.github/workflows/check.yml

name: check

# okrdev's own checks — the deterministic layer from docs/testing.md.
# One always-reporting required job, and any future narrowing belongs inside
# the job rather than in a workflow-level paths-ignore: a required check that
# never reports on a filtered PR blocks that PR forever. Same invariant the
# shipped templates/github/workflows/ci.yml preaches to adopters.

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  check:
    name: check
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '24'
      - name: Install the linters
        # Pinned: a linter that changes its mind on a Tuesday turns a required
        # check into a coin flip. Bump deliberately, like any other dependency.
        env:
          ACTIONLINT_VERSION: 1.7.7
        run: |
          sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck
          curl -sSLo /tmp/actionlint.tar.gz \
            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
          tar -xzf /tmp/actionlint.tar.gz -C /tmp actionlint
          sudo install /tmp/actionlint /usr/local/bin/actionlint
      - name: Run the checks
        run: ./tests/check.sh