ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  validate:
    name: Validate project configs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: "3.12"

      - name: Install PyYAML
        run: pip install pyyaml

      - name: Validate all YAML files
        run: |
          python - <<'EOF'
          import sys, pathlib, yaml
          errors = []
          for f in pathlib.Path("projects").rglob("*.yaml"):
              try:
                  yaml.safe_load(f.read_text())
              except yaml.YAMLError as e:
                  errors.append(f"{f}: {e}")
          if errors:
              print("YAML validation errors:")
              for e in errors:
                  print(f"  {e}")
              sys.exit(1)
          print(f"Validated {sum(1 for _ in pathlib.Path('projects').rglob('*.yaml'))} YAML files OK")
          EOF

      - name: Check machine-profile.yaml exists in each project
        run: |
          python - <<'EOF'
          import sys, pathlib
          errors = []
          checked = 0
          for project in pathlib.Path("projects").iterdir():
              if not project.is_dir():
                  continue
              checked += 1
              mp = project / "machine-profile.yaml"
              if not mp.exists():
                  errors.append(f"{project}: missing machine-profile.yaml")
          if errors:
              print("Missing machine-profile.yaml:")
              for e in errors:
                  print(f"  {e}")
              sys.exit(1)
          print(f"All {checked} project(s) have machine-profile.yaml")
          EOF

      - name: Verify no .anpkg files committed
        run: |
          count=$(find projects -name "*.anpkg" | wc -l)
          if [ "$count" -gt 0 ]; then
            echo "ERROR: .anpkg files must not be committed:"
            find projects -name "*.anpkg"
            exit 1
          fi
          echo "No .anpkg files found — OK"

  ok:
    name: ok
    if: always()
    needs: [validate]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Evaluate job results
        run: |
          echo "Job results: ${{ toJSON(needs.*.result) }}"
      - name: Fail if any required job failed or was cancelled
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: exit 1