algo/.github/workflows/lint.yml

---
name: Lint

'on':
  push:
    branches: [main, master]
  pull_request:

permissions:
  contents: read

jobs:
  ansible-lint:
    name: Ansible linting
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Algo environment
        uses: ./.github/actions/setup-algo
        with:
          install-ansible-collections: 'true'

      - name: Run ansible-lint
        run: |
          uv run --with ansible-lint ansible-lint .

      - name: Run playbook dry-run check (catch runtime issues)
        run: |
          # Test main playbook logic without making changes
          # This catches filter warnings, collection issues, and runtime errors
          uv run ansible-playbook main.yml --check --connection=local \
            -e "server_ip=test" \
            -e "server_name=ci-test" \
            -e "IP_subject_alt_name=192.168.1.1" \
            || echo "Dry-run check completed with issues - review output above"

  yaml-lint:
    name: YAML linting
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Setup uv environment
        uses: ./.github/actions/setup-uv

      - name: Run yamllint
        run: uv run --with yamllint yamllint -c .yamllint .

  jinja2-lint:
    name: Jinja2 template linting
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Setup uv environment
        uses: ./.github/actions/setup-uv

      - name: Run j2lint
        run: |
          # Lint Jinja2 templates for syntax and style issues
          # Ignored rules (incompatible with Ansible config-file templates):
          #   S3: indentation (dictated by output format, not Jinja style)
          #   S5: tabs (some config formats require them)
          #   S6: whitespace-control delimiters ({%- -%} are standard Ansible)
          #   S7: single-statement-per-line (inline Jinja in config output)
          #   V1: lowercase variables (existing names like IP_subject_alt_name)
          uv run --with j2lint j2lint roles/ --ignore S3 S5 S6 S7 V1

  python-lint:
    name: Python linting
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Algo environment
        uses: ./.github/actions/setup-algo

      - name: Run ruff check
        run: |
          # Fast Python linter
          uv run --with ruff ruff check .

      - name: Run ruff format check
        run: |
          # Verify consistent Python formatting
          uv run --with ruff ruff format --check .

  python-types:
    name: Python type checking
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Algo environment
        uses: ./.github/actions/setup-algo

      - name: Run ty check
        run: |
          # Type checking with ty
          uv run --with ty ty check

  shellcheck:
    name: Shell script linting
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Algo environment
        uses: ./.github/actions/setup-algo
        with:
          install-shellcheck: 'true'

      - name: Run shellcheck
        run: |
          # Check all shell scripts, not just algo and install.sh
          find . -type f -name "*.sh" -not -path "./.git/*" -exec shellcheck {} \;

  powershell-lint:
    name: PowerShell script linting
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Install PowerShell
        run: |
          # Install PowerShell Core
          wget -q https://github.com/PowerShell/PowerShell/releases/download/v7.4.0/powershell_7.4.0-1.deb_amd64.deb
          sudo dpkg -i powershell_7.4.0-1.deb_amd64.deb
          sudo apt-get install -f

      - name: Install PSScriptAnalyzer
        run: |
          pwsh -Command "Install-Module -Name PSScriptAnalyzer -Force -Scope CurrentUser"

      - name: Run PowerShell syntax check
        run: |
          # Check syntax by parsing the script
          pwsh -NoProfile -NonInteractive -Command "
            try {
              \$null = [System.Management.Automation.PSParser]::Tokenize((Get-Content -Path './algo.ps1' -Raw), [ref]\$null)
              Write-Host '✓ PowerShell syntax check passed'
            } catch {
              Write-Error 'PowerShell syntax error: ' + \$_.Exception.Message
              exit 1
            }
          "

      - name: Run PSScriptAnalyzer
        run: |
          pwsh -Command "
            \$results = Invoke-ScriptAnalyzer -Path './algo.ps1' -Severity Warning,Error
            if (\$results.Count -gt 0) {
              \$results | Format-Table -AutoSize
              exit 1
            } else {
              Write-Host '✓ PSScriptAnalyzer check passed'
            }
          "

  actionlint:
    name: GitHub Actions linting
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Install actionlint
        run: |
          bash <(curl -sL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
          sudo mv actionlint /usr/local/bin/

      - name: Run actionlint
        run: |
          actionlint .github/workflows/*.yml

  zizmor:
    name: GitHub Actions security audit
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Install zizmor
        run: |
          pip install zizmor

      - name: Run zizmor
        run: |
          zizmor .github/workflows/