full-verify.yml

name: full-verify

# The single, unconditional "is the whole repo green" check — unlike the other
# workflows (draft.yml, publisher.yml, consumer.yml, validate-examples.yml,
# example-scripts.yml), which are path-filtered to their own area, this one
# always runs on every push/PR to main and re-verifies every area in one place.
# Intended as the required status check for branch protection.

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch: {}

jobs:
  draft:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with: { ruby-version: "3.2" }
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: gem install kramdown-rfc2629
      - run: python3 -m pip install xml2rfc
      - name: Build and strict-check the latest draft
        run: |
          set -e
          cd internet-drafts
          md=$(ls draft-besleaga-sustainability-wellknown-*.md | sort | tail -1)
          base="${md%.md}"
          kramdown-rfc "$md" > "$base.xml"
          xml2rfc --strict --text "$base.xml" -o "$base.txt"
      - name: idnits (0 errors required)
        run: |
          cd internet-drafts
          md=$(ls draft-besleaga-sustainability-wellknown-*.md | sort | tail -1)
          base="${md%.md}"
          npx --yes @ietf-tools/idnits "$base.xml" | tee /tmp/idnits.out
          ! grep -qE '^ *ERROR' /tmp/idnits.out

  schemas:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - uses: ruby/setup-ruby@v1
        with: { ruby-version: "3.2" }
      - run: python3 -m pip install jtd
      - run: gem install cddl
      - name: Validate every example response (both validators)
        working-directory: schemas-validators
        run: bash validate-all.sh
      # Three-way schema equality (schemas-validators/response-schema.json ==
      # publisher/src/schema.ts == consumer/src/schema.ts) is enforced by each
      # package's own test suite: publisher/test/conformance.test.ts and
      # consumer/test/schema.test.ts both assert their embedded TS schema is
      # byte-identical to the repo JSON. Those run in the `publisher`/`consumer`
      # jobs below (via `npm test`), so no separate equality step is needed here.

  publisher:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: publisher
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: "22", cache: npm, cache-dependency-path: publisher/package-lock.json }
      - run: npm ci || npm install
      - run: npm run typecheck
      - run: npm run build
      - run: npm test
      - run: npm publish --dry-run

  consumer:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: "22" }
      - name: Build publisher (consumer's interop test needs its dist/)
        working-directory: publisher
        run: npm ci || npm install; npm run build
      - name: Build and test consumer
        working-directory: consumer
        run: |
          npm ci || npm install
          npm run typecheck
          npm run build
          npm test
      - name: Dry-run publish
        working-directory: consumer
        run: npm publish --dry-run

  example-scripts-and-server-configs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - uses: actions/setup-node@v4
        with: { node-version: "22" }
      - uses: shivammathur/setup-php@v2
        with: { php-version: "8.3" }
      - uses: ruby/setup-ruby@v1
        with: { ruby-version: "3.2" }
      - run: python3 -m pip install jtd
      - run: gem install cddl
      - name: example-scripts test suites
        working-directory: example-scripts
        run: |
          python3 test_security.py
          node test_security.js
          php test_security.php
          python3 test_request_handler.py
      - name: Install nginx and apache2
        run: sudo apt-get update -qq && sudo apt-get install -y nginx apache2
      - name: Live server-configuration check (see server-configurations/README.md)
        run: |
          set -e
          mkdir -p /tmp/nginx-fv/logs /tmp/nginx-fv/run /tmp/nginx-fv/tmp
          echo '{"version":"2.0","test":true}' > /tmp/nginx-fv/sustainability.json
          { echo 'worker_processes 1; pid /tmp/nginx-fv/run/nginx.pid; error_log /tmp/nginx-fv/logs/error.log;'; \
            echo 'events{worker_connections 16;} http{ access_log /tmp/nginx-fv/logs/access.log;'; \
            echo 'client_body_temp_path /tmp/nginx-fv/tmp/body; proxy_temp_path /tmp/nginx-fv/tmp/proxy;'; \
            echo 'fastcgi_temp_path /tmp/nginx-fv/tmp/fastcgi; uwsgi_temp_path /tmp/nginx-fv/tmp/uwsgi; scgi_temp_path /tmp/nginx-fv/tmp/scgi;'; \
            echo 'server{ listen 127.0.0.1:8099;'; \
            sed 's#/var/www/metadata/sustainability.json#/tmp/nginx-fv/sustainability.json#' server-configurations/nginx.conf | grep -v '^#'; \
            echo '} }'; } > /tmp/nginx-fv/nginx.conf
          nginx -t -c /tmp/nginx-fv/nginx.conf
          nginx -c /tmp/nginx-fv/nginx.conf
          sleep 1
          [ "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8099/.well-known/sustainability-data)" = "200" ]
          curl -s -D - -o /dev/null http://127.0.0.1:8099/.well-known/sustainability-data | grep -qi '^Access-Control-Allow-Origin: \*'
          curl -s -D - -o /dev/null -X POST http://127.0.0.1:8099/.well-known/sustainability-data | grep -qi '^Allow: GET, HEAD'
          nginx -s stop -c /tmp/nginx-fv/nginx.conf

      - name: Apache config check
        run: |
          set -e
          mkdir -p /tmp/apache-fv/logs /tmp/apache-fv/run /tmp/apache-fv/htdocs
          echo '{"version":"2.0","test":true}' > /tmp/apache-fv/htdocs/sustainability.json
          echo '{"error":"method not allowed"}' > /tmp/apache-fv/htdocs/sustainability-405.json
          cat > /tmp/apache-fv/httpd.conf <<EOF
          ServerRoot "/tmp/apache-fv"
          Listen 127.0.0.1:8098
          PidFile "/tmp/apache-fv/run/httpd.pid"
          ErrorLog "/tmp/apache-fv/logs/error.log"
          LoadModule mpm_event_module /usr/lib/apache2/modules/mod_mpm_event.so
          LoadModule authz_core_module /usr/lib/apache2/modules/mod_authz_core.so
          LoadModule alias_module /usr/lib/apache2/modules/mod_alias.so
          LoadModule headers_module /usr/lib/apache2/modules/mod_headers.so
          LoadModule rewrite_module /usr/lib/apache2/modules/mod_rewrite.so
          LoadModule mime_module /usr/lib/apache2/modules/mod_mime.so
          User $(whoami)
          Group $(id -gn)
          ServerName localhost
          TypesConfig /etc/mime.types
          EOF
          sed "s#/var/www/metadata/sustainability-405.json#/tmp/apache-fv/htdocs/sustainability-405.json#; s#/var/www/metadata/sustainability.json#/tmp/apache-fv/htdocs/sustainability.json#" \
            server-configurations/apache.conf | grep -v '^#' >> /tmp/apache-fv/httpd.conf
          apache2 -f /tmp/apache-fv/httpd.conf -t
          apache2 -f /tmp/apache-fv/httpd.conf -k start
          sleep 1
          [ "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8098/.well-known/sustainability-data)" = "200" ]
          curl -s -D - -o /dev/null http://127.0.0.1:8098/.well-known/sustainability-data | grep -qi '^Access-Control-Allow-Origin: \*'
          post=$(curl -s -D - -o /dev/null -X POST http://127.0.0.1:8098/.well-known/sustainability-data)
          echo "$post" | grep -qi "^Allow: GET, HEAD"
          apache2 -f /tmp/apache-fv/httpd.conf -k stop

  summary:
    needs: [draft, schemas, publisher, consumer, example-scripts-and-server-configs]
    runs-on: ubuntu-latest
    steps:
      - run: |
          echo "All areas verified green: draft, schemas, publisher, consumer, example-scripts, server-configurations."