ceremony/.github/workflows/ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Shellcheck
        run: bash .github/scripts/shellcheck-all.sh
      - name: Install actionlint
        env:
          ACTIONLINT_VERSION: 1.7.12
        run: |
          curl -fsSLo actionlint.tar.gz \
            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
          tar -xzf actionlint.tar.gz actionlint
          sudo install actionlint /usr/local/bin/actionlint          
      - name: Actionlint
        run: bash .github/scripts/actionlint-all.sh
      - name: Self-ref pin
        # The pin rules (issue #9; #1 D3): a stale CEREMONY_SELF_REF fails
        # CI here, not a consumer's release.
        run: bash .github/scripts/self-ref-check.sh
      - name: Tests
        env:
          # The npm-backed version_write case may skip locally when npm is
          # absent; in CI a skip must be a failure, or the case could
          # quietly stop running (issue #3's test contract).
          CEREMONY_REQUIRE_NPM: 1
        run: bash test/run.sh

  # The release exercise (issue #9's scratch caller) on every PR, so the
  # parse proof and the merge door's step-replay are standing, reviewable
  # evidence — not a dispatch someone must remember to run. PR-ONLY, and
  # the gate is load-bearing: this CI also runs on push to main, and a
  # workflow_call from THAT context would hand release.yml a genuine
  # push+refs/heads/main event — the merge door's exact gate — opening a
  # live door from CI. A pull_request event can never satisfy either
  # door's `if:`.
  release-exercise:
    if: github.event_name == 'pull_request'
    uses: ./.github/workflows/release-exercise.yml

  # Exercises the composite actions the way a consumer does — action.yml
  # resolving, $GITHUB_ACTION_PATH, the relative lib sourcing — which the
  # test suite, driving the scripts directly, cannot prove (issue #5's
  # acceptance criterion).
  action-exercise:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Construct an armed scratch tree in the workspace
        # This repo carries no VERSION or CHANGELOG.md of its own (until
        # #11 dogfoods); the guard reads the workspace, so give it a
        # transient armed tree there. The changelog is scratch-named so a
        # future real CHANGELOG.md is never shadowed; VERSION cannot be —
        # the file backend hardcodes it — so if #11 ever adds a real one,
        # this write must go.
        run: |
          printf '0.0.1-dev\n' > VERSION
          printf '# Changelog\n\n## Unreleased\n\n- Scratch entry.\n' > CHANGELOG.scratch.md          
      - uses: ./actions/changelog-armed
        with:
          changelog: CHANGELOG.scratch.md
      # The same scratch tree exercises drill-recorded: 0.0.1-dev is a
      # development tree, so the guard proves its wiring (action.yml,
      # $GITHUB_ACTION_PATH, the lib sourcing) through the nothing-to-assert
      # path — the state every consumer PR is in. The bare path is the test
      # suite's job.
      - uses: ./actions/drill-recorded
      - name: Construct a scratch history for the monotonic guard
        # The monotonic guard's input is a DIFF, so its exercise needs
        # history, not just a file: commit a scratch changelog, mark that
        # commit as the fixture base, then commit an insert-above edit on
        # top — a real containment run, not just an action.yml parse. The
        # base ref is the in-job branch, passed explicitly, because this
        # job's shallow PR checkout carries no origin/main for the input's
        # default to resolve (consumers get that via fetch-depth: 0, per
        # the action's description). Scratch-named file for the same
        # shadowing reason as above; the commits live only in this job's
        # checkout and are never pushed.
        run: |
          git config user.name ceremony-ci
          git config user.email ceremony-ci@users.noreply.github.com
          printf '# Changelog\n\n## Unreleased\n\n## 0.1.0 — 2026-07-01\n\n- Shipped entry.\n' > CHANGELOG.monotonic.scratch.md
          git add CHANGELOG.monotonic.scratch.md
          git commit -m 'fixture: monotonic base'
          git branch monotonic-fixture-base
          printf '# Changelog\n\n## Unreleased\n\n- Entry inserted above.\n\n## 0.1.0 — 2026-07-01\n\n- Shipped entry.\n' > CHANGELOG.monotonic.scratch.md
          git commit -am 'fixture: insert above'          
      - uses: ./actions/changelog-monotonic
        with:
          changelog: CHANGELOG.monotonic.scratch.md
          base-ref: monotonic-fixture-base