squabble.yml

# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
#
# squabble.yml — CICD-Squabbler gate & cross-repo CI dependency chain verifier
# (hyperpolymath/cicd-squabbler; Doctrine rule 5: "Squabble, don't bypass").
#
# Carries zero external `uses:` references (lockfile entry `[]`, matching
# cicd-squabbler's own squabble-action.yml pattern) so it can never be felled
# by a third-party action tag move or lockfile mismatch:
#   1. Checks out the exact commit under test via git HTTP header auth;
#   2. Installs Bun 1.4.2 (sha256-verified) and runs offline Silence + Firing
#      self-tests (`squabble_gate_test.sh`) plus `check-required-contexts.sh`;
#   3. Installs the pinned `squabble` v0.1.0 release binary through
#      `.github/actions/squabble/install.sh` (sha256 + GitHub SLSA provenance
#      attestation verified before chmod +x);
#   4. Runs `squabble chains .=<owner/repo> --follow 1` through
#      `.github/actions/squabble/run.sh`, failing loudly (exit 4) on any
#      cross-repo CI dependency cycle or dead upstream action/workflow.
name: CICD Squabbler

on:
  pull_request:
  push:
    branches: [main, master]
  workflow_dispatch:

permissions:
  contents: read
  attestations: read

concurrency:
  group: squabble-${{ github.ref }}
  cancel-in-progress: true

jobs:
  squabble:
    name: Squabble CI chains & required-context gate
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Check out commit without external uses
        env:
          REPO: ${{ github.repository }}
          SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          AUTH="AUTHORIZATION: basic $(printf 'x-access-token:%s' "${TOKEN}" | base64 -w0)"
          git init -q .
          git remote add origin "https://github.com/${REPO}.git"
          git -c http.extraheader="${AUTH}" fetch -q --depth 1 origin "${SHA}"
          git checkout -q FETCH_HEAD

      - name: Install verified Bun 1.4.2
        run: |
          set -euo pipefail
          curl --proto '=https' --proto-redir '=https' --fail --silent --show-error --location \
            https://github.com/oven-sh/bun/releases/download/bun-v1.4.2/bun-linux-x64.zip \
            --output "$RUNNER_TEMP/bun.zip"
          echo "36368faef7527875d5ffa52e53cd48021741f2a83eb6208a8dd64068d422a913  $RUNNER_TEMP/bun.zip" | sha256sum --check --strict
          unzip -q "$RUNNER_TEMP/bun.zip" -d "$RUNNER_TEMP"
          echo "$RUNNER_TEMP/bun-linux-x64" >> "$GITHUB_PATH"

      - name: Squabble guards & required-context self-tests
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          bash tests/workflows/squabble_gate_test.sh
          bash scripts/check-required-contexts.sh .

      - name: Install pinned & SLSA-attested squabble v0.1.0
        id: install
        env:
          GH_TOKEN: ${{ github.token }}
        run: bash .github/actions/squabble/install.sh

      - name: Audit cross-repo CI dependency chains (cycles & dead upstreams)
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          SQUABBLE_BIN: ${{ steps.install.outputs.path }}
        run: |
          set -euo pipefail
          SQUABBLE_ARGS="$(printf 'chains\n.=%s\n--follow\n1\n' "${REPO}")" \
            bash .github/actions/squabble/run.sh