bashtest.yml

name: CI

on: [push, pull_request]

jobs:
  lint:
    name: Lint and syntax
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install shells and shellcheck
        run: |
          sudo apt-get update
          sudo apt-get install -y shellcheck zsh fish desktop-file-utils

      - name: shellcheck (scripts, warning severity)
        run: shellcheck -S warning -f gcc ./*.sh

      - name: shellcheck (shell configs, error severity)
        run: shellcheck -S error -f gcc .bashrc .bash_aliases .bashrc_help

      - name: bash syntax
        run: |
          for f in *.sh .bashrc .bash_aliases .bashrc_help; do
            bash -n "$f"
          done

      - name: zsh syntax
        run: |
          zsh -n .zshrc
          zsh -n .zshrc_help

      - name: fish syntax
        run: |
          fish --no-execute config.fish
          fish --no-execute fish_help

      - name: Settings GUI self-test (settings model, aliases, menu entry)
        run: |
          bash dxsbash-gui.sh --selftest
          awk -f tools/ansi2pango.awk </dev/null >/dev/null

  install-test:
    name: Install on ${{ matrix.image }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - image: "debian:13"
            family: debian
          - image: "debian:12"
            family: debian
          - image: "ubuntu:24.04"
            family: debian
          - image: "archlinux:latest"
            family: arch
          - image: "fedora:latest"
            family: fedora
    container:
      image: ${{ matrix.image }}
    env:
      # The runner defaults container HOME to /github/home, but the
      # installer resolves the real user's home via getent (/root for
      # root) — keep them consistent so setup, doctor and the shell
      # configs all agree on where things live.
      HOME: /root
      DXSBASH_SKIP_FONT: "1"
      DEBIAN_FRONTEND: noninteractive
    steps:
      - name: Install prerequisites (Debian/Ubuntu)
        if: matrix.family == 'debian'
        run: |
          apt-get update
          apt-get install -y sudo git curl wget ca-certificates unzip

      - name: Install prerequisites (Arch)
        if: matrix.family == 'arch'
        run: |
          pacman -Syu --noconfirm sudo git curl wget ca-certificates unzip tar gzip

      - name: Install prerequisites (Fedora)
        if: matrix.family == 'fedora'
        run: |
          dnf install -y sudo git curl wget ca-certificates unzip tar gzip findutils

      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Stage repository at the install location
        run: |
          mkdir -p /root/linuxtoolbox
          cp -a "$GITHUB_WORKSPACE" /root/linuxtoolbox/dxsbash
          git config --global --add safe.directory /root/linuxtoolbox/dxsbash

      - name: Run installer (bash, non-interactive)
        run: |
          cd /root/linuxtoolbox/dxsbash
          ./setup.sh --install --yes --shell bash

      - name: Doctor health check
        run: |
          cd /root/linuxtoolbox/dxsbash
          ./doctor.sh --no-color --verbose

      - name: Config loads and helper commands work
        run: |
          bash -c 'source /root/.bashrc; type extract >/dev/null; type aliases >/dev/null; echo ".bashrc loads OK"'
          test -x /usr/local/bin/update-dxsbash
          test -x /usr/local/bin/dxsbash-config
          test -x /usr/local/bin/dxsbash-repair
          test -x /usr/local/bin/dxsbash-doctor
          test -x /usr/local/bin/dxsbash-audit
          test -x /usr/local/bin/dxsbash
          test -x /usr/local/bin/dxsbash-gui
          /usr/local/bin/dxsbash-gui --selftest
          /usr/local/bin/dxsbash version
          /usr/local/bin/dxsbash help

      - name: Security audit runs
        run: |
          # audit exits 1 when it finds FAILs, which is expected in a
          # bare container — assert it produces a summary either way.
          /usr/local/bin/dxsbash audit --no-color | tee /tmp/audit.txt || true
          grep -q "Summary" /tmp/audit.txt
          /usr/local/bin/dxsbash-audit --help >/dev/null

      - name: Security summary caches and prints
        run: |
          /root/linuxtoolbox/dxsbash/secsummary.sh --refresh | grep -q "Security:"
          test -f /root/.dxsbash/security-summary.txt
          # --startup must be fast and must not error
          /root/linuxtoolbox/dxsbash/secsummary.sh --startup | grep -q "Security:"

  build-deb:
    name: Build .deb package
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Build package
        run: |
          chmod +x packaging/build-deb.sh
          ./packaging/build-deb.sh

      - name: Verify package metadata and contents
        run: |
          dpkg-deb --info dist/dxsbash_*_all.deb
          dpkg-deb --contents dist/dxsbash_*_all.deb | head -40
          # The package must ship the installer entry points
          dpkg-deb --contents dist/dxsbash_*_all.deb | grep -q "usr/bin/dxsbash-installer"
          dpkg-deb --contents dist/dxsbash_*_all.deb | grep -q "usr/share/dxsbash/setup.sh"

      - name: Smoke-install the package
        run: |
          sudo dpkg -i dist/dxsbash_*_all.deb || sudo apt-get install -f -y
          test -x /usr/bin/dxsbash-installer
          test -f /usr/share/dxsbash/setup.sh
          dpkg -s dxsbash | grep -q "Status: install ok installed"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: dxsbash-deb
          path: dist/*.deb

  build-arch:
    name: Build Arch package
    runs-on: ubuntu-latest
    container:
      image: archlinux:latest
    steps:
      - name: Install build tools
        run: pacman -Syu --noconfirm --needed base-devel git sudo

      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Build package (makepkg refuses root — use a build user)
        run: |
          useradd -m builder
          cp -a "$GITHUB_WORKSPACE" /home/builder/dxsbash
          chown -R builder:builder /home/builder/dxsbash
          sudo -u builder -H bash -c 'cd ~/dxsbash && ./packaging/build-arch.sh'

      - name: Install and verify the package
        run: |
          pkg=$(ls /home/builder/dxsbash/dist/dxsbash-*-any.pkg.tar.*)
          pacman -U --noconfirm "$pkg"
          test -x /usr/bin/dxsbash-installer
          test -f /usr/share/dxsbash/setup.sh
          test -f /usr/share/licenses/dxsbash/LICENSE
          pacman -Qi dxsbash

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: dxsbash-arch
          path: /home/builder/dxsbash/dist/*.pkg.tar.*