From 961102ca6fb8c386484a0cdbdd80995350aea86b80fcf35845987f4c3ad2dfcf Mon Sep 17 00:00:00 2001
From: CTO Agent <cto@basicstack.de>
Date: Sun, 25 Oct 2026 15:28:19 +0000
Subject: [PATCH] =?UTF-8?q?ci:=20add=20Forgejo=20Actions=20workflow=20?=
 =?UTF-8?q?=E2=80=94=20JSON=20Schema=20(ajv)=20+=20Rego=20(opa=20fmt=20+?=
 =?UTF-8?q?=20opa=20test)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .forgejo/workflows/validate.yml | 73 +++++++++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 .forgejo/workflows/validate.yml

diff --git a/.forgejo/workflows/validate.yml b/.forgejo/workflows/validate.yml
new file mode 100644
index 0000000..72a9d05
--- /dev/null
+++ b/.forgejo/workflows/validate.yml
@@ -0,0 +1,73 @@
+name: validate
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  json-schema:
+    name: JSON Schema (ajv)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Install ajv
+        run: npm install -g ajv-cli@5 ajv-formats@3
+
+      - name: Validate every JSON Schema parses as JSON
+        run: |
+          set -euo pipefail
+          find schemas -type f -name '*.json' -print | while read -r f; do
+            echo "--- parse: $f"
+            node -e "require('./$f')"
+          done
+
+      - name: Validate each schema is itself valid against JSON Schema 2020-12
+        run: |
+          set -euo pipefail
+          find schemas -type f -name '*.json' -print | while read -r f; do
+            echo "--- meta-validate: $f"
+            ajv compile --spec=draft2020 -c ajv-formats -s "$f"
+          done
+
+      - name: Validate example payloads against their schemas
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          # Convention: schemas/.../v<version>.json may have sibling
+          # examples/*.json documents to validate against the schema.
+          for schema in $(find schemas -type f -name '*.json'); do
+            dir="$(dirname "$schema")/examples"
+            [ -d "$dir" ] || continue
+            for example in "$dir"/*.json; do
+              echo "--- validate example $example against $schema"
+              ajv validate --spec=draft2020 -c ajv-formats -s "$schema" -d "$example"
+            done
+          done
+
+  rego:
+    name: Rego (opa fmt + opa test)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install OPA
+        run: |
+          set -euo pipefail
+          curl -sSL -o /usr/local/bin/opa https://openpolicyagent.org/downloads/v1.9.0/opa_linux_amd64_static
+          chmod +x /usr/local/bin/opa
+          opa version
+
+      - name: opa fmt (fail on any diff)
+        run: opa fmt --list --diff policies/
+
+      - name: opa test
+        run: opa test policies/ -v