ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [master]

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install linters
        run: |
          pip install --user ansible-lint
          sudo apt-get update && sudo apt-get install -y shellcheck

      - name: shellcheck (bash capabilities/agents)
        run: |
          find capabilities agents -name '*.sh' -print0 | xargs -0 --no-run-if-empty shellcheck

      - name: ansible-lint (playbook capabilities)
        run: |
          # apply-configuration/linux.yml include_tasks's targets (change-password.yml,
          # disk-resize-*.yml, ...) only exist once an external process flattens the
          # capability files into one directory at config-ISO build time, so
          # ansible-lint can never resolve them here - .ansible-lint's exclude_paths
          # doesn't apply to files passed explicitly on the CLI, so it has to be
          # filtered out of the file list itself.
          find capabilities agents -name '*.yml' -not -path 'capabilities/apply-configuration/linux.yml' -print0 \
            | xargs -0 --no-run-if-empty ~/.local/bin/ansible-lint

      - name: PSScriptAnalyzer (PowerShell capabilities)
        shell: pwsh
        run: |
          Install-Module -Name PSScriptAnalyzer -Force -Scope CurrentUser
          $files = Get-ChildItem -Recurse -Include *.ps1 -Path capabilities,agents
          $failed = $false
          foreach ($f in $files) {
            $results = Invoke-ScriptAnalyzer -Path $f.FullName -Severity Error
            if ($results) { $results | Format-Table; $failed = $true }
          }
          if ($failed) { exit 1 }

      - name: Verify manifest is up to date
        run: |
          cp manifest.json /tmp/manifest.before.json || true
          ./scripts/generate-manifest.sh
          # generated_at is a wall-clock timestamp that legitimately differs
          # between the committed manifest and any regeneration, so it's
          # excluded from the comparison - only the file hashes/sizes matter.
          diff <(grep -v generated_at /tmp/manifest.before.json) <(grep -v generated_at manifest.json) \
            || (echo "manifest.json is stale — run scripts/generate-manifest.sh and commit it" && exit 1)