ci.yml

name: CI

on:
  pull_request:
    paths-ignore:
      - '**.md'
      - '.github/skills/**'
      - '.github/agents/**'
  push:
    branches:
      - main
    paths-ignore:
      - '**.md'
      - '.github/skills/**'
      - '.github/agents/**'

permissions:
  contents: read

jobs:
  shellcheck:
    name: ShellCheck bash scripts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1

      - name: Run ShellCheck on all .sh scripts
        run: |
          set -euo pipefail
          # severity=warning: fail on real bugs, not pre-existing style/info nits (SC2086, SC2317)
          find . -type f -name '*.sh' -print0 | xargs -0 shellcheck --severity=warning

  self-update-drift:
    name: Self-update block drift check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1

      - name: Compare each script's self-update block with the template
        run: .github/scripts/check-self-update.sh

  self-update-test:
    name: Gated self-update behaviour
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1

      - name: Run updater tests against a stubbed curl
        run: .github/scripts/test-self-update.sh

  actionlint:
    name: Lint workflows
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1

      - name: Run actionlint
        run: |
          go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.7
          "$(go env GOPATH)/bin/actionlint"