---
# The static gate. Runs on every push and pull request, needs no access to any
# host, and is the definition of "done" for a change here.
#
# Everything below is `scripts/check.sh` plus two scans. Keeping the lint steps
# in a script rather than inline is deliberate: a contributor can run the exact
# same gate locally with `make check` before pushing, and the two cannot drift.
name: lint

on:
  push:
    branches: ["**"]
  pull_request:

# A second push to the same branch makes the first run pointless.
concurrency:
  group: lint-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  ansible:
    name: yamllint + ansible-lint + syntax
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      # scripts/check.sh is the single source of the version pins; it prints
      # them so that this workflow can install exactly what a contributor runs
      # locally. Nothing here can drift from the script.
      - name: Install the pinned toolchain
        run: |
          set -eu
          scripts/check.sh --print-specs | tee /dev/stderr | xargs -d '\n' pip install --quiet

      - name: Run the static gate
        run: RUNNER=installed scripts/check.sh

  shell:
    name: shellcheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # Pre-installed on GitHub-hosted Ubuntu runners; installed explicitly so
      # this job also works on a self-hosted runner with a bare image.
      - name: Install shellcheck
        run: command -v shellcheck || sudo apt-get install -y --no-install-recommends shellcheck
      - name: Check the shell scripts
        run: shellcheck scripts/*.sh server/*/*/app/*.sh

  secrets:
    name: secret scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          # detect scans history, not just the working tree. A secret that was
          # committed and then removed is still a leaked secret.
          fetch-depth: 0
      # Run the upstream image directly rather than the marketplace action: the
      # action requires a licence key for organisation-owned repositories, and
      # silently no-ops without one. The image has no such condition.
      - name: Scan the working tree and history for committed secrets
        run: |
          docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:latest \
            detect --source=/repo --config=/repo/.gitleaks.toml \
            --redact --verbose --no-banner