validate-rule-contributions.yml

name: Validate Rule Contributions

on:
  pull_request:
    paths:
      - 'Unpublished/**'
    types: [opened, synchronize, reopened]
  workflow_dispatch: {}

jobs:
  validate-rules:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write

    steps:
      - name: Checkout PR / branch
        uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 0
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.ref }}
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Python 3.12
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install engine dependencies
        run: |
          python -m venv venv
          git submodule update --init --recursive
          ./venv/bin/pip install --upgrade pip
          ./venv/bin/pip install -r engine/requirements.txt

      # -----------------------------------------------------------------------
      # Detect which rule changed
      # -----------------------------------------------------------------------
      - name: Detect changed rule
        id: changed-rule
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            CHANGED=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
          else
            CHANGED=$(git diff --name-only HEAD~1 HEAD)
          fi

          # Match Unpublished/<RULE_ID>/ or Unpublished/<Subdir>/<RULE_ID>/
          # Capture the rule directory (2nd or 3rd path segment) depending on depth
          RULE_REL_PATH=$(echo "$CHANGED" \
            | grep -E '^Unpublished/' \
            | awk -F'/' '
                NF >= 4 { print $1"/"$2"/"$3; next }
                NF >= 3 { print $1"/"$2 }
              ' \
            | sort -u \
            | head -1)

          if [ -z "$RULE_REL_PATH" ]; then
            echo "::error::Could not detect a changed rule under Unpublished/."
            exit 1
          fi

          if [ ! -d "$RULE_REL_PATH" ]; then
            echo "::error::Rule directory $RULE_REL_PATH does not exist."
            exit 1
          fi

          # Derive a short RULE_ID (last path segment) for display/artifact naming
          RULE_ID=$(basename "$RULE_REL_PATH")

          echo "rule_rel_path=$RULE_REL_PATH" >> $GITHUB_OUTPUT
          echo "rule_id=$RULE_ID"             >> $GITHUB_OUTPUT
          echo "Detected rule: $RULE_ID at $RULE_REL_PATH"

      # -----------------------------------------------------------------------
      # Remove any committed results.json files and push the deletion
      # Contributors should not commit results.json — this is a safety net
      # -----------------------------------------------------------------------
      - name: Remove any committed results.json files
        if: steps.changed-rule.outputs.rule_rel_path != ''
        run: |
          git config user.name  "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          mapfile -t JSON_FILES < <(find "${{ steps.changed-rule.outputs.rule_rel_path }}" \
            -path "*/results/results.json" 2>/dev/null)

          if [ ${#JSON_FILES[@]} -eq 0 ]; then
            echo "No results.json files found — nothing to remove."
          else
            for f in "${JSON_FILES[@]}"; do
              echo "Removing $f"
              git rm -f "$f"
            done
            git commit -m "ci: remove results.json from ${{ steps.changed-rule.outputs.rule_id }} [skip ci]"
            git push origin HEAD
            echo "Committed and pushed removal of ${#JSON_FILES[@]} results.json file(s)."
          fi

      # -----------------------------------------------------------------------
      # Run validation (all logic lives in .github/scripts/)
      # -----------------------------------------------------------------------
      - name: Run validation
        id: validate
        continue-on-error: true
        run: |
          chmod +x .github/scripts/run_validation.sh
          bash .github/scripts/run_validation.sh \
            "${{ steps.changed-rule.outputs.rule_rel_path }}" \
            "$(pwd)/venv/bin/python" \
            "$(pwd)"

      # -----------------------------------------------------------------------
      # Upload results.json as a workflow artifact for debugging
      # -----------------------------------------------------------------------
      - name: Upload validation results artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: validation-results-${{ steps.changed-rule.outputs.rule_id }}
          path: |
            ${{ steps.changed-rule.outputs.rule_rel_path }}/**/results/results.json
            validation_report.md
          if-no-files-found: warn

      # -----------------------------------------------------------------------
      # Post report as PR comment
      # -----------------------------------------------------------------------
      - name: Post validation report to PR
        if: always() && github.event_name == 'pull_request' && steps.changed-rule.outputs.rule_id != ''
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const fs = require('fs');
            const reportPath = 'validation_report.md';

            let detailedContent = '_No validation report was generated._';
            if (fs.existsSync(reportPath)) {
              detailedContent = fs.readFileSync(reportPath, 'utf8');
            }

            const ruleId  = '${{ steps.changed-rule.outputs.rule_id }}';
            const runUrl  = `${context.payload.repository.html_url}/actions/runs/${context.runId}`;

            let body = `## Rule Validation Results — \`${ruleId}\`\n\n`;
            body += '<details>\n<summary><strong>Click to expand full report</strong></summary>\n\n';
            body += detailedContent;
            body += '\n</details>';
            body += `\n\nFull results also available as a [workflow artifact](${runUrl}).`;
            body += `\n\n---\n[View workflow run](${runUrl})`;

            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });

            const marker = `Rule Validation Results — \`${ruleId}\``;
            const existing = comments.find(c => c.user.type === 'Bot' && c.body.includes(marker));

            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body,
              });
            }

      # -----------------------------------------------------------------------
      # Write report to workflow summary (visible on manual runs too)
      # -----------------------------------------------------------------------
      - name: Write report to workflow summary
        if: always()
        run: |
          [ -f validation_report.md ] && cat validation_report.md >> $GITHUB_STEP_SUMMARY || true

      # -----------------------------------------------------------------------
      # Fail the job if any engine run errored
      # -----------------------------------------------------------------------
      - name: Check overall status
        if: steps.validate.outcome == 'failure'
        run: |
          echo "Validation failed — see the report above."
          exit 1