validate.yml

name: Validate dotfiles

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  validate:
    name: Validate configuration
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Install validation tools
        run: |
          sudo apt-get update
          sudo apt-get install --yes --no-install-recommends stow zsh

      - name: Validate Stow packages and shell syntax
        run: |
          set -euo pipefail
          bash -n stow.sh

          while IFS= read -r -d '' file; do
            zsh -n "$file"
          done < <(git ls-files -z -- '*.zsh' '.zprofile' '.zshrc' '.zshenv')

          mkdir -p "$RUNNER_TEMP/stow-target"
          HOME="$RUNNER_TEMP/stow-target" ./stow.sh

      - name: Validate TOML, JSON, and encrypted-secret layout
        run: |
          python3 - <<'PY'
          from __future__ import annotations

          import json
          import subprocess
          import tomllib
          from pathlib import Path

          tracked = subprocess.check_output(["git", "ls-files", "-z"], text=True).split("\0")
          for name in filter(None, tracked):
              path = Path(name)
              if path.suffix == ".toml":
                  tomllib.loads(path.read_text(encoding="utf-8"))
              elif path.suffix == ".json":
                  json.loads(path.read_text(encoding="utf-8"))

          for path in Path("secrets").glob("*.sops.env"):
              content = path.read_text(encoding="utf-8")
              if "ENC[" not in content or "sops_" not in content:
                  raise SystemExit(f"{path} is not an encrypted SOPS dotenv file")
          PY