validate-task.yml

name: Validate task

# The single validation gate: unit tests + the full lint set (the editor's checks, enforced in CI). Reused by
# test-pull-request (produces the required check) and the publisher, so the CI and publish gates are identical.
on:
  workflow_call:
    inputs:
      # Git ref to validate (empty = default checkout ref). The publisher passes its trigger branch so the
      # publish run validates the branch it publishes.
      ref:
        required: false
        type: string
        default: ''

jobs:

  unit-test:
    name: Run unit tests job
    runs-on: ubuntu-latest

    steps:

      - name: Setup .NET SDK step
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: 10.x

      - name: Checkout code step
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.ref }}

      # Builds with TreatWarningsAsErrors, so analyzer and code-style warnings fail here.
      # global.json opts dotnet test into Microsoft.Testing.Platform (MTP), the .NET 10 SDK's replacement for
      # the VSTest runner, and Microsoft.Testing.Extensions.CodeCoverage emits the Cobertura XML.
      # --coverage-output stays unset, since pinning one filename gives every test project in the solution the
      # same path and the last to finish overwrites the rest. The default <guid>.cobertura.xml it writes instead
      # is a name codecov-cli's own file finder does not match, its patterns being *coverage*.* and an exact
      # cobertura.xml, so each report is prefixed rather than renamed, keeping the guid that makes it unique.
      # This step is byte-identical to the hub validator's own, so the two gates cannot drift on coverage.
      - name: Run unit tests step
        run: |
          set -Eeuo pipefail
          dotnet test --coverage --coverage-output-format cobertura --results-directory ./coverage
          for report in ./coverage/*.cobertura.xml; do
            [ -e "$report" ] || continue
            mv "$report" "./coverage/coverage-$(basename "$report")"
          done

      # Report-only: fail_ci_if_error is false so a Codecov hiccup or an absent token never fails the gate.
      - name: Upload coverage to Codecov step
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
        with:
          directory: ./coverage
          fail_ci_if_error: false
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  # The editor's checks, enforced in CI from the same config files.
  lint:
    name: Lint job
    runs-on: ubuntu-latest

    steps:

      - name: Setup .NET SDK step
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: 10.x

      - name: Checkout code step
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.ref }}

      - name: Check C# formatting step
        run: |
          set -Eeuo pipefail
          dotnet tool restore
          dotnet csharpier check .

      - name: Check C# style step
        run: dotnet format style --verify-no-changes --severity=info --verbosity=detailed

      - name: Lint markdown step
        uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
        with:
          globs: '**/*.md'

      # Spell-check the user-facing docs; word list + exclusions live in cspell.json (shared with the editor).
      - name: Spell check step
        uses: streetsidesoftware/cspell-action@ce1816e4ce36532956ac6e983737392774b6e169 # v9.2.0
        with:
          files: |
            README.md
            HISTORY.md
          incremental_files_only: false

      # Lint the RegressionTests Python tooling with ruff + mypy via uvx (no project install; the
      # tooling is stdlib-only). Versions are pinned here in CI (bumpable) for a reproducible gate;
      # the VSCode tasks run the latest tools, so local may differ slightly by design. Config lives
      # in RegressionTests/pyproject.toml, so run from that directory (mypy resolves config from CWD).
      - name: Setup uv step
        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0

      - name: Lint Python step
        working-directory: RegressionTests
        run: |
          set -Eeuo pipefail
          uvx ruff@0.15.22 check .
          uvx ruff@0.15.22 format --check .
          uvx mypy@2.3.0 .

      - name: Lint workflows step
        uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0

      - name: Check EditorConfig step
        run: docker run --rm -v "$PWD":/check --workdir /check mstruebing/editorconfig-checker:latest