validate.yml

name: Validate index

# Every change to the index must pass the same rules Lithe applies to a
# third-party source; new or changed archives are downloaded and checked.
on:
  pull_request:
  push:
    branches: [main]
  schedule:
    # Weekly re-check of every listed archive: release assets can be deleted
    # or replaced after they were merged.
    - cron: "17 3 * * 1"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: validate-${{ github.ref }}
  cancel-in-progress: true

jobs:
  validate:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v7
        with:
          node-version: 22

      - name: Unit tests
        run: node --test scripts/store.test.mjs

      - name: Validate index
        run: node scripts/validate-index.mjs lithe-plugin-index.json

      - name: Pick the base index
        id: base
        run: |
          case "${{ github.event_name }}" in
            pull_request) ref="origin/${{ github.base_ref }}" ;;
            push) ref="${{ github.event.before }}" ;;
            *) ref="" ;;
          esac
          if [ -n "$ref" ] && git show "$ref:lithe-plugin-index.json" > "$RUNNER_TEMP/base-index.json" 2>/dev/null; then
            echo "args=--base $RUNNER_TEMP/base-index.json" >> "$GITHUB_OUTPUT"
          else
            echo "args=" >> "$GITHUB_OUTPUT"
          fi

      - name: Verify archives (checksum and plugin.json)
        run: node scripts/validate-index.mjs lithe-plugin-index.json --verify-archives ${{ steps.base.outputs.args }}

      - name: Check the index contract has not changed
        # validate-index.mjs follows the index rules of the Lithe plugin
        # contract, published in lithe-plugin-docs. A different schema there
        # means the rules changed; see docs/maintainers.md.
        env:
          SCHEMA_URL: https://raw.githubusercontent.com/Lithe-IDEA/lithe-plugin-docs/main/contract/v1/plugin-index.schema.json
          SCHEMA_SHA256: 6771cb0e8c1ba101e6fc90b436de1b74f057ff0d58cc90f92e669edc9a102fc6
        run: |
          status=$(curl -sS -o "$RUNNER_TEMP/plugin-index.schema.json" -w '%{http_code}' "$SCHEMA_URL")
          if [ "$status" = "404" ]; then
            echo "::notice::lithe-plugin-docs does not publish plugin-index.schema.json yet; skipping contract check."
          elif [ "$status" != "200" ]; then
            echo "::warning::Could not fetch the published schema (HTTP $status)."
          else
            actual=$(sha256sum "$RUNNER_TEMP/plugin-index.schema.json" | cut -d' ' -f1)
            if [ "$actual" != "$SCHEMA_SHA256" ]; then
              echo "::error::The published plugin-index.schema.json changed (SHA-256 $actual). Update validate-index.mjs, scripts/fixtures and SCHEMA_SHA256 together; see docs/maintainers.md."
              exit 1
            fi
          fi