ci.yml

---
name: CI

"on":
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:
  schedule:
    - cron: '0 6 * * 1'

jobs:
  shellcheck:
    name: ShellCheck (Bash files)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install ShellCheck
        run: sudo apt-get update && sudo apt-get install -y shellcheck

      - name: Run ShellCheck on repository shell files
        run: >-
          shellcheck
          dot_bashrc
          dot_profile
          dot_config/shell_common
          .vscode/test-dotfiles.sh
          .vscode/test-ansible-idempotence.sh
          scripts/debian/*.sh
          scripts/ansible/*.sh
  yaml-lint:
    name: YAML Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Run yamllint
        uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c
        with:
          file_or_dir: '.'

  ansible-syntax:
    name: Ansible Syntax
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Install ansible
        run: pip install ansible

      - name: Install Ansible Galaxy requirements
        working-directory: scripts/ansible
        run: ansible-galaxy install -r requirements.yml

      - name: Run Ansible syntax check
        working-directory: scripts/ansible
        run: ansible-playbook playbook.yml -i inventory/hosts.yml --syntax-check

  ansible-lint:
    name: Ansible Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Install ansible and ansible-lint
        run: pip install ansible ansible-lint

      - name: Install Ansible Galaxy requirements
        working-directory: scripts/ansible
        run: ansible-galaxy install -r requirements.yml

      - name: Run ansible-lint
        working-directory: scripts/ansible
        run: ansible-lint playbook.yml

  chezmoi-validate-linux:
    name: Chezmoi Template Validation (Linux)
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - username: mcp
            email: github@richard-slater.co.uk
          - username: scetrov
            email: git@scetrov.live
          - username: sandbox
            email: ci@example.com
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install chezmoi
        run: |
          sh -c "$(curl -fsLS get.chezmoi.io)" -- -b "$RUNNER_TEMP/bin"
          sudo install -m 0755 "$RUNNER_TEMP/bin/chezmoi" /usr/local/bin/chezmoi

      - name: Create validation user
        run: sudo useradd --create-home --shell /bin/bash "${{ matrix.username }}"

      - name: Prepare workspace copy for validation
        run: |
          workspace_copy="/tmp/chezmoi-${{ matrix.username }}"
          rm -rf "$workspace_copy"
          mkdir -p "$workspace_copy"
          cp -a "$GITHUB_WORKSPACE"/. "$workspace_copy"
          sudo chown -R "${{ matrix.username }}:${{ matrix.username }}" "$workspace_copy"

      - name: Validate chezmoi context
        env:
          CHEZMOI_EMAIL: "${{ matrix.email }}"
        run: |
          sudo -H -u "${{ matrix.username }}" env \
            HOME="/home/${{ matrix.username }}" \
            XDG_CONFIG_HOME="/home/${{ matrix.username }}/.config" \
            GIT_CONFIG_GLOBAL="/dev/null" \
            CHEZMOI="/usr/local/bin/chezmoi" \
            CHEZMOI_EMAIL="$CHEZMOI_EMAIL" \
            WORKSPACE_COPY="/tmp/chezmoi-${{ matrix.username }}" \
            bash -c '
              set -euo pipefail
              source_dir="$(mktemp -d)"
              cp -a "$WORKSPACE_COPY"/. "$source_dir"

              set +e
              "$CHEZMOI" diff --source="$source_dir"
              exit_code=$?
              set -e
              if [ "$exit_code" -gt 1 ]; then
                exit "$exit_code"
              fi

              "$CHEZMOI" doctor --source="$source_dir"
              "$CHEZMOI" managed --source="$source_dir" >/dev/null
            '

  ansible-idempotence:
    name: Ansible Idempotence (Scheduled)
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Run Docker idempotence check
        run: >-
          docker run --rm
          -v "$GITHUB_WORKSPACE:/dotfiles:ro"
          docker.io/library/debian:bookworm
          bash /dotfiles/.vscode/test-ansible-idempotence.sh