wellknown-enforcement.yml

# SPDX-License-Identifier: PMPL-1.0-or-later
name: .well-known Enforcement

on:
  pull_request:
    paths:
      - '.well-known/**'
  push:
    branches: [main]

permissions: read-all

jobs:
  validate-wellknown:
    name: Validate .well-known Directory
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4

      - name: Check .well-known structure
        run: |
          if [ ! -d ".well-known" ]; then
            echo "INFO: .well-known directory not present (optional)"
            exit 0
          fi

          echo "Validating .well-known structure..."

          # Check for security.txt if present
          if [ -f ".well-known/security.txt" ]; then
            # Validate basic security.txt format
            if ! grep -qi "Contact:" .well-known/security.txt; then
              echo "ERROR: security.txt must contain Contact: field"
              exit 1
            fi
          fi

          echo ".well-known validation passed"