ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [master]
  # The template resolves the SF Compute release index at build time, so
  # the repo can break without a commit: a release that drops the LTS the
  # default keys on, or an index that stops answering, fails validate.
  # The daily run finds that before a reader does.
  #
  # GitHub disables scheduled workflows in a public repository after 60
  # days without repository activity, and this repo is meant to go quiet.
  # Re-enable it from the Actions tab when that happens; firing
  # workflow_dispatch from the release pipeline instead would be immune.
  schedule:
    - cron: "17 6 * * *"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    env:
      # `packer init` fetches the qemu plugin from GitHub releases; the
      # unauthenticated rate limit is low enough to flake a shared runner.
      PACKER_GITHUB_API_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@v4

      - uses: hashicorp/setup-packer@v3
        with:
          version: "1.15.0"

      - name: Install plugins
        run: packer init .

      - name: Check formatting
        run: packer fmt -check -diff .

      # -evaluate-datasources makes validate fetch the release index and
      # resolve the base image, which is the part worth checking: plain
      # validate stops at an unresolved checksum. Firmware paths are not
      # checked by validate, so the runner needs no OVMF.
      - name: Validate, resolving the live release index
        run: packer validate -evaluate-datasources .

      - name: Lint shell scripts
        run: shellcheck ./*.sh