ci.yaml

name: CI

# ↓ lock down top‐level permissions to only what we use
permissions:
  contents: read             # we only need to checkout code
  actions: read              # to query workflows/runs
  statuses: write

# Run on pushes to any branch and pull requests
on:
  push:
    branches: ['main']
  pull_request:
    branches: ['**']

jobs:
  # Lint all YAML, JSON & Shell
  lint:
    name: Lint code & configs
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
        with:
          fetch-depth: 0

      - name: Check compose files
        run: |
          source ./.envrc
          # Test main compose file
          docker compose config -q
          # Test profiles
          docker compose --profile cardano config -q
          docker compose --profile ogmios config -q
          docker compose --profile proof-server config -q
          docker compose --profile cardano --profile ogmios --profile proof-server config -q

      - name: Run Super-linter
        uses: github/super-linter@b807e99ddd37e444d189cfd2c2ca1274d8ae8ef1  #v7
        env:
          # only lint the file types you care about
          VALIDATE_YAML: true
          VALIDATE_JSON: true
          VALIDATE_SHELL: true
          VALIDATE_BASH: true
          VALIDATE_BASH_EXEC: true
          VALIDATE_CHECOV: true
          VALIDATE_GITHUB_ACTIONS: true
          VALIDATE_NATURAL_LANGUAGE: true
          VALIDATE_MARKDOWN: true
          VALIDATE_DOCKERFILE: true
          FILTER_REGEX_EXCLUDE: (^cardano-config/|LICENSE\.md)
          # tell it your default branch so it can diff
          DEFAULT_BRANCH: origin/main
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}