ci.yaml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened]

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:

  determine-changes:
    name: Determine changed files
    runs-on: ubuntu-latest
    outputs:
      github_actions: ${{ steps.changed-files.outputs.github_actions_any_changed }}
      github_actions_ci: ${{ steps.changed-files.outputs.github_actions_ci_any_changed }}
      renovate_config: ${{ steps.changed-files.outputs.renovate_config_any_changed }}
      md: ${{ steps.changed-files.outputs.md_any_changed }}
      json5: ${{ steps.changed-files.outputs.json5_any_changed }}
      json5_files: ${{ steps.changed-files.outputs.json5_all_changed_files }}
      toml: ${{ steps.changed-files.outputs.toml_any_changed }}
      yaml: ${{ steps.changed-files.outputs.yaml_any_changed }}

    steps:
      - name: Checkout the main repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Determine changed files
        id: changed-files
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
          files_yaml: |
            github_actions:
              - .github/workflows/**
            github_actions_ci:
              - .github/workflows/ci.yaml
            renovate_config:
              - .github/renovate.json5
            md:
              - '**/*.md'
              - .markdownlint-cli2.yaml
            json5:
              - '**/*.json5'
            toml:
              - '**/*.toml'
              - .tombi.toml
            yaml:
              - '**/*.yml'
              - '**/*.yaml'
              - .yamllint.yaml

  lint-gh-actions:
    name: Lint GitHub Actions
    needs: determine-changes
    if: ${{ needs.determine-changes.outputs.github_actions == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      security-events: write

    steps:
      - name: Checkout the main repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Run actionlint
        if: github.event_name != 'pull_request'
        run: |
          go install github.com/rhysd/actionlint/cmd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12
          "$(go env GOPATH)/bin/actionlint" -color

      - name: Run actionlint (reviewdog)
        if: github.event_name == 'pull_request'
        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1.72.0
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          reporter: github-pr-review
          fail_level: error

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
        with:
          version: 'v1.24.1'
          online-audits: false
          advanced-security: false
          annotations: true

      - name: Run zizmor (SARIF upload)
        if: >-
          ${{
            always() &&
            github.event.repository.private == false &&
            (github.event_name != 'pull_request' ||
            github.event.pull_request.head.repo.full_name == github.repository)
          }}
        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
        with:
          version: 'v1.24.1'
          online-audits: false
          advanced-security: true

  # validate-renovate-config:
  #   name: Validate Renovate config
  #   needs: determine-changes
  #   if: >-
  #     ${{ needs.determine-changes.outputs.renovate_config == 'true' ||
  #     needs.determine-changes.outputs.github_actions_ci == 'true' }}
  #   runs-on: ubuntu-latest
  #   permissions:
  #     contents: read

  #   steps:
  #     - name: Checkout the main repository
  #       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  #       with:
  #         persist-credentials: false

  #     - name: Set up Node.js
  #       uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
  #       with:
  #         node-version: 24

  #     - name: Validate Renovate config
  #       run: |
  #         npx --yes --package renovate@43.150.0 \
  #           renovate-config-validator .github/renovate.json5

  # lint-markdown:
  #   name: Lint Markdown
  #   needs: determine-changes
  #   if: >-
  #     ${{ needs.determine-changes.outputs.md == 'true' ||
  #     needs.determine-changes.outputs.github_actions_ci == 'true' }}
  #   runs-on: ubuntu-latest
  #   permissions:
  #     contents: read
  #     pull-requests: write

  #   steps:
  #     - name: Checkout the main repository
  #       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  #       with:
  #         persist-credentials: false

  #     - name: Lint Markdown
  #       if: github.event_name != 'pull_request'
  #       run: npx --yes markdownlint-cli2@0.22.1 .

  #     - name: Set up reviewdog
  #       if: github.event_name == 'pull_request'
  #       uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1.5.0
  #       with:
  #         reviewdog_version: 'v0.21.0'

  #     - name: Lint Markdown (reviewdog)
  #       if: github.event_name == 'pull_request'
  #       env:
  #         REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  #       run: |
  #         markdownlint_rc=0
  #         npx --yes markdownlint-cli2@0.22.1 . > /tmp/markdownlint-report.txt 2>&1 || markdownlint_rc=$?
  #         reviewdog_rc=0
  #         reviewdog < /tmp/markdownlint-report.txt \
  #             -efm="%f:%l:%c %m" \
  #             -efm="%f:%l %m" \
  #             -name=markdownlint \
  #             -reporter=github-pr-review \
  #             -fail-level=error || reviewdog_rc=$?
  #         if [ $markdownlint_rc -ne 0 ] && ! grep -Eq '^[^:]+:[0-9]+(:[0-9]+)? ' /tmp/markdownlint-report.txt; then
  #           echo "::error title=markdownlint::markdownlint failed before producing parseable diagnostics"
  #           exit $markdownlint_rc
  #         fi
  #         exit $reviewdog_rc

  # lint-json5:
  #   name: Lint JSON5
  #   needs: determine-changes
  #   if: >-
  #     ${{ needs.determine-changes.outputs.json5 == 'true' ||
  #     needs.determine-changes.outputs.github_actions_ci == 'true' }}
  #   runs-on: ubuntu-latest
  #   permissions:
  #     contents: read

  #   steps:
  #     - name: Checkout the main repository
  #       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  #       with:
  #         persist-credentials: false

  #     - name: Check JSON5 syntax
  #       env:
  #         CHANGED_JSON5_FILES: ${{ needs.determine-changes.outputs.json5_files }}
  #       run: |
  #         readarray -t json5_files < <(
  #           printf '%s\n' "${CHANGED_JSON5_FILES}" | tr ' ' '\n' | sed '/^$/d'
  #         )
  #         if [ ${#json5_files[@]} -eq 0 ]; then
  #           readarray -d '' -t json5_files < <(
  #             find . -type f -name '*.json5' -not -path './.git/*' -print0
  #           )
  #         fi
  #         if [ ${#json5_files[@]} -eq 0 ]; then
  #           echo 'No JSON5 files found.'
  #           exit 0
  #         fi
  #         exit_code=0
  #         for json5_file in "${json5_files[@]}"; do
  #           npx --yes json5@2.2.3 --validate "$json5_file" || exit_code=1
  #         done
  #         exit $exit_code

  # lint-toml:
  #   name: Lint TOML
  #   needs: determine-changes
  #   if: >-
  #     ${{ needs.determine-changes.outputs.toml == 'true' ||
  #     needs.determine-changes.outputs.github_actions_ci == 'true' }}
  #   runs-on: ubuntu-latest
  #   permissions:
  #     contents: read
  #     pull-requests: write

  #   steps:
  #     - name: Checkout the main repository
  #       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  #       with:
  #         persist-credentials: false

  #     - name: Install Tombi
  #       uses: tombi-toml/setup-tombi@df24458044353545055a12fe0d0742df9d3c5bea # v1.1.2
  #       with:
  #         version: '1.1.2'

  #     - name: Lint TOML
  #       if: github.event_name != 'pull_request'
  #       run: tombi lint

  #     - name: Set up reviewdog
  #       if: github.event_name == 'pull_request'
  #       uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1.5.0
  #       with:
  #         reviewdog_version: 'v0.21.0'

  #     - name: Lint TOML (reviewdog)
  #       if: github.event_name == 'pull_request'
  #       env:
  #         REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  #         NO_COLOR: '1'
  #       run: |
  #         lint_rc=0
  #         tombi lint --quiet > /tmp/tombi-lint-report.txt 2>&1 || lint_rc=$?
  #         gawk '
  #           match($0, /^[[:space:]]*(Warning|Error):[[:space:]]*(.*)$/, m) {
  #             severity = m[1]; message = m[2]; next
  #           }
  #           match($0, /^[[:space:]]*at[[:space:]]+(.*):([0-9]+):([0-9]+)/, m) {
  #             printf "%s:%s:%s: %s: %s\n", m[1], m[2], m[3], substr(severity, 1, 1), message
  #           }
  #         ' /tmp/tombi-lint-report.txt > /tmp/tombi-lint-report.efm.txt
  #         reviewdog_rc=0
  #         reviewdog < /tmp/tombi-lint-report.efm.txt \
  #             -efm="%f:%l:%c: %t: %m" \
  #             -name=tombi-lint \
  #             -reporter=github-pr-review \
  #             -fail-level=error || reviewdog_rc=$?
  #         if [ $lint_rc -ne 0 ] && [ ! -s /tmp/tombi-lint-report.efm.txt ]; then
  #           echo "::error title=tombi::tombi lint failed before producing parseable diagnostics"
  #           cat /tmp/tombi-lint-report.txt
  #           exit $lint_rc
  #         fi
  #         exit $reviewdog_rc

  #     - name: Format TOML
  #       run: tombi format

  #     - name: Suggest TOML format changes (reviewdog)
  #       if: github.event_name == 'pull_request'
  #       uses: reviewdog/action-suggester@aa38384ceb608d00f84b4690cacc83a5aba307ff # v1.24.0
  #       with:
  #         github_token: ${{ secrets.GITHUB_TOKEN }}
  #         tool_name: tombi-format
  #         cleanup: 'false'

  #     - name: Check TOML format
  #       run: git diff --exit-code

  # lint-yaml:
  #   name: Lint YAML
  #   needs: determine-changes
  #   if: >-
  #     ${{ needs.determine-changes.outputs.yaml == 'true' ||
  #     needs.determine-changes.outputs.github_actions_ci == 'true' }}
  #   runs-on: ubuntu-latest
  #   permissions:
  #     contents: read
  #     pull-requests: write

  #   steps:
  #     - name: Checkout the main repository
  #       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  #       with:
  #         persist-credentials: false

  #     - name: Install uv
  #       if: github.event_name != 'pull_request'
  #       uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  #       with:
  #         version: '0.11.16'

  #     - name: Lint YAML
  #       if: github.event_name != 'pull_request'
  #       run: uvx --from "yamllint==1.38.0" yamllint .

  #     - name: Lint YAML (reviewdog)
  #       if: github.event_name == 'pull_request'
  #       uses: reviewdog/action-yamllint@f01d8a48fd8d89f89895499fca2cff09f9e9e8c0 # v1.21.0
  #       with:
  #         github_token: ${{ secrets.GITHUB_TOKEN }}
  #         reporter: github-pr-review
  #         fail_level: error
  #         yamllint_flags: .

  check-prek:
    name: Check prek
    runs-on: ubuntu-latest

    steps:
      - name: Checkout the main repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Check prek
        uses: j178/prek-action@bdca6f102f98e2b4c7029491a53dfd366469e33d # v2.0.4
        with:
          prek-version: 'v0.4.1'
          extra-args: '--all-files --skip no-commit-to-branch'

  # check-typos:
  #   name: Check typos
  #   runs-on: ubuntu-latest
  #   permissions:
  #     contents: read
  #     checks: write
  #     pull-requests: write

  #   steps:
  #     - name: Checkout the main repository
  #       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  #       with:
  #         persist-credentials: false

  #     - name: Check spelling
  #       if: github.event_name != 'pull_request'
  #       uses: crate-ci/typos@aca895bf05aec0cb7dffa6f94495e923224d9f17 # v1.46.2
  #       with:
  #         files: |
  #           .
  #           .github/**

  #     - name: Check spelling (reviewdog)
  #       if: github.event_name == 'pull_request'
  #       uses: reviewdog/action-typos@d5eb1bbcd1b3bfde596f6eeb470322727862fe98 # v1.19.0
  #       with:
  #         github_token: ${{ secrets.GITHUB_TOKEN }}
  #         reporter: github-pr-review
  #         fail_level: error
  #         typos_flags: --hidden .

  # lint-commit-messages:
  #   name: Lint commit messages
  #   runs-on: ubuntu-latest

  #   steps:
  #     - name: Checkout the main repository
  #       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  #       with:
  #         fetch-depth: 0
  #         persist-credentials: false

  #     - name: Set up Commitizen
  #       uses: commitizen-tools/setup-cz@96c75e6ae9632047f2c9b4025b9dd1624b40de8f # v0.9.1
  #       with:
  #         python-version: '3.x'
  #         version: '4.16.2'

  #     - name: Lint commit messages on push
  #       if: github.event_name == 'push'
  #       run: cz check --rev-range ${{ github.event.before }}..${{ github.sha }}

  #     - name: Lint commit messages on pull request
  #       if: github.event_name == 'pull_request'
  #       run: cz check --rev-range ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}