# K22-CODE-SH: check repository tooling before merges and releases.
name: scripts

on:
  pull_request:
  push:
    branches: [main]
  workflow_call:

permissions: {}

jobs:
  javascript:
    name: javascript
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Node
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: "24"
      - name: Install locked tools without lifecycle scripts
        run: npm ci --ignore-scripts
      - name: Lint and test review validation
        run: |
          npm run lint
          npm test
      - name: Verify dependency signatures
        run: npm audit signatures

  powershell:
    name: powershell
    runs-on: windows-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install pinned analyzer and check scripts
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          Install-Module PSScriptAnalyzer -RequiredVersion 1.25.0 -Scope CurrentUser -Force
          Import-Module PSScriptAnalyzer -RequiredVersion 1.25.0
          # Negative fixtures prove neither partition can silently lose its rules.
          $casingFixture = @(Invoke-ScriptAnalyzer -ScriptDefinition "get-content -literalpath 'fixture.txt'" -Settings ./PSScriptAnalyzerSettings.psd1 -IncludeRule PSUseCorrectCasing)
          if('PSUseCorrectCasing' -notin $casingFixture.RuleName) { throw 'The casing pass did not detect incorrect casing.' }
          $remainingFixture = @(Invoke-ScriptAnalyzer -ScriptDefinition "Write-Host 'fixture'" -Settings ./PSScriptAnalyzerSettings.psd1 -ExcludeRule PSUseCorrectCasing)
          if('PSAvoidUsingWriteHost' -notin $remainingFixture.RuleName) { throw 'The remaining-rule pass did not detect Write-Host.' }
          # Keep casing in its own pass: command metadata races other rules in 1.25.0.
          # https://github.com/PowerShell/PSScriptAnalyzer/issues/1708
          foreach($script in Get-ChildItem -LiteralPath build -Recurse -File | Where-Object Extension -In '.ps1', '.psm1', '.psd1')
          {
             Write-Output "Analyzing $($script.Name)"
             try
             {
                $findings = @(
                   Invoke-ScriptAnalyzer -Path $script.FullName -Settings ./PSScriptAnalyzerSettings.psd1 -IncludeRule PSUseCorrectCasing
                   Invoke-ScriptAnalyzer -Path $script.FullName -Settings ./PSScriptAnalyzerSettings.psd1 -ExcludeRule PSUseCorrectCasing
                )
             }
             catch
             {
                Write-Output $_.Exception.ToString()
                throw
             }
             if($findings.Count -gt 0) { $findings | Format-Table; throw "Script analysis failed: $($script.Name)" }
          }
      - name: Verify script boundary tests
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          Install-Module Pester -RequiredVersion 5.7.1 -Scope CurrentUser -Force
          Import-Module Pester -RequiredVersion 5.7.1
          $testConfiguration = New-PesterConfiguration
          $testConfiguration.Run.Path = @('build/Assert-Coverage.Tests.ps1', 'build/GitHubRepository.Tests.ps1', 'build/Distribution.Tests.ps1', 'build/InstalledUpdates.Tests.ps1', 'build/PackageBytes.Tests.ps1', 'build/ReleaseSigning.Tests.ps1')
          $testConfiguration.Run.Exit = $true
          $testConfiguration.TestResult.Enabled = $true
          $testConfiguration.TestResult.OutputPath = 'TestResults/coverage-gate.xml'
          Invoke-Pester -Configuration $testConfiguration