lint.yml

name: Lint

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint (bash + lua)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          persist-credentials: false

      - name: Install shellcheck
        run: sudo apt-get update -qq && sudo apt-get install -y shellcheck

      - name: Install selene
        run: |
          SELENE_VERSION=0.29.0
          curl -fsSL "https://github.com/Kampfkarren/selene/releases/download/${SELENE_VERSION}/selene-light-${SELENE_VERSION}-linux.zip" -o selene.zip
          unzip -q selene.zip
          chmod +x selene
          sudo mv selene /usr/local/bin/

      - name: Install yamlfmt
        run: |
          YAMLFMT_VERSION=0.21.0
          curl -fsSL "https://github.com/google/yamlfmt/releases/download/v${YAMLFMT_VERSION}/yamlfmt_${YAMLFMT_VERSION}_Linux_x86_64.tar.gz" \
            | sudo tar -xz -C /usr/local/bin yamlfmt
          sudo chmod +x /usr/local/bin/yamlfmt

      - name: Discover shell scripts (by shebang or shellcheck directive)
        id: discover
        run: |
          mapfile -t scripts < <(
            find . -type f \
              -not -path './.git/*' \
              -not -path './ramona/*' \
              -not -path './.local/share/*' \
              -not -path './.pixi/*' \
              -not -path './.config/nvim/lazy-lock.json' \
              -exec sh -c 'head -n1 "$1" 2>/dev/null | grep -qE "^(#!.*sh\b|# shellcheck shell=)"' _ {} \; \
              -print
          )
          printf '%s\n' "${scripts[@]}" | tee discovered.txt
          {
            echo "## Discovered shell scripts (${#scripts[@]})"
            printf -- '- `%s`\n' "${scripts[@]}"
          } >> "$GITHUB_STEP_SUMMARY"
          echo "count=${#scripts[@]}" >> "$GITHUB_OUTPUT"

      - name: bash -n syntax fast-fail
        if: always() && steps.discover.outputs.count != '0'
        run: |
          set -e
          while IFS= read -r f; do
            echo "→ bash -n $f"
            bash -n "$f"
          done < discovered.txt
          echo "✓ all scripts pass syntax check"

      - name: shellcheck
        if: always() && steps.discover.outputs.count != '0'
        run: |
          EXCLUDES=SC1090,SC1091,SC2034,SC2154
          fail=0
          while IFS= read -r f; do
            if ! shellcheck -x --exclude="$EXCLUDES" "$f"; then
              fail=1
            fi
          done < discovered.txt
          [ "$fail" -eq 0 ] && echo "✓ shellcheck clean"
          exit $fail

      - name: stylua --check
        if: always()
        uses: JohnnyMorganz/stylua-action@479972f01e665acfcba96ada452c36608bdbbb5e # v4.1.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          version: latest
          args: --check .config/nvim

      - name: selene
        if: always()
        run: selene .

      - name: yamlfmt --lint
        if: always()
        run: yamlfmt -lint