name: validate
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  json-schema:
    name: JSON Schema (ajv)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Install ajv
        run: npm install -g ajv-cli@5 ajv-formats@3

      - name: Validate every JSON Schema parses as JSON
        run: |
          set -euo pipefail
          find schemas -type f -name '*.json' -print | while read -r f; do
            echo "--- parse: $f"
            node -e "require('./$f')"
          done

      - name: Validate each schema is itself valid against JSON Schema 2020-12
        run: |
          set -euo pipefail
          find schemas -type f -name '*.json' -print | while read -r f; do
            echo "--- meta-validate: $f"
            ajv compile --spec=draft2020 -c ajv-formats -s "$f"
          done

      - name: Validate example payloads against their schemas
        run: |
          set -euo pipefail
          shopt -s nullglob
          # Convention: schemas/.../v<version>.json may have sibling
          # examples/*.json documents to validate against the schema.
          for schema in $(find schemas -type f -name '*.json'); do
            dir="$(dirname "$schema")/examples"
            [ -d "$dir" ] || continue
            for example in "$dir"/*.json; do
              echo "--- validate example $example against $schema"
              ajv validate --spec=draft2020 -c ajv-formats -s "$schema" -d "$example"
            done
          done

  rego:
    name: Rego (opa fmt + opa test)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install OPA
        run: |
          set -euo pipefail
          curl -sSL -o /usr/local/bin/opa https://openpolicyagent.org/downloads/v1.9.0/opa_linux_amd64_static
          chmod +x /usr/local/bin/opa
          opa version

      - name: opa fmt (fail on any diff)
        run: opa fmt --list --diff policies/

      - name: opa test
        run: opa test policies/ -v