ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Markdown lint
        uses: avto-dev/markdown-lint@04687db2e9b72c18a4dfce687923a8daa3e4b543 # v1
        with:
          args: 'docs/**/*.md README.md CONTRIBUTING.md SECURITY.md'

      - name: Link check
        uses: lycheeverse/lychee-action@2b973e86fc7b1f6b36a93795fe2c9c6ae1118621 # v1
        with:
          args: '--verbose --no-progress docs/**/*.md README.md'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Verify Mermaid blocks
        run: grep -rl '```mermaid' docs README.md

      - name: Validate JSON formatting
        run: |
          find impl -name '*.json' -print0 |
            xargs -0 -n1 jq empty

      - name: Install Bicep CLI
        run: az bicep install

      - name: Validate repository contracts
        run: bash scripts/validate-repository.sh