ci.yml

# agentbox CI. Runs `make check`, which lints and tests whatever languages are
# present; targets self-skip when their sources are absent, so this stays green
# on a sparse tree and activates per language as code lands. This workflow also
# serves as the fork confirmation gate from the roadmap; fork-specific wiring is
# added with that sub-project.
name: ci

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Go toolchain + linter only when there is a module to build.
      - name: Set up Go
        if: ${{ hashFiles('go.mod') != '' }}
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Install golangci-lint
        if: ${{ hashFiles('go.mod') != '' }}
        run: |
          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh \
            | sh -s -- -b "$(go env GOPATH)/bin" v2.12.2
          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"

      # shellcheck is preinstalled on ubuntu-latest; add shfmt for the bash target.
      - name: Install shfmt
        run: go install mvdan.cc/sh/v3/cmd/shfmt@latest

      - name: Install ansible-lint
        run: pipx install ansible-lint

      - name: Set up Packer
        uses: hashicorp/setup-packer@v3
        with:
          version: "1.11.2"

      # tmux backs the devctl bats suite (private test socket, no real server).
      - name: Install bats and tmux
        run: sudo apt-get update && sudo apt-get install -y bats tmux

      # terraform_wrapper: false keeps the real binary on PATH so `terraform
      # -chdir=... fmt -check` and `validate` run directly, not through a wrapper.
      - name: Set up Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_wrapper: false

      - name: Set up TFLint
        uses: terraform-linters/setup-tflint@v4

      # STRICT=1: a missing tool fails the build instead of skipping, so CI
      # cannot go green by silently not linting or testing.
      - name: make check
        run: make check STRICT=1