ci-integrity.yml

# SPDX-License-Identifier: MPL-2.0
# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
#
# Source integrity checks cannot establish GitHub's effective live Actions
# policy or explain a zero-job startup failure without its actual diagnostic.
# Native lock generation belongs to the published canonical recovery chain.
name: CI Integrity

on:
  pull_request:
  push:
    branches: [main, master]
  schedule:
    - cron: '17 5 * * 1'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-integrity-${{ github.ref }}
  cancel-in-progress: true

env:
  YQ_VERSION: v4.54.1
  STANDARDS_REF: 087f6bff5135ce3da6f287c83752256ce4a8efc1

jobs:
  integrity:
    name: CI integrity (pins, lock, allowlist, YAML)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Initialize runner-local paths and evidence
        shell: bash
        run: |
          set -euo pipefail
          standards_root="$RUNNER_TEMP/panic-ci-integrity-standards"
          evidence_dir="$RUNNER_TEMP/panic-ci-integrity-evidence"
          mkdir -p "$evidence_dir"
          printf 'not_run\n' > "$evidence_dir/native.exit"
          {
            printf 'STANDARDS_ROOT=%s\n' "$standards_root"
            printf 'ACTIONS_LOCK_EVIDENCE_DIR=%s\n' "$evidence_dir"
          } >> "$GITHUB_ENV"

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Install checksum-qualified YAML and native lock tools
        run: |
          set -euo pipefail
          tool_dir="$RUNNER_TEMP/panic-ci-integrity-bin"
          mkdir -p "$tool_dir"
          curl --fail --show-error --silent --location --proto '=https' --proto-redir '=https' --tlsv1.2 --retry 3 --max-time 60 \
            "https://github.com/mikefarah/yq/releases/download/$YQ_VERSION/yq_linux_amd64" -o "$tool_dir/yq"
          printf '%s  %s\n' '8e34fc298390875de416e6a4afcb8cabeceb25d9aa8506c1a2f9353cf702ea5f' "$tool_dir/yq" | sha256sum --check
          curl --fail --show-error --silent --location --proto '=https' --proto-redir '=https' --tlsv1.2 --retry 3 --max-time 60 \
            https://github.com/github/gh-actions-lock/releases/download/v0.2.0/linux-amd64 -o "$tool_dir/gh-actions-lock"
          printf '%s  %s\n' '79ec84c191667fd935a277e6fd3662cf5d3669cccc9e99998731d8f306f373b6' "$tool_dir/gh-actions-lock" | sha256sum --check
          chmod u+x "$tool_dir/yq" "$tool_dir/gh-actions-lock"
          "$tool_dir/yq" --version
          printf '%s\n' "$tool_dir" >> "$GITHUB_PATH"
          printf 'GH_ACTIONS_LOCK_BIN=%s\n' "$tool_dir/gh-actions-lock" >> "$GITHUB_ENV"

      - name: Fetch unchanged published canonical helpers
        run: |
          set -euo pipefail
          git init --quiet "$STANDARDS_ROOT"
          timeout 120 git -C "$STANDARDS_ROOT" fetch --quiet --no-tags --depth=1 \
            https://github.com/metadatastician/standards.git "$STANDARDS_REF"
          git -C "$STANDARDS_ROOT" checkout --quiet --detach FETCH_HEAD
          test "$(git -C "$STANDARDS_ROOT" rev-parse HEAD)" = "$STANDARDS_REF"

      - name: CI integrity regression controls
        run: bash scripts/ci/test-ci-integrity.sh

      - name: SHA pins (canon rule 10)
        run: bash .githooks/validate-sha-pins.sh

      - name: Canonical executable workflow coordinates
        run: bash "$STANDARDS_ROOT/scripts/check-workflow-coordinates.sh" .github/workflows

      - name: Native lock coverage and canonical lock sync
        run: bash .githooks/validate-actions-lock.sh

      - name: Exact tree allowlist (live Settings unverified)
        run: bash scripts/ci/check-allowed-actions.sh .github/actions-allowlist.json .github/workflows

      - name: Startup-failure source triage
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if [ "${{ github.event_name }}" = workflow_dispatch ]; then
            bash scripts/ci/triage-startup-failure.sh
          else
            bash scripts/ci/triage-startup-failure.sh --report
          fi

      - name: Every workflow parses and has a jobs map
        run: |
          set -euo pipefail
          fail=0
          for f in .github/workflows/*.yml .github/workflows/*.yaml; do
            [ -e "$f" ] || continue
            if ! yq -e '.' "$f" >/dev/null 2>&1; then
              echo "::error file=$f::does not parse as YAML"
              fail=1
              continue
            fi
            if [ "$(yq -r '.jobs | tag' "$f")" != '!!map' ]; then
              echo "::error file=$f::parses but declares no jobs: map"
              fail=1
            fi
          done
          exit "$fail"

      - name: Native CI helper contracts
        run: |
          set -euo pipefail
          cargo test --locked --manifest-path tools/ci/Cargo.toml
          cargo clippy --locked --manifest-path tools/ci/Cargo.toml --all-targets -- -D warnings
          bash scripts/ci/test-inventory-failure.sh

      - name: Repository path portability
        run: |
          set -euo pipefail
          rustc --version
          CHECKER="$RUNNER_TEMP/check-repository-paths"
          rustc --edition 2021 --test scripts/ci/check-repository-paths.rs -o "$CHECKER-tests"
          "$CHECKER-tests"
          rustc --edition 2021 scripts/ci/check-repository-paths.rs -o "$CHECKER"
          "$CHECKER" "$GITHUB_WORKSPACE"

      - name: Retain raw native result and immutable source identity
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        with:
          name: ci-integrity-native-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/panic-ci-integrity-evidence
          if-no-files-found: error
          retention-days: 14

      - name: Summary
        if: always()
        run: |
          {
            echo '## CI integrity'
            echo ''
            echo 'Step conclusions record the result; this table describes each gate.'
            echo ''
            echo '| Gate | Scope |'
            echo '|------|-------|'
            echo '| SHA pins and coordinates | Immutable refs and canonical executable repository names |'
            echo '| Native lock | Official v0.2.0 result, unchanged published reconciliation and bidirectional lock sync |'
            echo '| Tree allowlist | Complete action/workflow path and exact SHA, without a live Settings claim |'
            echo '| YAML parse | Readable workflow documents with a jobs map |'
            echo '| Repository paths | Windows device/component restrictions and case/file-directory collisions in the complete tracked inventory |'
            echo '| Startup triage | Source/API observations; no inferred platform root cause from zero jobs alone |'
            echo ''
            echo 'The raw artifact records not_run if consumer verification never executed, or running if no native exit was recorded.'
          } >> "$GITHUB_STEP_SUMMARY"