Merge pull request #1105 from KelvinTegelaar/dev

[pull] dev from KelvinTegelaar:dev

Author: pull[bot]

.github/scripts/validate-json.mjs

@@ -0,0 +1,73 @@
+import { readFile, readdir, writeFile, appendFile } from "node:fs/promises";
+import path from "node:path";
+
+// Usage: node validate-json.mjs [--strip <prefix>] <dir> [dir...]
+// --strip removes a leading path prefix from reported filenames, so a PR checked
+// out into a subdirectory still reports repo-relative paths.
+const argv = process.argv.slice(2);
+let strip = "";
+const roots = [];
+for (let i = 0; i < argv.length; i++) {
+  if (argv[i] === "--strip") {
+    strip = argv[++i] ?? "";
+  } else {
+    roots.push(argv[i]);
+  }
+}
+
+async function collect(dir) {
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  const files = [];
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === "node_modules") continue;
+      files.push(...(await collect(full)));
+    } else if (entry.name.endsWith(".json")) {
+      files.push(full);
+    }
+  }
+  return files;
+}
+
+const report = (file) => {
+  const normalised = file.split(path.sep).join("/");
+  return strip && normalised.startsWith(strip) ? normalised.slice(strip.length) : normalised;
+};
+
+const failures = [];
+let checked = 0;
+
+for (const root of roots) {
+  for (const file of await collect(root)) {
+    checked++;
+    // Strip a leading UTF-8 BOM: it's tolerated by PowerShell's ConvertFrom-Json
+    // (how the API loads these files) but rejected by Node's JSON.parse.
+    const contents = (await readFile(file, "utf8")).replace(/^\uFEFF/, "");
+    try {
+      JSON.parse(contents);
+    } catch (error) {
+      failures.push({ file: report(file), message: error.message.replace(/\r?\n/g, " ") });
+    }
+  }
+}
+
+for (const { file, message } of failures) {
+  // Annotate the PR diff via a GitHub Actions error command.
+  console.log(`::error file=${file}::${message}`);
+}
+console.log(`Checked ${checked} JSON file(s), ${failures.length} invalid.`);
+
+// Hand the results to the workflow so it can comment on the PR.
+if (process.env.GITHUB_OUTPUT) {
+  await appendFile(process.env.GITHUB_OUTPUT, `invalid_count=${failures.length}\n`);
+}
+await writeFile("json-validation-results.json", JSON.stringify(failures, null, 2));
+
+process.exit(failures.length > 0 ? 1 : 0);

.github/workflows/Validate_JSON.yml

@@ -0,0 +1,121 @@
+---
+name: Validate JSON
+on:
+  # pull_request_target (not pull_request) so the token can comment on fork PRs.
+  # The PR's own code is never executed: it is checked out into ./pr as data only,
+  # and parsed by the validator script from the trusted base checkout.
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+    branches:
+      - main
+      - dev
+    paths:
+      - "Config/**/*.json"
+      - "Tools/**/*.json"
+      - "AddMSPApp/**/*.json"
+      - ".github/workflows/Validate_JSON.yml"
+      - ".github/scripts/validate-json.mjs"
+  push:
+    branches:
+      - dev
+    paths:
+      - "Config/**/*.json"
+      - "Tools/**/*.json"
+      - "AddMSPApp/**/*.json"
+      - ".github/workflows/Validate_JSON.yml"
+      - ".github/scripts/validate-json.mjs"
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request_target' && github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  validate:
+    name: Parse JSON in Config, Tools and AddMSPApp
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout base (trusted validator script)
+        uses: actions/checkout@v6
+
+      - name: Checkout PR head (untrusted, data only)
+        if: github.event_name == 'pull_request_target'
+        uses: actions/checkout@v6
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: pr
+          persist-credentials: false
+
+      - name: Validate JSON files
+        id: validate
+        continue-on-error: true
+        env:
+          ROOT: ${{ github.event_name == 'pull_request_target' && 'pr/' || '' }}
+        run: >-
+          node .github/scripts/validate-json.mjs --strip "$ROOT"
+          "${ROOT}Config" "${ROOT}Tools" "${ROOT}AddMSPApp"
+
+      - name: Comment on PR
+        if: github.event_name == 'pull_request_target'
+        uses: actions/github-script@v9
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('fs');
+            const marker = '<!-- validate-json -->';
+            const resultsFile = 'json-validation-results.json';
+            if (!fs.existsSync(resultsFile)) {
+              // The validator crashed before reporting; let its own error stand.
+              core.warning('No validation results found — skipping PR comment.');
+              return;
+            }
+            const failures = JSON.parse(fs.readFileSync(resultsFile, 'utf8'));
+
+            // Find a previous comment from this workflow so we update instead of piling up.
+            const { data: comments } = await github.rest.issues.listComments({
+              ...context.repo,
+              issue_number: context.issue.number,
+              per_page: 100,
+            });
+            const existing = comments.find(
+              (c) => c.user.type === 'Bot' && c.body.includes(marker)
+            );
+
+            let body;
+            if (failures.length > 0) {
+              const list = failures
+                .map(({ file, message }) => `- \`${file}\`\n  > ${message}`)
+                .join('\n');
+              body =
+                `${marker}\n### ⚠️ Invalid JSON detected\n\n` +
+                `${failures.length} JSON file(s) in this PR could not be parsed. ` +
+                `These files are loaded directly by CIPP, so a syntax error here breaks the app at runtime.\n\n` +
+                `${list}\n\n` +
+                `Please fix the syntax and push again — this comment will update automatically.`;
+            } else if (existing) {
+              body = `${marker}\n### ✅ JSON is valid\n\nAll JSON files in \`Config\`, \`Tools\` and \`AddMSPApp\` parse correctly. Thanks for fixing it!`;
+            } else {
+              // Nothing was ever broken — stay quiet.
+              return;
+            }
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                ...context.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                ...context.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
+
+      - name: Fail if any JSON is invalid
+        if: steps.validate.outputs.invalid_count != '0'
+        run: |
+          echo "::error::${{ steps.validate.outputs.invalid_count }} invalid JSON file(s). See annotations above."
+          exit 1