ci.yml

# SPDX-License-Identifier: Apache-2.0
name: CI

on:
  pull_request:
  push:
    branches:
      - main
      - development

permissions:
  contents: read

jobs:
  dco:
    name: DCO sign-off
    # Only pull requests. History predating brain decision 0008 is unsigned and
    # is deliberately not rewritten, so checking pushes would fail on ancestors.
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Every commit carries a matching Signed-off-by
        shell: bash
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          set -euo pipefail
          missing=0
          checked=0
          # Merge commits are exempt: they carry no authored change.
          while read -r sha; do
            [[ -n "${sha}" ]] || continue
            checked=$((checked + 1))
            author="$(git log -1 --format='%aN <%aE>' "${sha}")"
            if ! git log -1 --format='%(trailers:key=Signed-off-by,valueonly)' "${sha}" \
                | grep -qiFx "${author}"; then
              echo "::error::${sha:0:8} $(git log -1 --format=%s "${sha}")"
              echo "    no Signed-off-by matching the author: ${author}"
              missing=$((missing + 1))
            fi
          done < <(git rev-list --no-merges "${BASE_SHA}..${HEAD_SHA}")

          if (( missing > 0 )); then
            echo
            echo "${missing} of ${checked} commit(s) lack a matching sign-off."
            echo "Fix with:  git rebase --signoff ${BASE_SHA}"
            echo "Then:      git push --force-with-lease"
            echo "See DCO.txt and CONTRIBUTING.md."
            exit 1
          fi
          echo "OK: all ${checked} commit(s) signed off."

  license-headers:
    name: SPDX license headers
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Every in-scope file carries an SPDX header
        run: .github/scripts/spdx-headers.sh check

  shellcheck:
    name: shellcheck
    runs-on: ubuntu-latest
    # Gating since 2026-08-28: every script is clean at --severity=warning in
    # all four repositories. A new warning is a change to fix, not to absorb.
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Run shellcheck
        shell: bash
        run: |
          set -euo pipefail
          command -v shellcheck >/dev/null || sudo apt-get install -y shellcheck
          mapfile -t files < <(git ls-files '*.sh')
          if (( ${#files[@]} == 0 )); then
            echo "No shell scripts."
            exit 0
          fi
          shellcheck --severity=warning --external-sources "${files[@]}"

  tests:
    name: Bash test suite
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      # The suite needs two tools the repository depends on but does not ship:
      # jv validates system.json against system-schema.json (system/cuos/init.sh,
      # system-schema.test.sh), and yq reads cloud-init YAML
      # (cloud-init-to-system-json.sh). yq happens to exist on ubuntu-latest;
      # installing it anyway is the difference between a suite that passes
      # because we said what it needs and one that passes because of the runner
      # image. Both pinned: a tool that changes under us turns the suite red for
      # no reason.
      - name: Install jv and yq
        shell: bash
        env:
          JV_VERSION: v6.0.3
          YQ_VERSION: v4.53.6
        run: |
          set -euo pipefail
          curl -fsSL "https://github.com/santhosh-tekuri/jsonschema/releases/download/${JV_VERSION}/jv-${JV_VERSION}-linux-amd64.tar.gz" \
            | sudo tar -xz -C /usr/local/bin jv
          sudo curl -fsSL -o /usr/local/bin/yq \
            "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64"
          sudo chmod +x /usr/local/bin/yq
          jv --version
          yq --version

      - name: Run every *.test.sh
        shell: bash
        run: |
          set -uo pipefail
          # git ls-files, not find: it skips node_modules, build output and
          # anything else untracked, and it fails loudly on a broken checkout.
          mapfile -t files < <(git ls-files '*.test.sh')
          if (( ${#files[@]} == 0 )); then
            echo "No test scripts in this repository."
            exit 0
          fi
          status=0
          for file in "${files[@]}"; do
            echo "::group::${file}"
            if ! bash "${file}"; then
              status=1
              echo "::error file=${file}::${file} failed"
            fi
            echo "::endgroup::"
          done
          exit "${status}"