validate.yml

name: Validate

on:
  pull_request:
  push:
    branches: [main]

permissions: {}

concurrency:
  group: validate-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  tests:
    name: Validator tests
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.14"
      - run: python -m pip install --require-hashes -r requirements.txt
      - run: python -W error -m unittest discover --start-directory scripts/tests

  entries:
    name: Entries
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.14"
      - run: python -m pip install --require-hashes -r requirements.txt
      - name: Schemas
        run: |
          shopt -s nullglob
          check-jsonschema --check-metaschema schema/*.json
          check-jsonschema --schemafile schema/curation.schema.json curation/*.json
          manifests=(integrations/*/integration.json)
          if [ "${#manifests[@]}" -gt 0 ]; then
            check-jsonschema --schemafile schema/integration.schema.json "${manifests[@]}"
          fi
          check-jsonschema --builtin-schema vendor.github-workflows .github/workflows/*.yml
          check-jsonschema --builtin-schema vendor.github-issue-forms .github/ISSUE_TEMPLATE/[!c]*.yml
          check-jsonschema --builtin-schema vendor.github-issue-config .github/ISSUE_TEMPLATE/config.yml
          check-jsonschema --builtin-schema vendor.dependabot .github/dependabot.yml
      - name: Registry rules
        id: rules
        env:
          GITHUB_TOKEN: ${{ github.token }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
          PR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
        run: |
          args=(--online --scan-sources --annotations --urls-out build/urls.txt)
          if [ -n "$BASE_SHA" ]; then
            args+=(--base "$BASE_SHA" --author "$PR_AUTHOR" --author-association "$PR_ASSOCIATION")
          fi
          python scripts/validate.py "${args[@]}"
          if [ -s build/urls.txt ]; then
            echo "links=true" >> "$GITHUB_OUTPUT"
          fi
      - name: Links
        if: steps.rules.outputs.links == 'true'
        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
        with:
          args: --no-progress --require-https --max-retries 2 --accept 200,429 build/urls.txt
          fail: true

  workflows:
    name: Workflow lint
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: actionlint
        env:
          ACTIONLINT_VERSION: 1.7.12
          ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
        run: |
          archive="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
          curl -fsSL --retry 3 -o "$RUNNER_TEMP/$archive" \
            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/$archive"
          echo "$ACTIONLINT_SHA256  $RUNNER_TEMP/$archive" | sha256sum --check --strict
          tar -xzf "$RUNNER_TEMP/$archive" -C "$RUNNER_TEMP" actionlint
          "$RUNNER_TEMP/actionlint" -color
      - name: shellcheck
        run: shellcheck _owner/setup.sh
      - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
        with:
          version: 1.30.1
          advanced-security: false
          annotations: true

  gate:
    name: Registry Gate
    if: always()
    needs: [tests, entries, workflows]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions: {}
    steps:
      - env:
          RESULTS: ${{ join(needs.*.result, ' ') }}
        run: |
          for result in $RESULTS; do
            if [ "$result" != "success" ]; then
              echo "A required job ended with: $result"
              exit 1
            fi
          done