name: Validate extensions

on:
  push:
    branches: [main]
  pull_request:

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install jq + ripgrep + gitleaks (security suites need them)
        run: |
          sudo apt-get update && sudo apt-get install -y jq ripgrep
          # gitleaks: fetch the release binary (not in apt) so push-gate's
          # scan-secrets.sh and its suite run for real instead of skipping.
          GL_VER=8.21.2
          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GL_VER}/gitleaks_${GL_VER}_linux_x64.tar.gz" \
            | sudo tar -xz -C /usr/local/bin gitleaks
          gitleaks version && rg --version | head -1

      - name: Install Claude Code (for authoritative plugin validation)
        run: npm install -g @anthropic-ai/claude-code

      - name: Validate plugin + marketplace manifests
        run: |
          claude plugin validate .
          tmp="$(mktemp -d)"
          mkdir -p "$tmp/.claude-plugin"
          cp .claude-plugin/plugin.json "$tmp/.claude-plugin/plugin.json"
          claude plugin validate "$tmp"

      - name: Validate extensions (frontmatter, naming, structure)
        run: bash tests/validate.sh

      - name: Doc-drift gate (docs must match disk)
        run: bash tests/doc-drift.sh

      - name: Executable-bit gate (tracked scripts must be executable)
        run: bash tests/check-exec-bits.sh

      - name: Run skill behavioural test suites
        run: bash tests/run-skill-tests.sh

      - name: Offline resource checks (verifier scripts)
        run: bash tests/check-resources.sh