pr-validation.yml

name: Pull Request Validation

on:
  pull_request:
    branches:
      - main
      - master

permissions:
  contents: read

jobs:
  validate-pr:
    name: Validate Pull Request
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: ">=1.23.5"

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Set up Node.js for markdownlint
        uses: actions/setup-node@v6
        with:
          node-version: "24"

      - name: Download JStall minimal JAR for go:embed
        run: |
          mkdir -p dist
          curl -fsSL -o dist/jstall-minimal.jar https://github.com/parttimenerd/jstall/releases/latest/download/jstall-minimal.jar

      - name: Install Go dependencies
        run: go mod tidy -e || true

      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: latest

      - name: Run govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          # Run in JSON mode and emit GitHub Actions warning annotations for each finding.
          # govulncheck outputs multi-line JSON objects (not line-delimited), so we use
          # raw_decode to parse successive top-level objects from the output stream.
          govulncheck -json . 2>/dev/null | python3 -c "
          import sys, json
          decoder = json.JSONDecoder()
          data = sys.stdin.read().strip()
          pos = 0
          while pos < len(data):
              obj, idx = decoder.raw_decode(data, pos)
              pos = idx
              while pos < len(data) and data[pos] in ' \t\n\r':
                  pos += 1
              if not isinstance(obj, dict):
                  continue
              finding = obj.get('finding')
              if not finding:
                  continue
              osv_id = finding.get('osv', '')
              traces = finding.get('trace', [])
              mod = traces[0].get('module', '') if traces else ''
              ver = traces[0].get('version', '') if traces else ''
              fixed = finding.get('fixed_version', '')
              summary = f'{mod} {ver} is vulnerable ({osv_id}); fixed in {fixed}' if fixed else osv_id
              loc = ''
              for frame in reversed(traces):
                  fpos = frame.get('position', {})
                  fname = fpos.get('filename', '')
                  line_no = fpos.get('line', '')
                  if fname:
                      loc = f'file={fname},line={line_no},'
                      break
              print(f'::warning {loc}title=govulncheck [{osv_id}]::{summary}')
          " || true

      - name: Lint Go code
        run: ./scripts/lint-go.sh ci

      - name: Check Python test suite
        id: check-python
        run: |
          if [ -f "test/requirements.txt" ] && [ -f "test/setup.sh" ]; then
            echo "python_tests_exist=true" >> $GITHUB_OUTPUT
            echo "✅ Python test suite found"
          else
            echo "python_tests_exist=false" >> $GITHUB_OUTPUT
            echo "⚠️  Python test suite not found - skipping Python validation"
          fi

      - name: Setup Python environment
        if: steps.check-python.outputs.python_tests_exist == 'true'
        run: |
          cd test
          python -m venv venv
          source venv/bin/activate
          python -m pip install --upgrade pip
          python -m pip install -r requirements.txt

      - name: Validate Python code quality
        if: steps.check-python.outputs.python_tests_exist == 'true'
        run: ./scripts/lint-python.sh ci

      - name: Lint Markdown files
        run: ./scripts/lint-markdown.sh ci

      # TODO: Re-enable Python tests when ready
      # - name: Run Python tests
      #   if: steps.check-python.outputs.python_tests_exist == 'true'
      #   run: |
      #     cd test
      #     source venv/bin/activate
      #     echo "🧪 Running Python tests..."
      #     if ! pytest -v --tb=short; then
      #       echo "❌ Python tests failed."
      #       exit 1
      #     fi
      #     echo "✅ Python tests passed!"
      #   env:
      #     CF_API: ${{ secrets.CF_API }}
      #     CF_USERNAME: ${{ secrets.CF_USERNAME }}
      #     CF_PASSWORD: ${{ secrets.CF_PASSWORD }}
      #     CF_ORG: ${{ secrets.CF_ORG }}
      #     CF_SPACE: ${{ secrets.CF_SPACE }}

      - name: Build plugin
        run: |
          echo "🔨 Building plugin..."
          if ! python3 .github/workflows/build.py; then
            echo "❌ Build failed."
            exit 1
          fi
          echo "✅ Build successful!"

      - name: Validation Summary
        run: |
          echo ""
          echo "🎉 Pull Request Validation Summary"
          echo "=================================="
          echo "✅ Go code formatting and linting"
          echo "✅ Go tests"
          echo "✅ Markdown formatting and linting"
          if [ "${{ steps.check-python.outputs.python_tests_exist }}" == "true" ]; then
            echo "✅ Python code quality checks"
            echo "✅ Python tests"
          else
            echo "⚠️  Python tests skipped (not found)"
          fi
          echo "✅ Plugin build"
          echo ""
          echo "🚀 Ready for merge!"