name: Lint

# Static analysis over shell scripts (ShellCheck) and the .plg/XML manifest
# (xmllint) on every push and pull request. Mirrors scripts/dev/lint.sh for
# local use.

on:
  push:
    branches: [main]
  pull_request:

jobs:
  shellcheck:
    name: ShellCheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install ShellCheck
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends shellcheck

      - name: Run ShellCheck
        run: |
          set -eu
          # shellcheck disable=SC2038  (find | xargs is fine here, filenames
          # in this repo never contain spaces/newlines)
          find plugin/rc.d plugin/sbin scripts -type f \
            \( -name '*.sh' -o -name 'rc.*' -o -name '*.SlackBuild' \) \
            -print0 \
          | xargs -0 shellcheck --severity=warning --external-sources

  xmllint:
    name: Validate .plg XML
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install libxml2-utils
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends libxml2-utils

      - name: Validate podman.plg is well-formed XML
        run: xmllint --noout plugin/podman.plg

  editorconfig:
    name: EditorConfig
    runs-on: ubuntu-latest
    # Installs the editorconfig-checker binary directly from its GitHub
    # release instead of using the editorconfig-checker/action-* marketplace
    # action: on self-hosted Gitea Actions runners, third-party action
    # resolution can fail (observed as a 404 against the Gitea instance's
    # own repo API while resolving the action) even with
    # [actions].DEFAULT_ACTIONS_URL = github configured. A pinned, checksum
    # -verified binary download has no such dependency on action resolution
    # and works identically on GitHub-hosted and Gitea Actions runners.
    env:
      EC_VERSION: "3.8.0"
      EC_SHA256: "5bda1d502d9a0bbd3caa0ef1d1e3b8ee496a18f226f69e0be06d24a0c8ae0237"
    steps:
      - uses: actions/checkout@v4

      - name: Install editorconfig-checker
        run: |
          set -eu
          curl -fL --retry 3 -o /tmp/ec.tar.gz \
            "https://github.com/editorconfig-checker/editorconfig-checker/releases/download/v${EC_VERSION}/editorconfig-checker-linux-amd64.tar.gz"
          echo "${EC_SHA256}  /tmp/ec.tar.gz" | sha256sum -c -
          tar -xzf /tmp/ec.tar.gz -C /tmp
          sudo install -m 0755 /tmp/editorconfig-checker /usr/local/bin/ec

      - name: Run editorconfig-checker
        # -disable-indent-size: this check wants every line's indentation to
        # be an exact multiple of .editorconfig's indent_size (2), which
        # produces false positives for prose content this repo legitimately
        # has a lot of — Markdown's own nested-list indentation rules (3
        # spaces under "- ", 4 under numbered items) don't align with a
        # flat "multiple of 2" rule, and neither do many shell heredoc
        # bodies or the XML comment blocks in plugin/podman.plg. The other
        # checks (trailing whitespace, final newline, charset, line length)
        # stay enabled and catch real issues.
        run: ec -disable-indent-size