ci: derive the kinds from the matrix, normalize paths, lint both template spellings

Three fixes from review on 5b7e8b6.

The kind list was hardcoded in three loops with nothing tying it to the jobs. Adding
a fourth job with its matrix key and its MATRIX_KEYS entry while missing one of those
loops wrote no output line for it, and `!= '[]'` is true for the empty string — so
that job would start and die in fromJSON(''), the exact failure emit_all's comment
describes. The loops now come from `jq -r 'keys_unsorted[]'` over the matrix file, and
refuse to emit anything if that yields nothing. The guard's kind check became
bidirectional to close the other direction: a kind a job reads but the file does not
have is now reported, not just a key no job consumes.

`directories` values are normalized when collected. Dependabot resolves
"/examples/fastapi/app/" and "/examples/fastapi/app" to the same manifest, but
comparing verbatim reported the entry as pointing at no manifest *and* the manifest
as having no entry — two contradictory problems for a config that works, the failure
already fixed here for the singular `directory` key and for globs. Stripping only
slashes leaves glob patterns alone, and the duplicate check now also sees
`/examples/x` against `/examples/x/` as the collision Dependabot rejects the file
over.

The validate job lints template.yml as well as template.yaml. examples/sinatra and
examples/go-http-zip use the .yml spelling, so 43 of 45 templates were linted and
those two were not — while examples-verified claimed "template validation only" for
them. Both have Dependabot entries and no matrix entry, so that claim was the only
thing their pull requests were going to get, and it was false.

Exercised: a trailing-slash entry now passes; a slashed and unslashed pair of the
same directory is reported as a duplicate; a matrix missing a kind a job reads, and a
matrix with a kind no job reads, both fail; a fourth kind in the file gets its output
line; an unreadable matrix refuses rather than emitting an empty selection; and the
twelve-state guard suite plus three selector paths still behave.

Author: bnusunny

.github/scripts/check-example-config.sh

@@ -124,9 +124,20 @@ for update in config["updates"]:
     # but the singular is the canonical form for one directory and is what someone
     # adding an entry is likely to reach for — reading only the plural would report
     # their manifest as unclaimed and tell them to add an entry that is already there.
-    directories = list(update.get("directories") or [])
+    # Normalized on collection: Dependabot resolves "/examples/fastapi/app/" and
+    # "/examples/fastapi/app" to the same manifest, but comparing the strings verbatim
+    # reported the first as an entry with no manifest *and* the manifest as having no
+    # entry — two contradictory problems for a config that works, which is the failure
+    # already fixed here twice, for the singular `directory` key and for globs. Stripping
+    # only slashes leaves glob patterns alone. It also lets the duplicate check see
+    # `/examples/x` and `/examples/x/` as the collision Dependabot rejects the file over.
+    def normalize(value):
+        stripped = value.strip("/")
+        return "/" + stripped if stripped else "/"
+
+    directories = [normalize(d) for d in (update.get("directories") or [])]
     if "directory" in update:
-        directories.append(update["directory"])
+        directories.append(normalize(update["directory"]))
 
     where = f"{ecosystem} {directories}"
 
@@ -305,12 +316,21 @@ MATRIX_KEYS = {
 
 matrix = json.load(open(matrix_path))
 
+# Both directions. A key no job reads is dead weight; a kind a job reads that the file
+# does not have is worse — select-examples.sh derives its loops from this file, so that
+# job would get no output line, and `!= '[]'` is true for the empty string.
 unknown_kinds = sorted(set(matrix) - set(MATRIX_KEYS))
 if unknown_kinds:
     problems.append(
         "%s has kinds no job consumes: %s" % (matrix_path, ", ".join(unknown_kinds))
     )
 
+missing_kinds = sorted(set(MATRIX_KEYS) - set(matrix))
+if missing_kinds:
+    problems.append(
+        "%s is missing kinds a job reads: %s" % (matrix_path, ", ".join(missing_kinds))
+    )
+
 for kind, entries in matrix.items():
     expected = MATRIX_KEYS.get(kind)
     if expected is None:

.github/scripts/select-examples.sh

@@ -27,14 +27,26 @@ set -euo pipefail
 
 MATRIX="$(dirname "$0")/../example-matrix.json"
 
+# The kinds come from the matrix file, not from three hardcoded lists. Adding a fourth job
+# and its matrix key while forgetting one of those lists wrote no output line for it at
+# all, and `!= '[]'` is true for the empty string — so the job would start and die in
+# fromJSON(''), which is the failure this file's emit_all comment describes. The guard
+# asserts the other direction (a kind a job reads must exist in the file), so between them
+# every key gets a line and every line has a consumer.
+mapfile -t KINDS < <(jq -r 'keys_unsorted[]' "$MATRIX")
+if [[ ${#KINDS[@]} -eq 0 ]]; then
+  echo "No kinds in $MATRIX; refusing to emit an empty selection." >&2
+  exit 1
+fi
+
 # Assign before echoing, so a jq failure is the command's status rather than an
 # argument to echo: `echo "x=$(jq ...)"` returns echo's 0 even when jq dies, and
 # set -e never fires. That wrote `image=` to $GITHUB_OUTPUT and reported success — and
 # an empty value is worse than a failure, because `!= '[]'` is true for it, so the test
 # jobs would run and die in fromJSON('') with an error unrelated to the real cause.
 emit_all() {
   local kind matrix
-  for kind in image zip stream; do
+  for kind in "${KINDS[@]}"; do
     # `has` rather than a bare `.$kind`: jq prints the literal `null` and exits 0 for a
     # missing key, so a renamed top-level key in the matrix file wrote `stream=null`,
     # which `!= '[]'` reads as truthy — test-stream would start and die in
@@ -112,7 +124,7 @@ example_paths="$(grep -oE '^examples/[^/]+/' <<<"$changed" || true)"
 # `if: ... != '[]'` guards in examples.yaml skip the test jobs and the workflow is green.
 if [[ -z "$example_paths" ]]; then
   echo "No example changed: nothing to verify."
-  for kind in image zip stream; do
+  for kind in "${KINDS[@]}"; do
     echo "$kind=[]" >>"$GITHUB_OUTPUT"
   done
   exit 0
@@ -138,7 +150,7 @@ if [[ -n "$uncovered" ]]; then
   fi
 fi
 
-for kind in image zip stream; do
+for kind in "${KINDS[@]}"; do
   # Same has() assertion as emit_all: without it a renamed top-level key fails here with
   # jq's bare "Cannot iterate over null", naming neither the file nor the key, while the
   # push path says which key is missing. Loud is not the same as diagnostic.

.github/workflows/examples.yaml

@@ -106,7 +106,12 @@ jobs:
       - name: Validate all SAM templates
         run: |
           failed=0
-          for template in $(find examples -maxdepth 2 -name "template.yaml" | sort); do
+          # Both spellings: examples/sinatra and examples/go-http-zip use template.yml,
+          # so a .yaml-only find left them unlinted while examples-verified still claimed
+          # "template validation only" for them — and both have Dependabot entries and no
+          # matrix entry, so that claim is the only thing their pull requests get.
+          for template in $(find examples -maxdepth 2 \
+            \( -name "template.yaml" -o -name "template.yml" \) | sort); do
             dir=$(dirname "$template")
             echo "Validating $dir..."
             if ! sam validate --template "$template" --lint 2>&1; then