k9-svc-validation.yml

# SPDX-License-Identifier: MPL-2.0
name: K9-SVC Validation
on:
  push:
    branches: [main, master]
  pull_request:

# Estate guardrail: scope push to default branches (PR fires once, not
# push+PR) and cancel superseded runs. Safe — read-only PR check.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Validate contractiles
        run: |
          #!/bin/bash
          set -euo
          
          # Check all contractiles exist
          for file in Must Trust Dust Lust Adjust Intend; do
            if [ ! -f "${file}.a2ml" ]; then
              echo "ERROR: Missing contractile: ${file}.a2ml"
              exit 1
            fi
          done
          
          echo "✓ All contractiles present"
          
          # Basic syntax validation
          for file in *.a2ml; do
            if [ -f "$file" ]; then
              # Check for basic structure
              if ! grep -q "^// SPDX-License-Identifier:" "$file"; then
                echo "ERROR: Missing SPDX header in $file"
                exit 1
              fi
            fi
          done
          
          echo "✓ Contractile validation passed"