git commit -m "test: refresh genuinely executed source-bound verification"
          git fetch origin "$TARGET_BRANCH"
          test "$(git rev-parse FETCH_HEAD)" = "$GITHUB_SHA"
          git push origin "HEAD:refs/heads/$TARGET_BRANCH"
      - name: Export verification diagnostics
        if: always()
        run: |
          mkdir -p "$RUNNER_TEMP/baseline-verification"
          cp tests/test_baseline.json "$RUNNER_TEMP/baseline-verification/test-baseline.json"
          git rev-parse HEAD > "$RUNNER_TEMP/baseline-verification/HEAD.txt"
          git status --porcelain > "$RUNNER_TEMP/baseline-verification/status.txt"
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: source-bound-baseline
          path: ${{ runner.temp }}/baseline-verification/
          retention-days: 7