self-test.yml

# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# self-test — run this repo's own test suite.
#
# WHY: `tests/test_check_trusted_base.sh` has existed for some time and was
# wired into NO workflow. A test that never executes is indistinguishable from
# a test that passes — the same shape as the `continue-on-error` gitleaks step
# and the `./src`-only rust-secrets grep. This workflow closes that gap by
# running every `tests/*.sh`, so adding a test is enough to have it enforced.
#
# The suite is deliberately FAIL-CLOSED: an empty tests/ directory, a
# non-executable test, or a missing interpreter fails the job rather than
# reporting a vacuous pass.

name: Self Test

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  tests:
    name: Repo self-tests
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # check-lock-gate-pin-freshness.sh compares the lock gate's pinned
          # commit against the base ref. A depth-1 clone has neither object, and
          # that guard fails rather than skipping on an unresolvable pin, so the
          # history is a requirement and not an optimisation.
          fetch-depth: 0

      # PyYAML is required by the secret-scanner canary. The scorecard
      # grounding tests execute the same checks as registry-verify, including
      # checks that require ripgrep and xmllint.
      - name: Install test dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends ripgrep libxml2-utils ruby ruby-minitest
          python3 -m pip install --user --quiet pyyaml

      - name: Run tests/*.sh and scripts/tests/*.sh
        run: bash scripts/run-shell-test-suite.sh

      # Not part of the offline suite: this one needs real git history, so it
      # cannot live in scripts/tests/*.sh where a contributor runs it on a
      # shallow or detached tree. On a pull request the comparison is the base
      # SHA, so a PR that edits a helper is not asked to pin to its own
      # unborn merge commit; on main it is HEAD, so the bump owed after such a
      # PR lands shows up immediately instead of rotting silently.
      - name: Lock-gate pin is not stale
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          set -euo pipefail
          COMPARE="${BASE_SHA:-$GITHUB_SHA}"
          bash scripts/check-lock-gate-pin-freshness.sh "$COMPARE"