# Continuous integration: lint and dependency review. Job names are the required
# branch-protection checks documented in docs/gitflow.md. The gateway unit tests
# and the manifest dry-run live in ci-python.yaml / ci-manifests.yaml so each can
# use native on.pull_request.paths filtering and skip unrelated changes.
name: CI

on:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: lint
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: "3.12"
      - name: Install Python linters
        run: |
          set -euo pipefail
          python -m pip install --upgrade pip
          pip install "yamllint==1.38.0" "pyyaml==6.0.3"
      - name: Install actionlint
        env:
          ACTIONLINT_VERSION: v1.7.12
        run: |
          set -euo pipefail
          version="${ACTIONLINT_VERSION#v}"
          curl -fsSL -o /tmp/actionlint.tar.gz             "https://github.com/rhysd/actionlint/releases/download/$ACTIONLINT_VERSION/actionlint_${version}_linux_amd64.tar.gz"
          tar -xzf /tmp/actionlint.tar.gz -C /tmp actionlint
          install -m 0755 /tmp/actionlint /usr/local/bin/actionlint
          actionlint -version
      - name: Install hadolint
        env:
          HADOLINT_VERSION: v2.12.0
        run: |
          set -euo pipefail
          curl -fsSL -o /tmp/hadolint             "https://github.com/hadolint/hadolint/releases/download/$HADOLINT_VERSION/hadolint-Linux-x86_64"
          install -m 0755 /tmp/hadolint /usr/local/bin/hadolint
          hadolint --version
      - name: Repository checks
        run: |
          set -euo pipefail
          ./scripts/check-versions.sh
          ./scripts/check-examples.sh
      - name: Shellcheck
        run: shellcheck -x build.sh scripts/*.sh examples/*/scripts/*.sh
      - name: Actionlint
        run: actionlint -color
      - name: Yamllint
        run: yamllint .
      - name: Hadolint
        run: |
          set -euo pipefail
          hadolint Dockerfile
          hadolint examples/dsh-agents-as-a-service/gateway/Dockerfile
      - name: Documentation links
        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2
        with:
          args: >-
            --offline --no-progress --verbose
            ./README.md ./CONTRIBUTING.md ./SECURITY.md ./AGENTS.md ./docs ./examples

  dependency-review:
    name: dependency-review
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Dependency review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v4