ci.yml

---
name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  shell:
    name: Shell scripts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Install shellcheck
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq shellcheck

      - name: shellcheck
        run: |
          mapfile -t scripts < <(git ls-files '*.sh')
          if [ "${#scripts[@]}" -eq 0 ]; then
            echo "no shell scripts to check"
            exit 0
          fi
          shellcheck -S warning "${scripts[@]}"

      - name: Syntax check
        run: |
          while IFS= read -r f; do
            bash -n "$f"
          done < <(git ls-files '*.sh')

      # The repository is edited from Windows and executed inside WSL. A CRLF
      # shebang makes the interpreter unresolvable, so this is a real failure
      # mode rather than a style preference.
      - name: Line endings and executable bit
        run: |
          fail=0
          while IFS= read -r f; do
            if grep -q $'\r' "$f"; then
              echo "::error file=$f::CRLF line endings found; shell scripts must be LF"
              fail=1
            fi
            if [ ! -x "$f" ]; then
              echo "::error file=$f::missing executable bit"
              fail=1
            fi
          done < <(git ls-files '*.sh')
          exit "$fail"

  secrets:
    name: No committed secrets
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      # Belt and braces alongside .gitignore. Catches a file that was force
      # added past the ignore rules.
      - name: Check for secret material
        run: |
          fail=0
          while IFS= read -r f; do
            case "$f" in
              *.key|*.asc|*.pem|*.pfx|*.p12|*secrets.env|.env|id_ed25519|id_rsa)
                echo "::error file=$f::secret material must not be committed"
                fail=1
                ;;
            esac
          done < <(git ls-files)
          exit "$fail"