ca-template-check.yml

name: CA template

on:
  push:
    branches:
      - main
    paths:
      - 'templates/*.xml'
      - 'ca_profile.xml'
      - 'scripts/ca-validate.py'
      - '.github/workflows/ca-template-check.yml'
  pull_request:
    paths:
      - 'templates/*.xml'
      - 'ca_profile.xml'
      - 'scripts/ca-validate.py'
      - '.github/workflows/ca-template-check.yml'

# Reads the tree and nothing else.
permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # Python's standard library, so nothing is installed. The runner image
      # carries no xmllint.
      - name: Validate the template and the profile
        run: python3 scripts/ca-validate.py "${{ github.repository }}" "${{ github.event.repository.default_branch }}"