dev.yml

name: CloudFile quick source checks

# Routine dev and PR changes must never trigger a cross-repository build,
# native compilation, DB integration or deployment. Run those separately via
# reviewed workflow_dispatch jobs when the relevant change needs them.
on:
  push:
    branches: [dev]
    paths-ignore:
      - '**/*.md'
      - '**/*.markdown'
      - 'README*'
      - 'AGENTS.md'
      - 'docs/**'
  pull_request:
    branches: [dev]
    paths-ignore:
      - '**/*.md'
      - '**/*.markdown'
      - 'README*'
      - 'AGENTS.md'
      - 'docs/**'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  static:
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2
      - name: Check changed files
        shell: bash
        run: |
          set -euo pipefail
          git diff --check HEAD^ HEAD
          python3 - <<'PY'
          from pathlib import Path
          import subprocess

          changed = subprocess.check_output(
              ['git', 'diff', '--name-only', '-z', 'HEAD^', 'HEAD']
          ).split(b'\0')
          for raw in changed:
              if not raw:
                  continue
              path = Path(raw.decode('utf-8'))
              if path.is_file() and path.suffix == '.py':
                  compile(path.read_bytes(), str(path), 'exec')
          PY
          while IFS= read -r path; do
            [[ ! -f "$path" ]] || bash -n "$path"
          done < <(git diff --name-only HEAD^ HEAD -- '*.sh')

      - name: Test source selection rules without building images
        run: |
          python3 -m unittest discover -s tests -p test_build_receipt.py -q
          python3 -m unittest discover -s tests -p test_current_build_policy.py -q