ci.yml

name: ci

on:
  push:
    branches: [main, master]
  pull_request:

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest

    steps:
      - name: Check out source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install actionlint
        run: |
          ACTIONLINT_VERSION="1.7.7"
          curl -fsSL -o /tmp/actionlint.tar.gz \
            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
          tar -xzf /tmp/actionlint.tar.gz -C /tmp
          sudo mv /tmp/actionlint /usr/local/bin/actionlint

      - name: Lint GitHub Actions workflows
        run: actionlint

      - name: Lint shell scripts
        run: |
          sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck >/dev/null
          shellcheck scripts/*.sh

      - name: Syntax-check shell scripts
        run: |
          for f in scripts/*.sh; do
            bash -n "$f"
            echo "  $f: syntax OK"
          done

      - name: Validate YAML templates
        run: |
          python3 -c "
          import yaml, glob, sys
          errors = 0
          for f in glob.glob('templates/*.yaml'):
              try:
                  yaml.safe_load(open(f))
                  print(f'  {f}: valid YAML')
              except yaml.YAMLError as e:
                  print(f'  {f}: INVALID - {e}', file=sys.stderr)
                  errors += 1
          sys.exit(errors)
          "