name: Validate

on:
  push:
    branches:
      - main
      - "release/**"
  pull_request:

jobs:
  validate:
    name: Validate and build (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    defaults:
      run:
        # AgentBoot targets git-bash on Windows (bash is available on the runner),
        # so run every step in bash for parity with Linux/macOS.
        shell: bash

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "22"
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Configure git identity (required by tests)
        run: |
          git config --global user.name "CI"
          git config --global user.email "ci@agentboot.dev"

      - name: Typecheck
        run: npm run typecheck

      - name: Validate personas and traits
        run: npm run validate

      - name: Build
        run: npm run build

      # Agent Skills spec conformance — run the OFFICIAL skills-ref validator
      # against every emitted skill so the dist/skill tree cannot silently drift
      # from agentskills.io compliance (regression: provenance header used to be
      # emitted before the frontmatter and failed every persona).
      - name: Agent Skills spec conformance (skills-ref)
        shell: bash
        run: |
          found=0
          for d in dist/skill/core/*/; do
            [ -f "$d/SKILL.md" ] || continue
            found=1
            # Deliberately pinned to an exact version so a compromised or broken
            # upstream publish cannot alter this merge gate. To bump: check
            # `npm view skills-ref version` and update the pin here.
            npx -y skills-ref@0.1.5 validate "$d"
          done
          if [ "$found" -eq 0 ]; then
            echo "::error::no skills found under dist/skill/core — build output layout changed?"
            exit 1
          fi

      # Plugin-spec conformance — the OFFICIAL claude plugin validate against
      # dist/plugin (manifest at .claude-plugin/plugin.json, spec field types,
      # registered hooks). Linux leg only; the offline mirror in
      # tests/agentskills-conformance.test.ts covers both platforms.
      - name: Plugin spec conformance (claude plugin validate)
        if: runner.os == 'Linux'
        shell: bash
        run: |
          # Deliberately pinned to an exact version so a compromised or broken
          # upstream publish cannot alter this merge gate. To bump: check
          # `npm view @anthropic-ai/claude-code version` and update the pin here.
          npm install -g @anthropic-ai/claude-code@2.1.215
          claude plugin validate ./dist/plugin

      # D2: enforcement conformance — execute the compiled hook scripts with
      # crafted inputs (clean / secret canary / malformed / oversized) and fail
      # the build if observed behavior diverges from the declared enforcement
      # level. Also writes dist/<platform>/enforcement-manifest.json.
      - name: Enforcement conformance (hook behavior)
        shell: bash
        run: npx tsx scripts/cli.ts conformance

      - name: Run tests
        run: npm test

      - name: Check PERSONAS.md is up to date
        run: |
          if ! git diff --exit-code PERSONAS.md; then
            echo ""
            echo "PERSONAS.md is out of date."
            echo "Run 'npm run build' locally and commit the updated PERSONAS.md."
            exit 1
          fi