ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  quality:
    name: Repository quality
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Reject committed local artifacts
        run: |
          if git ls-files \
            | grep -E '(^|/)\.DS_Store$|(^|/)logs/|\.log$'; then
            echo "Local artifacts (.DS_Store, logs/, *.log) must not be committed."
            exit 1
          fi
          echo "No committed local artifacts."

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: .node-version

      - name: Install system validation tools
        run: |
          sudo apt-get update
          sudo apt-get install --yes ca-certificates curl python3-venv
          python3 -m venv "$RUNNER_TEMP/pre-commit"
          "$RUNNER_TEMP/pre-commit/bin/pip" install pre-commit==4.6.2
          echo "$RUNNER_TEMP/pre-commit/bin" >> "$GITHUB_PATH"
          npm install --global markdownlint-cli2@0.23.3

          # v1.7.12: digest published with the GitHub release asset.
          curl -fsSL \
            https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz \
            -o "$RUNNER_TEMP/actionlint.tar.gz"
          echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  $RUNNER_TEMP/actionlint.tar.gz" | sha256sum --check
          mkdir -p "$RUNNER_TEMP/actionlint"
          tar -xzf "$RUNNER_TEMP/actionlint.tar.gz" -C "$RUNNER_TEMP/actionlint"
          sudo install \
            "$(find "$RUNNER_TEMP/actionlint" -type f -name actionlint -print -quit)" \
            /usr/local/bin/actionlint

          # lychee-v0.24.2: digest published with the GitHub release asset.
          curl -fsSL \
            https://github.com/lycheeverse/lychee/releases/download/lychee-v0.24.2/lychee-x86_64-unknown-linux-gnu.tar.gz \
            -o "$RUNNER_TEMP/lychee.tar.gz"
          echo "1f4e0ef7f6554a6ed33dd7ac144fb2e1bbed98598e7af973042fc5cd43951c9a  $RUNNER_TEMP/lychee.tar.gz" | sha256sum --check
          mkdir -p "$RUNNER_TEMP/lychee"
          tar -xzf "$RUNNER_TEMP/lychee.tar.gz" -C "$RUNNER_TEMP/lychee"
          sudo install \
            "$(find "$RUNNER_TEMP/lychee" -type f -name lychee -print -quit)" \
            /usr/local/bin/lychee

          # v4.0.2: digest published with the GitHub release asset.
          curl -fsSL \
            https://github.com/editorconfig-checker/editorconfig-checker/releases/download/v4.0.2/editorconfig-checker-linux-amd64.tar.gz \
            -o "$RUNNER_TEMP/editorconfig-checker.tar.gz"
          echo "44efaef3ed14c6ab52eb87481d78e5e5c204796dccf26e2f4598a61ba17f8003  $RUNNER_TEMP/editorconfig-checker.tar.gz" | sha256sum --check
          mkdir -p "$RUNNER_TEMP/editorconfig-checker"
          tar -xzf "$RUNNER_TEMP/editorconfig-checker.tar.gz" -C "$RUNNER_TEMP/editorconfig-checker"
          sudo install \
            "$(find "$RUNNER_TEMP/editorconfig-checker" -type f -name editorconfig-checker -print -quit)" \
            /usr/local/bin/editorconfig-checker

      - name: Install Node dependencies
        run: npm ci

      - name: Run test suite
        run: npm test

      - name: Lint commit messages
        env:
          CI_EVENT: ${{ github.event_name }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PUSH_BEFORE_SHA: ${{ github.event.before }}
          PUSH_AFTER_SHA: ${{ github.sha }}
        run: bash scripts/lint-commit-msg.sh --ci

      - name: Cache pre-commit environments
        uses: actions/cache@v6
        with:
          path: ~/.cache/pre-commit
          key: >-
            pre-commit-${{ runner.os }}-${{
            hashFiles('.pre-commit-config.yaml') }}

      - name: Run repository quality checks
        run: pre-commit run --all-files --show-diff-on-failure