ci.yml

# SPDX-License-Identifier: MPL-2.0
name: Haskell CI
permissions: read-all
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
      - name: Set up GHC
        # SHA pinned to v2.7.10 (current at 2026-05-25). The previous pin
        # `dd344bc1cec854a9b2f7029b98379ce6c1accc98` did not exist on the
        # upstream repo — GitHub Actions failed to resolve it and every
        # CI run errored before any GHC step ran. This SHA is the same
        # one used elsewhere in this repo (sbom.yml, casket-ci.yml).
        uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2.11.0
        with:
          ghc-version: '9.4'
          cabal-version: '3.10'
      - name: Cache Cabal
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
        with:
          path: |
            ~/.cabal/packages
            ~/.cabal/store
            dist-newstyle
          key: ${{ runner.os }}-cabal-${{ hashFiles('**/*.cabal') }}
      - name: Build
        run: cabal build all
      - name: Test
        run: cabal test all
  language-check:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
      - name: Verify Haskell-only in src/
        run: |
          echo "Checking for forbidden languages in src/..."
          forbidden=$(find src/ -type f \( -name "*.py" -o -name "*.js" -o -name "*.ts" -o -name "*.rb" \) 2>/dev/null || true)
          if [ -n "$forbidden" ]; then
            echo "ERROR: Found forbidden language files in src/:"
            echo "$forbidden"
            exit 1
          fi
          echo "OK: Only Haskell files in src/"