name: Repository quality
# Called by CI so release-please's workflow_dispatch receives these checks too.
on:
  workflow_call:
permissions:
  contents: read
jobs:
  workflows:
    name: Workflow validation
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: '1.26'
          cache: false
      - name: Install actionlint
        run: go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
      - name: Validate workflows and embedded shell scripts
        env:
          # Ignore style suggestions, but fail on shell correctness warnings and errors.
          SHELLCHECK_OPTS: --severity=warning
        run: actionlint -color
      # Part of "Workflow validation" rather than a job of its own: it is a two-second grep, and this
      # job is already a required check, so the guard starts protecting both branches immediately.
      - name: Reject developer-specific paths in build inputs
        run: bash scripts/ci/check-developer-paths.sh
      # Formatting is platform independent, so it runs here on Ubuntu rather than costing a Windows
      # runner. Cheap and early: a formatting slip fails in seconds instead of after the full compile.
      - name: Check formatting
        run: scripts/format.sh --check
  dependencies:
    name: Dependency review
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # This job must not skip. It is one of the required status checks on main and develop, and a required check that reports "skipped" blocks a merge instead of passing it. Guarding it on the pull_request event left the release pull request unmergeable by its own automation: ci.yml ignores that pull request by path and the release workflow dispatches ci.yml on the release branch instead, so this job saw workflow_dispatch and skipped, and land-release-pr.sh got "the base branch policy prohibits the merge" after everything else came back green.
      #
      # A pull_request event supplies both refs on its own. Every other trigger has to be told what to compare, and comparing the default branch against the checked-out commit is the same question the pull request asks.
      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v4
        with:
          fail-on-severity: high
          base-ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.repository.default_branch }}
          head-ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}