codeowners-validator.yml

name: 'Codeowners validation'

on:
  push:
    paths:
    - 'CODEOWNERS'
    - 'docs/CODEOWNERS'
    - '.github/CODEOWNERS'
    - '.github/workflows/codeowners-validator.yml'
    branches:
    - '**'
  schedule:
  - cron: '29 20 * * *' # sync-with-template: adjust
  workflow_dispatch: { }

permissions:
  id-token: write

concurrency:
  group: codeowners-validation-${{github.ref}}
  cancel-in-progress: true

jobs:
  codeowners-validation:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
    - name: Checkout repository
      uses: actions/checkout@v6
      with:
        fetch-depth: 1

    - name: Get repository owner type
      id: owner-type
      run: |
        REPO_JSON=$(curl -s "${{github.api_url}}/repos/${{github.repository}}" -H "Authorization: token ${{github.token}}")
        OWNER_TYPE=$(echo $REPO_JSON | jq -r '.owner.type')
        OWNER_TYPE=$(echo "$OWNER_TYPE" | tr '[:upper:]' '[:lower:]')
        echo "owner-type=$OWNER_TYPE" | tee -a $GITHUB_OUTPUT

    - name: Get GitHub Token
      id: get-token
      uses: remal/github-repository-token-issuer@v1
      with:
        scopes: |
          contents: read
          ${{steps.owner-type.outputs.owner-type == 'organization' && 'members:read' || ''}}

    - name: CODEOWNERS validation
      if: ${{steps.owner-type.outputs.owner-type != 'organization'}}
      uses: mszostok/codeowners-validator@v0.7.4
      with:
        github_access_token: '${{steps.get-token.outputs.token}}'
        checks: ${{steps.owner-type.outputs.owner-type == 'organization' && '' || 'duppatterns,files,syntax'}}