ci.yml

name: CI

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  lint-shell:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: ShellCheck
        uses: ludeeus/action-shellcheck@master
        with:
          scandir: './scripts'
          severity: error

  lint-xml:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Validate XML
        run: |
          sudo apt-get install -y libxml2-utils
          find . -name "*.xml" -not -path "*/.repo/*" -exec xmllint --noout {} \; 2>&1 | grep -v "validates\|warning" || true

  validate-manifest:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Validate repo manifest format
        run: |
          find . -name "*.xml" -path "*manifest*" -not -path "*/.repo/*" | while read -r f; do
            echo "Validating: $f"
            xmllint --noout "$f" 2>&1
          done

  security-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: gitleaks/gitleaks-action@v2