name: validate
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# The repository uses the sha256 git object format. Git < 2.42 cannot speak
# the sha256 wire protocol, and actions/checkout@v4 does `git init` without
# --object-format=sha256, which produces `fatal: mismatched algorithms:
# client sha1; server sha256`. We therefore skip actions/checkout entirely
# and clone manually from a trixie-based container (git 2.47+).
jobs:
  json-schema:
    name: JSON Schema (ajv)
    runs-on: ubuntu-latest
    container:
      image: node:24-trixie-slim
    steps:
      - name: Install git + curl in container
        run: |
          set -euo pipefail
          apt-get update
          apt-get install -y --no-install-recommends git curl ca-certificates
          git --version
          node --version

      - name: Clone repository (sha256-aware)
        run: |
          set -euo pipefail
          git clone --depth=1 --branch="${GITHUB_REF_NAME}" \
            "https://x-access-token:${GITHUB_TOKEN}@forgejo.basicstack.de/${GITHUB_REPOSITORY}.git" "${GITHUB_WORKSPACE}"
          cd "${GITHUB_WORKSPACE}"
          git log -1 --oneline

      - name: Install ajv-cli + ajv-formats
        working-directory: ${{ github.workspace }}
        run: |
          set -euo pipefail
          npm install --prefix /tmp/ajv ajv-cli@5 ajv-formats@3

      - name: Validate every JSON Schema parses as JSON
        working-directory: ${{ github.workspace }}
        run: |
          set -eu
          find schemas -type f -name 'v*.json' -print | while IFS= read -r f; do
            echo "--- parse: $f"
            node -e "require('./$f')"
          done

      - name: Meta-validate each schema against JSON Schema 2020-12
        working-directory: ${{ github.workspace }}
        run: |
          set -eu
          export NODE_PATH=/tmp/ajv/node_modules
          find schemas -type f -name 'v*.json' -print | while IFS= read -r f; do
            echo "--- meta-validate: $f"
            node /tmp/ajv/node_modules/.bin/ajv compile --spec=draft2020 -c=ajv-formats -s "$f"
          done

      - name: Validate per-version example payloads against their schemas
        working-directory: ${{ github.workspace }}
        run: |
          set -eu
          export NODE_PATH=/tmp/ajv/node_modules
          # Each schema file is <path>/vX.Y.Z.json; example payloads for that version
          # live under <path>/examples/vX.Y.Z/*.json. This keeps v1.0.0 examples from
          # being validated against v1.1.0 and vice-versa.
          find schemas -type f -name 'v*.json' -print | while IFS= read -r schema; do
            version="$(basename "$schema" .json)"
            dir="$(dirname "$schema")/examples/$version"
            [ -d "$dir" ] || continue
            find "$dir" -type f -name '*.json' -print | while IFS= read -r example; do
              echo "--- validate example $example against $schema"
              node /tmp/ajv/node_modules/.bin/ajv validate --spec=draft2020 -c=ajv-formats -s "$schema" -d "$example"
            done
          done

  rego:
    name: Rego (opa fmt + opa test)
    runs-on: ubuntu-latest
    container:
      image: debian:trixie-slim
    steps:
      - name: Install git + curl in container
        run: |
          set -euo pipefail
          apt-get update
          apt-get install -y --no-install-recommends git curl ca-certificates
          git --version

      - name: Clone repository (sha256-aware)
        run: |
          set -euo pipefail
          git clone --depth=1 --branch="${GITHUB_REF_NAME}" \
            "https://x-access-token:${GITHUB_TOKEN}@forgejo.basicstack.de/${GITHUB_REPOSITORY}.git" "${GITHUB_WORKSPACE}"
          cd "${GITHUB_WORKSPACE}"
          git log -1 --oneline

      - name: Install OPA
        run: |
          set -euo pipefail
          mkdir -p "$HOME/.local/bin"
          curl -sSL -o "$HOME/.local/bin/opa" https://openpolicyagent.org/downloads/v1.9.0/opa_linux_amd64_static
          chmod +x "$HOME/.local/bin/opa"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
          "$HOME/.local/bin/opa" version

      - name: opa fmt (fail on any diff)
        working-directory: ${{ github.workspace }}
        run: opa fmt --list --diff policies/

      - name: opa test
        working-directory: ${{ github.workspace }}
        run: opa test policies/ -v