name: Validate Registry on PR

# Contributor code must run only with a read-only token and no secrets.
# Never change this workflow back to pull_request_target while it checks out
# and executes pull-request code.

on:
  pull_request:
    branches:
      - main
      - dev
  workflow_dispatch:

permissions:
  contents: read

jobs:
  validate-and-update:
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout code without persisted credentials
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y jq

      - name: Install Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: latest

      - name: Install project dependencies
        run: bun install --frozen-lockfile

      - name: Make validation scripts executable
        run: |
          chmod +x scripts/registry/validate-registry.sh
          chmod +x scripts/registry/auto-detect-components.sh
          chmod +x scripts/registry/register-component.sh
          chmod +x scripts/prompts/validate-pr.sh

      - name: Report registry drift
        id: registry_drift
        run: |
          ./scripts/registry/auto-detect-components.sh --dry-run > /tmp/detect-output.txt 2>&1
          cat /tmp/detect-output.txt
          sed $'s/\033\\[[0-9;]*m//g' /tmp/detect-output.txt > /tmp/detect-output-plain.txt

          if grep -Eq 'New Components:[[:space:]]*[1-9][0-9]*([[:space:]]|$)' /tmp/detect-output-plain.txt; then
            echo "drift_detected=true" >> "$GITHUB_OUTPUT"
            echo "## Registry drift detected" >> "$GITHUB_STEP_SUMMARY"
            echo "" >> "$GITHUB_STEP_SUMMARY"
            echo "The repository already contains components not represented in registry.json." >> "$GITHUB_STEP_SUMMARY"
            echo "This is reported but does not block security validation until the existing drift is reconciled." >> "$GITHUB_STEP_SUMMARY"
          else
            echo "drift_detected=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Validate prompt library structure
        run: ./scripts/prompts/validate-pr.sh

      - name: Validate markdown context links
        run: npm run validate:context-links

      - name: Validate registry
        run: npm run validate:registry

      - name: Validation summary
        if: success()
        run: |
          echo "## All registry validations passed" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "- Prompt library structure is valid" >> "$GITHUB_STEP_SUMMARY"
          echo "- Context markdown links are valid" >> "$GITHUB_STEP_SUMMARY"
          echo "- Registry paths and dependencies are valid" >> "$GITHUB_STEP_SUMMARY"
          if [ "${{ steps.registry_drift.outputs.drift_detected }}" = "true" ]; then
            echo "- Existing registry drift was reported separately" >> "$GITHUB_STEP_SUMMARY"
          else
            echo "- No unregistered components were detected" >> "$GITHUB_STEP_SUMMARY"
          fi