ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  luacheck:
    name: Luacheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: nebularg/actions-luacheck@v1
        with:
          files: '.'
          args: '--no-color -q'

  luaunit:
    name: LuaUnit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Lua
        run: |
          sudo apt-get update
          sudo apt-get install -y lua5.4
      - name: Run tests
        run: lua5.4 tests/Run.lua

  toc-validation:
    name: TOC validation
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Verify TOC file references exist
        run: |
          EXIT_CODE=0
          while IFS= read -r line; do
            line="$(echo "$line" | sed 's/\r$//')"
            [[ -z "$line" ]] && continue
            [[ "$line" =~ ^## ]] && continue
            filepath="$(echo "$line" | tr '\\' '/')"
            if [[ ! -f "$filepath" ]]; then
              echo "FAIL: $filepath listed in .toc but does not exist"
              EXIT_CODE=1
            fi
          done < EasyFind.toc
          exit $EXIT_CODE

  commit-hygiene:
    name: Commit hygiene
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Validate commit messages
        run: |
          BASE="${{ github.event.pull_request.base.sha }}"
          HEAD="${{ github.event.pull_request.head.sha }}"
          EXIT_CODE=0

          while IFS= read -r sha; do
            MSG="$(git log --format='%B' -n 1 "$sha")"
            SUBJECT="$(echo "$MSG" | head -n 1)"

            if [[ -z "$SUBJECT" ]]; then
              echo "FAIL [$sha]: Empty subject line"
              EXIT_CODE=1
              continue
            fi

            if [[ ${#SUBJECT} -gt 72 ]]; then
              echo "FAIL [$sha]: Subject exceeds 72 chars (${#SUBJECT})"
              EXIT_CODE=1
            fi

          done < <(git rev-list "$BASE".."$HEAD")

          exit $EXIT_CODE

  file-hygiene:
    name: File hygiene
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Check for prohibited files
        run: |
          EXIT_CODE=0

          # Block .env files
          ENV_FILES=$(find . -name '.env' -o -name '.env.*' | grep -v '.env.example' | grep -v '.git/' || true)
          if [[ -n "$ENV_FILES" ]]; then
            echo "FAIL: .env file(s) in repository: $ENV_FILES"
            EXIT_CODE=1
          fi

          # Block credential files
          SECRET_FILES=$(find . -not -path './.git/*' -iregex '.*\.\(key\|pem\|p12\|pfx\)$' || true)
          if [[ -n "$SECRET_FILES" ]]; then
            echo "FAIL: Credential file(s) found: $SECRET_FILES"
            EXIT_CODE=1
          fi

          # Check for hardcoded secrets in Lua files
          SECRET_PATTERNS=$(grep -rlE '(api[_-]?key|secret|token|password)\s*[:=]\s*["'"'"'][A-Za-z0-9+/=_-]{20,}' *.lua Locales/*.lua 2>/dev/null || true)
          if [[ -n "$SECRET_PATTERNS" ]]; then
            echo "FAIL: Possible hardcoded secret in: $SECRET_PATTERNS"
            EXIT_CODE=1
          fi

          exit $EXIT_CODE

  localization:
    name: Localization
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Verify locale parity and L[] references
        run: |
          EXIT_CODE=0
          ENUS=Locales/enUS.lua
          if [[ ! -f "$ENUS" ]]; then echo "FAIL: $ENUS missing"; exit 1; fi
          keys() { grep -oP '^L\["\K[^"]+' "$1" | sort -u; }

          # 1. Every locale file carries the exact enUS key set (no missing, no stray).
          ENUS_KEYS="$(keys "$ENUS")"
          for f in Locales/*.lua; do
            [[ "$f" == "$ENUS" || "$f" == "Locales/Localization.lua" ]] && continue
            DIFF="$(comm -3 <(echo "$ENUS_KEYS") <(keys "$f"))"
            if [[ -n "$DIFF" ]]; then
              echo "FAIL: $f key set differs from enUS (< missing in $f, > stray in $f):"
              echo "$DIFF"
              EXIT_CODE=1
            fi
          done

          # 2. Every L["KEY"] referenced in shipped code is defined in enUS.lua.
          #    Locale files (definitions) are excluded; dynamic L[var] lookups
          #    don't match L["..."] and are intentionally not checked.
          USED="$(grep -rhoP 'L\["\K[^"]+' --include='*.lua' --exclude-dir=Locales --exclude-dir=dev . | sort -u || true)"
          while IFS= read -r k; do
            [[ -z "$k" ]] && continue
            if ! grep -qxF "$k" <(echo "$ENUS_KEYS"); then
              echo "FAIL: L[\"$k\"] used in code but not defined in enUS.lua"
              EXIT_CODE=1
            fi
          done <<< "$USED"

          if [[ $EXIT_CODE -eq 0 ]]; then echo "Localization OK: all locales match enUS and all L[] keys are defined."; fi
          exit $EXIT_CODE