version: 1
name: gpuaas-public-policy
mode: enforce

metadata:
  owner: platform-architecture
  description: "Draft ReviewGuard policy aligned to agent_policy.yaml and CI_Enforcement_Checklist.md"

rules:
  - id: RG-CF-001
    name: contract-first-required
    scope: pull_request
    when:
      any_changed:
        - "cmd/**"
        - "packages/services/**"
        - "packages/web/**"
    require:
      any_changed:
        - "doc/api/openapi.draft.yaml"
        - "doc/api/asyncapi.draft.yaml"
    message: "Behavior/API-affecting changes must include contract updates."
    severity: error

  - id: RG-SEC-001
    name: block-hardcoded-secrets
    scope: diff
    deny_patterns:
      - "AKIA[0-9A-Z]{16}"
      - "(?i)secret\\s*=\\s*['\"][^'\"]+['\"]"
      - "(?i)password\\s*=\\s*['\"][^'\"]+['\"]"
      - "(?i)private[_-]?key"
    message: "Potential hardcoded secret found in diff."
    severity: error

  - id: RG-SEC-003
    name: block-query-token-auth-patterns
    scope: diff
    when:
      any_changed:
        - "doc/api/openapi.draft.yaml"
        - "doc/api/asyncapi.draft.yaml"
        - "doc/api/API_Surface.md"
        - "cmd/**"
        - "packages/**"
    deny_patterns:
      - "(?i)\\?token="
      - "(?i)query:\\s*[\\s\\S]{0,120}token:"
    message: "Token-in-query auth patterns are forbidden for security-sensitive operations."
    severity: error

  - id: RG-SEC-002
    name: authz-required-on-admin-routes
    scope: diff
    when:
      any_changed:
        - "cmd/**"
        - "packages/services/**"
    require_patterns:
      # Go + OPA stack: tune this to match your authorization middleware name.
      # Common patterns: RequireAdmin, RequireRole, enforcePolicy, opaCheck, mustBeAdmin.
      - "(?i)(require.?admin|admin.?required|admin.?only|RequireRole|enforcePolicy|mustBeAdmin)"
    message: >
      Admin route changes must preserve explicit server-side authorization checks.
      Tune require_patterns to match the project's authorization middleware function name.
    severity: error

  - id: RG-REL-001
    name: mutation-tests-required
    scope: pull_request
    when:
      any_changed:
        - "cmd/**"
        - "packages/shared/**"
        - "packages/services/**"
    require:
      any_changed:
        - "**/*_test.go"
        - "**/*spec*"
    message: "Backend mutations require test updates."
    severity: error

  - id: RG-COMP-001
    name: breaking-change-note-required
    scope: pull_request
    when:
      any_changed:
        - "doc/api/openapi.draft.yaml"
    require:
      pr_description_contains:
        - "Compatibility Impact"
        - "Breaking Change"
    message: "API spec changes must declare compatibility impact in PR description."
    severity: error

  - id: RG-GOV-001
    name: adr-reference-required-for-arch-changes
    scope: pull_request
    when:
      any_changed:
        - "doc/architecture/Architecture_v1.md"
        - "doc/operations/**"
        - "cmd/**"
        - "packages/shared/**"
    require:
      pr_description_contains:
        - "ADR"
    message: "Architecture-impacting changes require ADR reference."
    severity: warn

advice:
  - "Start with warn mode for noisy rules, promote to error after 1-2 sprints."
  - "Pair this policy with CI scanners/tests from CI_Enforcement_Checklist.md."
  - "Tune regex patterns to reduce false positives before broad rollout."
