name: validate
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# The repository uses the sha256 git object format. Git < 2.42 cannot speak
# the sha256 wire protocol, so we must run the job in a container whose Debian
# base has a recent-enough git (bookworm ships 2.39, trixie ships 2.47+).
jobs:
  json-schema:
    name: JSON Schema (ajv)
    runs-on: ubuntu-latest
    container:
      image: node:24-trixie-slim
    steps:
      - name: Install git + curl in container
        run: |
          set -euo pipefail
          apt-get update
          apt-get install -y --no-install-recommends git curl ca-certificates
          git --version
          node --version

      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install ajv-cli + ajv-formats
        run: |
          set -euo pipefail
          npm install --prefix /tmp/ajv ajv-cli@5 ajv-formats@3

      - name: Validate every JSON Schema parses as JSON
        run: |
          set -euo pipefail
          find schemas -type f -name '*.json' -print | while read -r f; do
            echo "--- parse: $f"
            node -e "require('./$f')"
          done

      - name: Meta-validate each schema against JSON Schema 2020-12
        run: |
          set -euo pipefail
          export NODE_PATH=/tmp/ajv/node_modules
          find schemas -type f -name '*.json' -print | while read -r f; do
            echo "--- meta-validate: $f"
            node /tmp/ajv/node_modules/.bin/ajv compile --spec=draft2020 -c=ajv-formats -s "$f"
          done

      - name: Validate example payloads against their schemas (if any)
        run: |
          set -euo pipefail
          export NODE_PATH=/tmp/ajv/node_modules
          shopt -s nullglob
          for schema in $(find schemas -type f -name '*.json'); do
            dir="$(dirname "$schema")/examples"
            [ -d "$dir" ] || continue
            for example in "$dir"/*.json; do
              echo "--- validate example $example against $schema"
              node /tmp/ajv/node_modules/.bin/ajv validate --spec=draft2020 -c=ajv-formats -s "$schema" -d "$example"
            done
          done

  rego:
    name: Rego (opa fmt + opa test)
    runs-on: ubuntu-latest
    container:
      image: debian:trixie-slim
    steps:
      - name: Install git + curl in container
        run: |
          set -euo pipefail
          apt-get update
          apt-get install -y --no-install-recommends git curl ca-certificates
          git --version

      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install OPA
        run: |
          set -euo pipefail
          mkdir -p "$HOME/.local/bin"
          curl -sSL -o "$HOME/.local/bin/opa" https://openpolicyagent.org/downloads/v1.9.0/opa_linux_amd64_static
          chmod +x "$HOME/.local/bin/opa"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
          "$HOME/.local/bin/opa" version

      - name: opa fmt (fail on any diff)
        run: opa fmt --list --diff policies/

      - name: opa test
        run: opa test policies/ -v