# PR gate: validate only. NO signing, NO push, NO secrets.
#
# Pull requests can come from forks, and a fork PR must never be able to reach
# INDEX_SIGNING_KEY or a token that can write to main -- a malicious PR could
# otherwise exfiltrate the key by editing a tool or a workflow step. This job
# runs the validator and nothing else, so the worst a hostile PR can do is fail
# CI.
name: validate
run-name: validate plugin index

on:
  pull_request:
  workflow_dispatch:

jobs:
  validate:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      # Includes the live registry cross-check: the pinned version must exist
      # upstream and its dist.integrity must match the pinned hash exactly.
      # This is the check that fails a PR pinning a hash nobody verified.
      - name: Validate index
        run: bun run validate

      - name: Reviewer reminder
        if: success()
        run: |
          {
            echo "### Automated checks passed"
            echo
            echo "The index is well-formed and every pinned hash matches its registry."
            echo
            echo "**This does not mean the plugin is safe.** The machine can only confirm"
            echo "that the pinned bytes are the bytes upstream serves -- not what those"
            echo "bytes do. Work the review checklist in the PR description before merging."
          } >> "$GITEA_STEP_SUMMARY"