reusable-check-files.yaml

## %CopyrightBegin%
##
## SPDX-License-Identifier: Apache-2.0
##
## Copyright Ericsson AB 2024-2026. All Rights Reserved.
##
## Licensed under the Apache License, Version 2.0 (the "License");
## you may not use this file except in compliance with the License.
## You may obtain a copy of the License at
##
##     http://www.apache.org/licenses/LICENSE-2.0
##
## Unless required by applicable law or agreed to in writing, software
## distributed under the License is distributed on an "AS IS" BASIS,
## WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
## See the License for the specific language governing permissions and
## limitations under the License.
##
## %CopyrightEnd%

name: Check modified files for errors
run-name: Check modified files for errors

on:
  workflow_call:
    inputs:
      pr_base_sha:
        description: 'SHA of the PR base commit (github.event.pull_request.base.sha)'
        required: true
        type: string
      pr_head_sha:
        description: 'SHA of the PR head commit (github.event.pull_request.head.sha)'
        required: true
        type: string
      pr_author:
        description: 'Login of the PR author (github.event.pull_request.user.login)'
        required: true
        type: string
      repository:
        description: 'Repository full name (github.repository)'
        required: true
        type: string
    secrets:
      token:
        description: 'GitHub token with repo read access'
        required: true

permissions:
  contents: read

jobs:
  check-files:
    name: Check modified files for errors
    runs-on: ubuntu-latest
    permissions:
      contents: read   # actions/checkout (fetch-depth: 0) + git diff (whitespace + BEAM detection)
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Detect whitespace errors
        env:
          PR_BASE_SHA: ${{ inputs.pr_base_sha }}
          PR_HEAD_SHA: ${{ inputs.pr_head_sha }}
        run: |
          git config --local --add core.whitespace tab-in-indent,-trailing-space
          WHITESPACE_ERRORS=$(git diff --check --merge-base \
                              "$PR_BASE_SHA" \
                              "$PR_HEAD_SHA" \
                              "*.erl" "*.hrl" "*.c" "*.h" "*.cpp" "*.hpp" \
                              || true)
          if [[ -n "$WHITESPACE_ERRORS" ]]; then
             echo "::error::Whitespace errors detected in modified lines."
             echo "::error::Use only spaces for indentation."
             echo "$WHITESPACE_ERRORS"
             exit 1
          fi

      - name: Detect modified BEAM files
        if: inputs.repository == 'erlang/otp'
        env:
          GH_TOKEN:     ${{ secrets.token }}
          PR_AUTHOR:    ${{ inputs.pr_author }}
          PR_BASE_SHA:  ${{ inputs.pr_base_sha }}
          PR_HEAD_SHA:  ${{ inputs.pr_head_sha }}
        run: |
          PERMISSION=$(gh api \
                       -H "Accept: application/vnd.github+json" \
                       -H "X-GitHub-Api-Version: 2022-11-28" \
                       /repos/{owner}/{repo}/collaborators/$PR_AUTHOR/permission --jq '.role_name')

          MODIFIED_BEAM_FILES=$(git diff --name-only --merge-base \
                                         "$PR_BASE_SHA" \
                                         "$PR_HEAD_SHA" \
                                | grep '\.beam$' || true)
          if [[ "$PERMISSION" != "admin" && "$PERMISSION" != "maintain" && "$PERMISSION" != "Security Master" && -n "$MODIFIED_BEAM_FILES" ]]; then
             echo "::error::Workflow failed: Only maintainers can make modifications to '*.beam' files:"
             echo "$MODIFIED_BEAM_FILES"
             exit 1
          fi