name: CI

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Shellcheck
        run: bash .github/scripts/shellcheck-all.sh
      - name: Install actionlint
        env:
          ACTIONLINT_VERSION: 1.7.12
        run: |
          curl -fsSLo actionlint.tar.gz \
            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
          tar -xzf actionlint.tar.gz actionlint
          sudo install actionlint /usr/local/bin/actionlint
      - name: Actionlint
        run: bash .github/scripts/actionlint-all.sh
      - name: Self-ref pin
        # The pin rules (issue #9; #1 D3): a stale CEREMONY_SELF_REF fails
        # CI here, not a consumer's release.
        run: bash .github/scripts/self-ref-check.sh
      - name: Tests
        env:
          # The npm-backed version_write case may skip locally when npm is
          # absent; in CI a skip must be a failure, or the case could
          # quietly stop running (issue #3's test contract).
          CEREMONY_REQUIRE_NPM: 1
        run: bash test/run.sh

  # Exercises the composite actions the way a consumer does — action.yml
  # resolving, $GITHUB_ACTION_PATH, the relative lib sourcing — which the
  # test suite, driving the scripts directly, cannot prove (issue #5's
  # acceptance criterion).
  action-exercise:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Construct an armed scratch tree in the workspace
        # This repo carries no VERSION or CHANGELOG.md of its own (until
        # #11 dogfoods); the guard reads the workspace, so give it a
        # transient armed tree there. The changelog is scratch-named so a
        # future real CHANGELOG.md is never shadowed; VERSION cannot be —
        # the file backend hardcodes it — so if #11 ever adds a real one,
        # this write must go.
        run: |
          printf '0.0.1-dev\n' > VERSION
          printf '# Changelog\n\n## Unreleased\n\n- Scratch entry.\n' > CHANGELOG.scratch.md
      - uses: ./actions/changelog-armed
        with:
          changelog: CHANGELOG.scratch.md