name: Lint Action Pinning

# No trigger-level `paths:` filter, deliberately. A workflow skipped by one
# reports no conclusion at all, and a required check that never reports leaves
# a pull request unable to enter a merge queue and a merge group unable to
# leave it. `merge_group` cannot carry a `paths:` filter in the first place.
#
# The heavier gates push their filtering down into a `changes` job (see
# `.github/scripts/changed-paths.py`). This one is deliberately unfiltered
# instead: the list it replaced had grown to thirty-odd entries that each had
# to be added by hand whenever a contract test gained a new subject, and every
# omission was a silently unguarded file. Always running is both cheaper to
# reason about and strictly safer. See docs/ci-merge-queue.md.
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  merge_group:
    types: [checks_requested]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  # Never cancel a merge-queue run. Its ref is unique per queue entry, so a
  # cancellation here could only come from a mis-keyed group, and the queue
  # would read the cancelled check as a failure and eject the pull request.
  cancel-in-progress: ${{ github.event_name != 'merge_group' }}

# Least-privilege: only reads source.
permissions:
  contents: read

jobs:
  lint:
    name: All action refs are SHA-pinned
    # Checkout receives the short-lived job token. Keep this credential-bearing
    # path on GitHub-hosted capacity during the external-runner pilot.
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Test action-pinning lint
        run: python3 .github/scripts/lint-action-pinning_test.py

      - name: Test in-job path filter
        run: python3 .github/scripts/changed-paths_test.py

      - name: Test Claude Code review workflow contract
        run: python3 .github/scripts/claude-code-review-workflow-contract_test.py

      - name: Test PR walkthrough workflow contract
        run: |
          python3 .github/scripts/pr-walkthrough-workflow-contract_test.py
          python3 scripts/pr-walkthrough-pr-body.test.py
          python3 .agents/skills/pr-walkthrough/scripts/pr-walkthrough-context.test.py
          python3 .agents/skills/pr-walkthrough/scripts/pr-walkthrough-render.test.py

      - name: Test preview environment workflow contract
        run: python3 .github/scripts/preview-env-workflow-contract_test.py

      - name: Test OpenCode code review workflow contract
        run: python3 .github/scripts/opencode-code-review-workflow-contract_test.py

      - name: Test frontend tests workflow contract
        run: python3 .github/scripts/frontend-tests-workflow-contract_test.py

      - name: Test release workflow contract
        run: python3 .github/scripts/release-workflow-contract_test.py

      - name: Test E2E workflow contract
        run: python3 .github/scripts/e2e-tests-workflow-contract_test.py

      - name: Test external runner workflow contract
        run: python3 .github/scripts/external-runner-workflow-contract_test.py

      - name: Test external runner planner
        run: python3 .github/scripts/runner-plan_test.py

      - name: Test bounded step summary
        run: python3 .github/scripts/bounded-step-summary_test.py

      - name: Test backend tests workflow contract
        run: python3 .github/scripts/backend-tests-workflow-contract_test.py

      - name: Test stale merge approval revocation workflow contract
        run: python3 .github/scripts/revoke-ready-to-merge-workflow-contract_test.py

      - name: Test pull request size label workflow contract
        run: python3 .github/scripts/pr-size-label-workflow-contract_test.py

      - name: Test pull request documentation workflow contract
        run: python3 .github/scripts/pr-docs-workflow-contract_test.py

      - name: Test pull request documentation validator
        run: node --test .github/scripts/pr-docs.test.cjs

      - name: Test managed runtime pin update workflow contract
        run: python3 .github/scripts/update-agent-runtime-pins-workflow-contract_test.py

      - name: Test backend tests workflow contract
        run: python3 .github/scripts/backend-tests-workflow-contract_test.py

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: "24"

      - name: Test runtime bundle contract
        run: bash scripts/release/runtime-bundle.test.sh

      - name: Test GHCR retry helper
        run: bash scripts/release/retry-ghcr-command.test.sh

      - name: Test npm release helpers
        run: node --test scripts/release/nightly-version.test.mjs scripts/release/nightly-release.test.mjs scripts/release/npm-view-version.test.mjs scripts/release/publish-npm.test.mjs scripts/release/update-scoop-bucket.test.mjs

      - name: Verify action refs
        run: python3 .github/scripts/lint-action-pinning.py