ci.yml

# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: CI

on:
  pull_request:
    branches: ["main"]
  push:
    branches: ["main"]

# Least privilege: these jobs only read the repo; no write scopes are needed.
permissions:
  contents: read

# Cancel superseded runs when new commits are pushed to the same ref.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  UV_VERSION: "0.10.x"
  PYTHON_VERSION: "3.12"
  NODE_VERSION: "22.20.0"
  UV_CACHE_DIR: .uv-cache
  UV_LINK_MODE: copy

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      docker: ${{ steps.filter.outputs.docker }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
      - id: filter
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          if git diff --quiet "$BASE_SHA" "$HEAD_SHA" -- \
            .dockerignore .github/workflows/ci.yml .gitlab-ci.yml Dockerfile \
            Makefile pyproject.toml uv.lock src tests/docker tests/fixtures/safe_skill; then
            echo "docker=false" >> "$GITHUB_OUTPUT"
          else
            echo "docker=true" >> "$GITHUB_OUTPUT"
          fi

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Set up uv
        # Pinned to a full commit SHA (third-party action); comment tracks the tag.
        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
        with:
          version: ${{ env.UV_VERSION }}
          enable-cache: true
          cache-dependency-glob: uv.lock
          python-version: ${{ env.PYTHON_VERSION }}
      - run: make install-dev
      - run: uv run make lint
      - run: uv run make format-check

  test-unit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Set up uv
        # Pinned to a full commit SHA (third-party action); comment tracks the tag.
        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
        with:
          version: ${{ env.UV_VERSION }}
          enable-cache: true
          cache-dependency-glob: uv.lock
          python-version: ${{ env.PYTHON_VERSION }}
      - run: make install-dev
      - run: uv run skillspector --version
      - run: uv run make test-ci

  test-opencode:
    name: OpenCode TypeScript Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Set up Node.js
        # Pinned to a full commit SHA (third-party action); comment tracks the tag.
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: node --test tests/opencode/skillspector_scan_lib.test.ts
      - name: Run Pi extension security tests
        run: node --test tests/unit/test_pi_extension.mjs

  docker-smoke:
    needs: changes
    if: needs.changes.outputs.docker == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - run: docker version
      - run: docker info
      - run: docker build -t skillspector .
      - run: tests/docker/smoke.sh
      - if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: docker-smoke-reports
          path: |
            .skillspector-docker-smoke.json
            .skillspector-docker-github-smoke.json
          if-no-files-found: ignore

  dco:
    name: DCO Check
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Verify DCO sign-off on all commits
        run: |
          BASE=${{ github.event.pull_request.base.sha }}
          HEAD=${{ github.event.pull_request.head.sha }}
          # Iterate SHAs directly rather than piping `git log` into `while read`:
          # `git log` does not print a trailing newline after the final record,
          # so a read-loop silently skips the last commit — and for a one-commit
          # PR (the common case) the body never runs at all, letting an unsigned
          # commit pass. A for-loop over the SHA list checks every commit.
          status=0
          for sha in $(git log --format=%H "${BASE}..${HEAD}"); do
            parents=$(git show -s --format=%P "$sha")
            committer_email=$(git show -s --format=%ce "$sha")
            # GitHub's update-branch API creates a merge commit without a DCO
            # trailer. Its parents were already checked, so exempt only those
            # GitHub-generated merge commits; contributor commits still require
            # sign-off.
            if [[ "$parents" == *" "* && "$committer_email" == "noreply@github.com" ]]; then
              continue
            fi
            if ! git log -1 --format="%B" "$sha" | grep -q "^Signed-off-by:"; then
              echo "  missing Signed-off-by: $sha $(git log -1 --format=%s "$sha")"
              status=1
            fi
          done
          if [ "$status" -ne 0 ]; then
            echo ""
            echo "Please add a DCO sign-off (git commit -s) to all commits."
            exit 1
          fi
          echo "All commits have DCO sign-off."