name: Validate pull request

on:
  pull_request:
    branches:
      - main
      - testing

permissions:
  contents: read

jobs:
  validate:
    name: Run lightweight checks
    runs-on: ubuntu-24.04
    # `just check` parses the whole Justfile, so provide the non-secret
    # variables required by its top-level metadata declarations. This job
    # does not build or publish an image; production builds use repository
    # runtime variables in their respective workflows.
    env:
      IMAGE_NAME: aerocore-os
      REPO_ORGANIZATION: aerocore-io
      IMAGE_DESC: AeroCore customized Bazzite Deck image
      IMAGE_KEYWORDS: bootc,oci,linux,bazzite,steam-deck,aerocore
      IMAGE_LOGO_URL: https://avatars.githubusercontent.com/u/120078124?s=200&v=4
      DEFAULT_TAG: testing
      BIB_IMAGE: quay.io/centos-bootc/bootc-image-builder:latest

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Install just
        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4

      - name: Validate workflow YAML
        run: |
          ruby -e 'require "yaml"; Dir[".github/workflows/*.yml"].each { |file| YAML.load_file(file) }'

      - name: Validate Just syntax
        run: just check

      - name: Validate Justfile formatting
        run: |
          just --unstable --fmt --check -f Justfile

      - name: Test dotenv precedence
        run: tests/test-dotenv-precedence.sh

      - name: Validate build scripts
        run: |
          for script in build_files/*.sh installer/*.sh just_scripts/*.sh tests/*.sh; do
            bash -n "$script"
          done
          bash -n system_files/usr/libexec/aerocore-instruments-setup

      - name: Test Bazzite Deck identity patch
        run: tests/test-patch-bazzite-deck-identity.sh

      - name: Test GPT root configuration
        run: tests/test-configure-target-gpt-root.sh

      - name: Validate AeroCore Anaconda profile
        run: tests/test-aerocore-anaconda-profile.sh

      - name: Validate Anaconda WebUI patch
        run: |
          fixture="$(mktemp)"
          trap 'rm -f "${fixture}"' EXIT
          printf '%s' 'n===0?r(new Error(X2("Password is too weak"))):o(' |
            gzip -n > "${fixture}"
          installer/patch-anaconda-webui.sh "${fixture}"
          gzip -dc "${fixture}" |
            grep -Fq 'n===0&&!e?r(new Error(X2("Password is too weak"))):o('
          installer/patch-anaconda-webui.sh "${fixture}"

      - name: Validate installer polkit rules
        run: |
          for rule in installer/system_files/overrides/etc/polkit-1/rules.d/*.rules; do
            node --check < "$rule"
          done