name: Validate

on:
  push:
  pull_request:

jobs:
  dotfiles:
    runs-on: ubuntu-24.04

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install validation tools
        run: |
          sudo apt-get update
          sudo apt-get install --yes build-essential curl file git gnupg procps shellcheck shfmt zsh
          source install/lib/common.sh
          source install/lib/brew.sh
          source install/lib/packages.sh
          install_wezterm
          install_homebrew
          brew install neovim starship stylua
          echo "$BREW_PREFIX/bin" >> "$GITHUB_PATH"

      - name: Restore Neovim plugins
        env:
          DOTFILES_CI: "1"
          XDG_CONFIG_HOME: ${{ github.workspace }}/.config
        run: nvim --headless "+Lazy! restore" +qa

      - name: Validate
        run: bin/check-dotfiles

  # End-to-end installer test: the dotfiles job validates the configs but
  # never runs install.sh itself, which is what rots (apt repo URLs, GPG
  # fingerprints, pinned checksums). Run the full install as a normal user
  # in a pristine container.
  installer:
    runs-on: ubuntu-24.04

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Run full installer in a fresh container
        run: |
          docker run --rm -v "$PWD:/src:ro" ubuntu:24.04 bash -ec '
            export DEBIAN_FRONTEND=noninteractive
            apt-get update
            apt-get install -y --no-install-recommends sudo curl ca-certificates git
            useradd -m -s /bin/bash tester
            echo "tester ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/tester
            cp -r /src /home/tester/dotfiles
            chown -R tester:tester /home/tester/dotfiles
            su tester -c "cd ~/dotfiles && install/install.sh"
            su tester -c "cd ~/dotfiles && install/install.sh --unlink"
          '