name: Workflow Sanity

on:
  pull_request:
    paths-ignore:
      - "CHANGELOG.md"
  push:
    branches: [main]
    paths-ignore:
      - "CHANGELOG.md"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:
  no-tabs:
    if: github.event_name != 'workflow_dispatch'
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        env:
          CHECKOUT_REPO: ${{ github.repository }}
          CHECKOUT_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          git init "$GITHUB_WORKSPACE"
          git -C "$GITHUB_WORKSPACE" config gc.auto 0
          git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
          timeout --signal=TERM --kill-after=10s 30s git -C "$GITHUB_WORKSPACE" \
            -c protocol.version=2 \
            fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
            "+${CHECKOUT_SHA}:refs/remotes/origin/checkout"
          git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout

      - name: Fail on tabs in workflow files
        run: |
          python - <<'PY'
          from __future__ import annotations

          import pathlib
          import sys

          root = pathlib.Path(".github/workflows")
          bad: list[str] = []
          for path in sorted(root.rglob("*.yml")):
            if b"\t" in path.read_bytes():
              bad.append(str(path))

          for path in sorted(root.rglob("*.yaml")):
            if b"\t" in path.read_bytes():
              bad.append(str(path))

          if bad:
            print("Tabs found in workflow file(s):")
            for path in bad:
              print(f"- {path}")
            sys.exit(1)
          PY

  actionlint:
    if: github.event_name != 'workflow_dispatch'
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        env:
          CHECKOUT_REPO: ${{ github.repository }}
          CHECKOUT_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          git init "$GITHUB_WORKSPACE"
          git -C "$GITHUB_WORKSPACE" config gc.auto 0
          git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
          timeout --signal=TERM --kill-after=10s 30s git -C "$GITHUB_WORKSPACE" \
            -c protocol.version=2 \
            fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
            "+${CHECKOUT_SHA}:refs/remotes/origin/checkout"
          git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout

      - name: Install actionlint
        shell: bash
        run: |
          set -euo pipefail
          ACTIONLINT_VERSION="1.7.11"
          archive="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
          base_url="https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}"
          # GitHub release downloads occasionally return transient 5xx responses.
          # Retry all curl errors here so workflow-sanity does not fail closed on
          # a one-off release edge outage.
          curl --retry 5 --retry-delay 2 --retry-all-errors -sSfL -o "${archive}" "${base_url}/${archive}"
          curl --retry 5 --retry-delay 2 --retry-all-errors -sSfL -o checksums.txt "${base_url}/actionlint_${ACTIONLINT_VERSION}_checksums.txt"
          grep " ${archive}\$" checksums.txt | sha256sum -c -
          tar -xzf "${archive}" actionlint
          sudo install -m 0755 actionlint /usr/local/bin/actionlint

      - name: Lint workflows
        run: actionlint

      - name: Disallow direct inputs interpolation in composite run blocks
        run: python3 scripts/check-composite-action-input-interpolation.py

      - name: Disallow tracked merge conflict markers
        run: node scripts/check-no-conflict-markers.mjs

  generated-doc-baselines:
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        env:
          CHECKOUT_REPO: ${{ github.repository }}
          CHECKOUT_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          git init "$GITHUB_WORKSPACE"
          git -C "$GITHUB_WORKSPACE" config gc.auto 0
          git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
          timeout --signal=TERM --kill-after=10s 30s git -C "$GITHUB_WORKSPACE" \
            -c protocol.version=2 \
            fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
            "+${CHECKOUT_SHA}:refs/remotes/origin/checkout"
          git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout

      - name: Setup Node environment
        uses: ./.github/actions/setup-node-env
        with:
          install-bun: "false"

      - name: Check config docs drift statefile
        run: pnpm config:docs:check

      - name: Check plugin SDK API baseline drift
        run: pnpm plugin-sdk:api:check
