truthfulness.yml

# SPDX-License-Identifier: MPL-2.0
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
#
# Truthfulness invariant: the cartridge catalogue must never advertise as
# `available: true` anything that isn't built and returning real results.
# This gate builds every available cartridge and invokes its first tool,
# failing if the reply carries a `"status":"stub"` marker (or no reply at all).
# See tests/truthfulness_check.sh for the rules.

name: Truthfulness

# Was workflow-level path-filtered: a required check that never ran on PRs
# touching none of its paths, leaving the check "Expected" and the PR blocked.
# Now always runs; the `changes` job gates the heavy job, which when skipped
# reports SUCCESS to required checks.
on:
  push:
    branches: [main, master, develop]
  pull_request:
    branches: [main, master]
  workflow_dispatch:

permissions: read-all

concurrency:
  group: truthfulness-${{ github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    name: Detect relevant changes
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      run: ${{ steps.detect.outputs.run }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - id: detect
        env:
          EVENT: ${{ github.event_name }}
          BASE: ${{ github.base_ref }}
          BEFORE: ${{ github.event.before }}
        run: |
          set -uo pipefail
          run=true
          if [ "$EVENT" = pull_request ]; then
            git fetch --no-tags --depth=200 origin "$BASE" 2>/dev/null \
              && changed=$(git diff --name-only "origin/${BASE}...HEAD" 2>/dev/null) \
              && { printf '%s\n' "$changed" | grep -qE '^cartridges/.*/cartridge\.json$|^cartridges/.*/ffi/|^ffi/|^elixir/lib/boj_rest/router\.ex$|^tests/truthfulness_check\.sh$' && run=true || run=false; }
          elif [ "$EVENT" = push ] && [ -n "$BEFORE" ] && [ "$BEFORE" != 0000000000000000000000000000000000000000 ]; then
            changed=$(git diff --name-only "${BEFORE}...${GITHUB_SHA}" 2>/dev/null) \
              && { printf '%s\n' "$changed" | grep -qE '^cartridges/.*/cartridge\.json$|^cartridges/.*/ffi/|^ffi/|^elixir/lib/boj_rest/router\.ex$|^tests/truthfulness_check\.sh$' && run=true || run=false; }
          fi
          printf 'run=%s\n' "$run" >> "$GITHUB_OUTPUT"
          echo "relevant=$run; changed files:"; printf '%s\n' "${changed:-<none computed>}"

  truthfulness:
    name: Catalogue truthfulness (available ⇒ built + real)
    needs: changes
    if: needs.changes.outputs.run == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Zig
        uses: goto-bus-stop/setup-zig@9566bb3e8749893055694249726756f25e099b30  # v2
        with:
          version: 0.15.1

      - name: Install jq
        run: sudo apt-get update && sudo apt-get install -y jq

      # The script builds boj-invoke and (re)builds each available cartridge's
      # .so itself, so it is the single source of truth for the gate.
      - name: Run truthfulness check (probe)
        run: bash tests/truthfulness_check.sh --probe