ci.yml

name: CI
# Dogfoods this repo's own composite actions on every push and PR.
# Serves as a live reference implementation for consuming repos.

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '0 6 * * 1'  # weekly Monday 06:00 UTC — for scorecard
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Lint workflow and action YAML files with actionlint.
  actionlint:
    name: Actionlint
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/github-actionlint

  # Lint Terraform/OpenTofu with tflint. This repo has no .tf files, so this is
  # a smoke test that the composite installs and runs (exits 0 on no findings).
  tflint:
    name: TFLint
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/tflint

  # Validate Helm/Kustomize with kubeconform. This repo has no charts/, so this
  # is a smoke test that the composite installs and runs (exits 0, nothing to
  # validate).
  kubeconform:
    name: Kubeconform
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/kubeconform

  # Dogfood the app lint gate by calling the reusable workflow directly.
  # (MegaLinter has no composite under .github/actions — its only reliable gate
  # is its exit code, which needs continue-on-error + if:always; those are
  # job-step features composite-internal steps don't support. See lint-app.yml.)
  lint-app:
    name: Lint App
    permissions:
      contents: read
      security-events: write  # SARIF upload to the Security tab
    uses: ./.github/workflows/lint-app.yml
    with:
      default-branch: main

  # Run this repo's own .pre-commit-config.yaml hooks via the composite.
  pre-commit:
    name: Pre-commit
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0  # full history so the PR diff range can be resolved

      - uses: ./.github/actions/pre-commit

  # Pattern-based secret detection with Gitleaks.
  # Hard-fails the build on any match. On PRs scans only the PR commit range.
  gitleaks:
    name: Gitleaks
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0  # full history so the PR commit range can be scanned

      - uses: ./.github/actions/gitleaks

  # Verified active-secret detection with TruffleHog.
  # Hard-fails on any verified secret; unverified matches are warnings in the
  # Security tab. On PRs scans only the PR commit range.
  trufflehog:
    name: TruffleHog
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write  # SARIF upload to the Security tab
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0  # full history so the PR commit range can be scanned

      - uses: ./.github/actions/trufflehog

  # Security-scan workflow and action YAML files with zizmor.
  zizmor:
    name: Zizmor
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/zizmor

  # Run OpenSSF Scorecard on push to main and schedule only.
  # Scorecard hard-requires the default branch; skipped on PRs and feature branches.
  scorecard:
    name: OpenSSF Scorecard
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    permissions:
      contents: read
      actions: read
      security-events: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/scorecard

  # Review dependency changes for vulnerabilities and license issues.
  # On pull_request: compares PR base/head via built-in event context.
  # On push to main: compares the pushed range (event.before → sha) so maintainers
  # can see the action work end-to-end without opening a PR.
  # Skipped on first push to a branch (event.before = zero SHA) — no base to compare.
  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main' && github.event.before != '0000000000000000000000000000000000000000')
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/dependency-review
        with:
          base-ref: ${{ github.event_name == 'push' && github.event.before || '' }}
          head-ref: ${{ github.event_name == 'push' && github.sha || '' }}

  # Verify Terramate and OpenTofu are installed correctly.
  # Terramate stack steps are no-ops in this repo (no stacks defined).
  terramate-opentofu-setup:
    name: Terramate + OpenTofu Setup
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0  # terramate --changed requires full git history

      - uses: ./.github/actions/terramate-opentofu-setup

  # Verify the storage optimizer composite action runs without error.
  # Runs on push to main (demonstration) and workflow_dispatch (on-demand).
  storage-optimizer:
    name: Storage Optimizer
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
    permissions:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/storage-optimizer