ci.yml

name: ci

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: shellcheck scripts/*.sh tests/*.sh

  script-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: bash tests/route_test.sh

  # platform#1329 criteria 1 and 3, proved live (not simulated): this repo is public
  # and registers no self-hosted runner at all, so if the router job's own runs-on ever
  # resolved to router-label (self-hosted) here, this job would hang waiting for a
  # runner that doesn't exist and CI would never go green. Passing is the proof that
  # the router job starts on GitHub-hosted without needing self-hosted first (#3), and
  # that a public caller is routed hosted end to end (#1). Private-repo routing (#2) and
  # the no-token paths (#4) are covered offline by tests/route_test.sh, since this repo
  # has no private counterpart and no billing token to exercise that live.
  reusable-selftest:
    uses: ./.github/workflows/router.yml

  composite-selftest:
    runs-on: ubuntu-latest
    outputs:
      runner: ${{ steps.route.outputs.runner }}
    steps:
      - uses: actions/checkout@v4
      - id: route
        uses: ./

  assert-public-hosted:
    needs: [reusable-selftest, composite-selftest]
    runs-on: ubuntu-latest
    steps:
      - name: On a public repo both entry points must route to GitHub-hosted
        env:
          REUSABLE: ${{ needs.reusable-selftest.outputs.runner }}
          COMPOSITE: ${{ needs.composite-selftest.outputs.runner }}
        run: |
          want='["ubuntu-latest"]'
          echo "reusable=$REUSABLE composite=$COMPOSITE"
          [ "$REUSABLE" = "$want" ] || { echo "reusable workflow did not route a public repo to hosted"; exit 1; }
          [ "$COMPOSITE" = "$want" ] || { echo "composite action did not route a public repo to hosted"; exit 1; }