validate.yaml

name: Validate

on:
  workflow_call:
    inputs:
      runs-on:
        description: >-
          Runner label. Defaults to ubuntu-latest. Override to a self-hosted
          runner label if you want to run CI on your own scale set.
        required: false
        default: ubuntu-latest
        type: string

permissions:
  contents: read

jobs:
  actionlint:
    name: actionlint
    runs-on: ${{ inputs.runs-on }}
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          cache: false
          go-version: "1.26.2"

      - name: Install actionlint
        shell: bash
        run: |
          set -euo pipefail
          GOBIN="$RUNNER_TEMP/bin" go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"

      - name: Run actionlint
        id: actionlint
        # actionlint v1.7.12 lacks github.job_workflow_sha in its context schema
        # and hard-errors on go-lint.yaml's (correct) use of it. Ignore that one
        # known-good property until a pinned actionlint recognizes it; drop this
        # -ignore when bumping actionlint past the schema fix.
        run: actionlint -ignore 'property "job_workflow_sha" is not defined'

      - name: actionlint summary
        if: always()
        run: |
          set -euo pipefail
          if [ "${{ steps.actionlint.outcome }}" = "success" ]; then
            {
              echo "### actionlint"
              echo "actionlint passed."
            } >> "$GITHUB_STEP_SUMMARY"
          else
            {
              echo "### actionlint"
              echo "actionlint failed."
              echo ""
              echo "- Review the job logs for details."
            } >> "$GITHUB_STEP_SUMMARY"
          fi

  golangci-config:
    # go-lint.yaml fetches golangci-default.yaml from this repo at runtime for
    # every consumer without a local golangci config, so a malformed or invalid
    # edit here breaks lint across the estate. Validate the file on every change
    # (it's in this workflow's paths filter) with the same golangci-lint major
    # version consumers install via go-lint.yaml.
    name: golangci config verify
    runs-on: ${{ inputs.runs-on }}
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          cache: false
          go-version: "1.26.2"

      - name: Install golangci-lint
        shell: bash
        run: |
          set -euo pipefail
          GOBIN="$RUNNER_TEMP/bin" go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6
          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"

      - name: Verify golangci-default.yaml
        id: golangci-config
        run: golangci-lint config verify --config golangci-default.yaml

      - name: golangci config summary
        if: always()
        run: |
          set -euo pipefail
          if [ "${{ steps.golangci-config.outcome }}" = "success" ]; then
            {
              echo "### golangci config verify"
              echo "golangci-default.yaml is valid."
            } >> "$GITHUB_STEP_SUMMARY"
          else
            {
              echo "### golangci config verify"
              echo "golangci-default.yaml failed validation."
              echo ""
              echo "- Review the job logs for details."
            } >> "$GITHUB_STEP_SUMMARY"
          fi

  renovate-preset:
    # renovate/default.json is consumed by EVERY kupecloud repo via
    # `extends: ["local>kupecloud/github-workflows//renovate/default"]`, so a bad
    # merge here breaks dependency management org-wide. Validate on every PR.
    name: renovate preset
    runs-on: ${{ inputs.runs-on }}
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Validate preset and regex fixtures
        run: ./renovate/tests/validate.sh