# Copyright 2025 Google Inc. All Rights Reserved.
#
# Distributed under MIT license.
# See file LICENSE for detail or copy at https://opensource.org/licenses/MIT

# Workflow for checking typos and buildifier, formatting, etc.

name: "Lint"

on:
  push:
    branches: [ "master" ]
  pull_request:
    branches: [ "master" ]
  schedule:
    - cron: '18 15 * * 0'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  check:
    name: Lint
    runs-on: 'ubuntu-latest'

    steps:

    - name: Harden Runner
      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
      with:
        egress-policy: audit

    - name: Checkout repository
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        persist-credentials: false

    - name: Install tools
      run: |
        eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
        brew install buildifier ruff typos-cli zizmor

    - name: Check typos
      run: |
        eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
        ./scripts/check_typos.sh

    - name: Audit workflows
      run: |
        eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
        zizmor ./.github/workflows

    - name: Lint Python code
      run: |
        eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
        ruff check --extend-select=C4,C90,PERF,RET,SIM,W

    # TODO(eustas): run buildifier