name: Public source validation

on:
  push:
  pull_request:

permissions:
  contents: read

concurrency:
  group: public-validation-${{ gitea.repository }}-${{ gitea.event_name }}-${{ gitea.ref }}
  cancel-in-progress: true

jobs:
  validate:
    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version-file: go.mod
          cache: true
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '24'
          cache: pnpm
      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
        with:
          version: '10.33.0'
      - run: go test ./... && go vet ./...
      - run: pnpm install --frozen-lockfile
      - run: pnpm test && pnpm typecheck && pnpm lint && pnpm build
      - name: Python contract and repository checks
        shell: bash
        run: |
          set -euo pipefail
          python3 -m venv "$RUNNER_TEMP/pulse-validation"
          validation_python="$RUNNER_TEMP/pulse-validation/bin/python"
          "$validation_python" -m pip install --disable-pip-version-check -r requirements-dev.txt
          "$validation_python" tools/check_api_contract.py
          "$validation_python" tools/validate_contracts.py
          "$validation_python" tools/check_wiring.py
          "$validation_python" tools/check_secrets.py
      - run: bash deploy/verify-image-digests.sh
      - name: Export reviewed public source
        run: node scripts/export-public-source.mjs --output "$RUNNER_TEMP/pulse-public"
      - name: Validate exported source manifest
        run: cd "$RUNNER_TEMP/pulse-public" && node scripts/validate-public-source.mjs
      - name: Dependency scan
        run: sh scripts/run-trivy-fs-scan.sh "$RUNNER_TEMP/pulse-public"