pr-validation.yml

name: HolyCode - PR Validation

on:
  pull_request:
  workflow_dispatch:

concurrency:
  group: pr-validation-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

# Manual main-branch validation requires DOCKERHUB_USERNAME and
# DOCKERHUB_TOKEN so Docker Scout can query its current advisory database.

jobs:
  static-validation:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Require main for manual validation
        if: github.event_name == 'workflow_dispatch'
        run: test "$GITHUB_REF" = 'refs/heads/main'

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Node for Renovate validation
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.19.0

      - name: Python version policy tests
        run: python -m unittest discover -s tests

      - name: Static action pin checks
        run: python scripts/validate_workflow_pins.py

      - name: Chromium seccomp profile
        run: python scripts/validate_chromium_seccomp.py

      - name: JSON syntax
        run: python -m json.tool renovate.json >/tmp/renovate.json

      - name: Workflow YAML syntax
        run: ruby -e 'require "yaml"; Dir[".github/workflows/*.yml"].each { |path| YAML.load_file(path) }'

      - name: Compose config
        run: |
          set -eu
          docker compose -f docker-compose.yaml config --no-interpolate >/tmp/docker-compose.yaml
          docker compose -f docker-compose.full.yaml config --no-interpolate >/tmp/docker-compose.full.yaml
          if docker compose -f docker-compose.full.yaml config --services | grep -Fx cliproxyapi; then
            echo "bundled CLIProxyAPI service must remain removed until its fixed image is verified" >&2
            exit 1
          fi

      - name: Renovate configuration
        run: bash scripts/validate_renovate_extraction.sh 44.24.2

  build-and-smoke-test:
    needs: static-validation
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            platform: linux/amd64
            suffix: amd64
            scout_arch: amd64
            scout_sha256: f4e2814bd61040365153d5b964b144cb2dc6ee536a68b5bac4cadf00fc0ec34b
            trivy_arch: 64bit
            trivy_sha256: 2edd39da482bb4e9831962487b68f68e3928ec3137794757f54d00383d79547b
          - runner: ubuntu-24.04-arm
            platform: linux/arm64
            suffix: arm64
            scout_arch: arm64
            scout_sha256: 8b21594c72d4d9403a82a49e9dbdfc04c27c6a21933906f1eefbb0beabe22d58
            trivy_arch: ARM64
            trivy_sha256: 13833d97e8a1a5367471c372a173180157f593bece570e20d5d925fef552f5dd
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Build image
        run: docker build --platform "${{ matrix.platform }}" -t "holycode-pr-test:${{ matrix.suffix }}" .

      - name: Smoke test image tools and secret hygiene
        run: bash scripts/smoke_image.sh "holycode-pr-test:${{ matrix.suffix }}"

      - name: Validate Drizzle esbuild remediation
        run: |
          docker run --rm --entrypoint sh "holycode-pr-test:${{ matrix.suffix }}" -lc '
            set -eu
            test ! -e /usr/local/lib/node_modules/drizzle-kit/node_modules/@esbuild-kit
            jq -e ".version == \"0.28.1\"" /usr/local/lib/node_modules/drizzle-kit/node_modules/esbuild/package.json >/dev/null
            drizzle-kit --version
            drizzle-kit --help >/dev/null
          '

      - name: Validate plugin pin modes
        run: bash scripts/test_plugin_modes.sh "holycode-pr-test:${{ matrix.suffix }}"

      - name: Smoke test Paperclip skills catalog
        run: |
          set -eu

          docker run --rm --entrypoint sh "holycode-pr-test:${{ matrix.suffix }}" -lc "
            set -eu
            test -f /usr/local/lib/node_modules/paperclipai/node_modules/@paperclipai/skills-catalog/generated/catalog.json
            node --input-type=module -e '
              import { listCatalogSkills } from \"/usr/local/lib/node_modules/paperclipai/node_modules/@paperclipai/server/dist/services/skills-catalog.js\";
              const skills = listCatalogSkills();
              if (Array.isArray(skills) === false || skills.length < 1) {
                throw new Error(\"Skills catalog is empty\");
              }
              console.log(\"skills=\" + skills.length);
            '
          "

      - name: Smoke test Paperclip runtime environment
        run: |
          set -eu

          docker run -d --name holycode-paperclip-test \
            -e ENABLE_PAPERCLIP=true \
            "holycode-pr-test:${{ matrix.suffix }}"

          cleanup() {
            docker logs holycode-paperclip-test || true
            docker rm -f holycode-paperclip-test || true
          }
          trap cleanup EXIT

          ready=false
          for _ in $(seq 1 90); do
            if docker exec holycode-paperclip-test sh -lc 'curl -fsS http://localhost:3100/ >/dev/null' 2>/dev/null; then
              ready=true
              break
            fi
            if docker logs holycode-paperclip-test 2>&1 | grep -Eq '/root/.config/opencode|EACCES: permission denied'; then
              exit 1
            fi
            sleep 2
          done
          [ "$ready" = true ]

          docker exec -u opencode holycode-paperclip-test sh -lc '
            pid="$(pgrep -u opencode -f "^node.*/paperclipai" | head -n 1)"
            test -n "$pid"
            xargs -0 -n 1 < "/proc/$pid/environ" > /tmp/paperclip-env
            grep -Fx "HOME=/home/opencode" /tmp/paperclip-env
            grep -Fx "XDG_CONFIG_HOME=/home/opencode/.config" /tmp/paperclip-env
            grep -Fx "XDG_CACHE_HOME=/home/opencode/.cache" /tmp/paperclip-env
            grep -Fx "XDG_DATA_HOME=/home/opencode/.local/share" /tmp/paperclip-env
            grep -Fx "XDG_STATE_HOME=/home/opencode/.local/state" /tmp/paperclip-env
          '

          docker logs holycode-paperclip-test > /tmp/holycode-paperclip.log 2>&1 || true
          if grep -F "/root/.config/opencode" /tmp/holycode-paperclip.log; then
            exit 1
          fi
          if grep -F "EACCES: permission denied" /tmp/holycode-paperclip.log; then
            exit 1
          fi
          if grep -F "Skills catalog manifest not found" /tmp/holycode-paperclip.log; then
            exit 1
          fi

      - name: Validate Hermes migration guard
        run: |
          set -eu

          docker volume create holycode-hermes-data >/dev/null
          trap 'docker volume rm holycode-hermes-data >/dev/null 2>&1 || true' EXIT
          docker run --rm --entrypoint sh -v holycode-hermes-data:/home/opencode "holycode-pr-test:${{ matrix.suffix }}" \
            -lc 'mkdir -p /home/opencode/.hermes && touch /home/opencode/.hermes/preserved'

          if docker run --rm -v holycode-hermes-data:/home/opencode \
            -e ENABLE_HERMES=true "holycode-pr-test:${{ matrix.suffix }}" >/tmp/holycode-hermes.log 2>&1; then
            echo "ENABLE_HERMES=true unexpectedly started the removed bundled service" >&2
            exit 1
          fi
          grep -F "bundled Hermes is temporarily unavailable" /tmp/holycode-hermes.log
          grep -F "/home/opencode/.hermes is preserved" /tmp/holycode-hermes.log
          docker run --rm --entrypoint test -v holycode-hermes-data:/home/opencode \
            "holycode-pr-test:${{ matrix.suffix }}" -f /home/opencode/.hermes/preserved

      - name: Install Trivy CLI
        if: github.event_name == 'workflow_dispatch'
        env:
          TRIVY_SHA256: ${{ matrix.trivy_sha256 }}
          TRIVY_VERSION: 0.73.0
        run: |
          set -euo pipefail

          archive="$RUNNER_TEMP/trivy_${TRIVY_VERSION}_Linux-${{ matrix.trivy_arch }}.tar.gz"
          bin_dir="$RUNNER_TEMP/trivy-bin"
          curl --disable --proto '=https' --tlsv1.2 --retry 8 --retry-all-errors \
            --retry-max-time 300 --remove-on-error --connect-timeout 15 --max-time 300 \
            --fail --silent --show-error --location --output "$archive" \
            "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-${{ matrix.trivy_arch }}.tar.gz"
          printf '%s  %s\n' "$TRIVY_SHA256" "$archive" | sha256sum --check --strict
          mkdir -p "$bin_dir"
          tar -xzf "$archive" -C "$bin_dir" trivy
          chmod 0755 "$bin_dir/trivy"
          echo "$bin_dir" >> "$GITHUB_PATH"
          "$bin_dir/trivy" --version

      - name: Generate pre-tag SPDX SBOM for Docker Scout
        if: github.event_name == 'workflow_dispatch'
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          version: v0.73.0
          skip-setup-trivy: true
          image-ref: holycode-pr-test:${{ matrix.suffix }}
          format: spdx-json
          output: holycode-${{ matrix.suffix }}.spdx.json

      - name: Install Docker Scout CLI for pre-tag validation
        if: github.event_name == 'workflow_dispatch'
        env:
          SCOUT_SHA256: ${{ matrix.scout_sha256 }}
          SCOUT_VERSION: 1.24.0
        run: |
          set -euo pipefail

          archive="$RUNNER_TEMP/docker-scout_${SCOUT_VERSION}_linux_${{ matrix.scout_arch }}.tar.gz"
          bin_dir="$RUNNER_TEMP/docker-scout-bin"
          curl --disable --proto '=https' --tlsv1.2 --retry 8 --retry-all-errors \
            --retry-max-time 300 --remove-on-error --connect-timeout 15 --max-time 300 \
            --fail --silent --show-error --location --output "$archive" \
            "https://github.com/docker/scout-cli/releases/download/v${SCOUT_VERSION}/docker-scout_${SCOUT_VERSION}_linux_${{ matrix.scout_arch }}.tar.gz"
          printf '%s  %s\n' "$SCOUT_SHA256" "$archive" | sha256sum --check --strict
          mkdir -p "$bin_dir"
          tar -xzf "$archive" -C "$bin_dir" docker-scout
          chmod 0755 "$bin_dir/docker-scout"
          echo "$bin_dir" >> "$GITHUB_PATH"
          "$bin_dir/docker-scout" version

      - name: Login to Docker Hub for pre-tag Docker Scout
        if: github.event_name == 'workflow_dispatch'
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Generate pre-tag Docker Scout vulnerability reports
        if: github.event_name == 'workflow_dispatch'
        env:
          SCOUT_FIXABLE_REPORT: holycode-${{ matrix.suffix }}.scout-fixable.sarif
          SCOUT_REPORT: holycode-${{ matrix.suffix }}.scout.sarif
          SCOUT_SBOM: holycode-${{ matrix.suffix }}.spdx.json
        run: |
          set -euo pipefail

          docker-scout cves "sbom://$SCOUT_SBOM" \
            --only-severity critical,high \
            --format sarif \
            --output "$SCOUT_REPORT"
          docker-scout cves "sbom://$SCOUT_SBOM" \
            --only-severity critical,high \
            --only-fixed \
            --format sarif \
            --output "$SCOUT_FIXABLE_REPORT"

      - name: Docker Scout pre-tag fixable critical and high gate
        id: scout_gate
        if: github.event_name == 'workflow_dispatch'
        continue-on-error: true
        env:
          SCOUT_FIXABLE_REPORT: holycode-${{ matrix.suffix }}.scout-fixable.sarif
        run: |
          set -euo pipefail

          jq -e '.runs | type == "array" and length > 0' "$SCOUT_FIXABLE_REPORT" >/dev/null
          python scripts/validate_scanner_findings.py \
            --scanner scout \
            --report "$SCOUT_FIXABLE_REPORT" \
            --as-of "$(date -u +%F)"

      - name: Generate pre-tag Trivy vulnerability report
        if: github.event_name == 'workflow_dispatch'
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          version: v0.73.0
          skip-setup-trivy: true
          image-ref: holycode-pr-test:${{ matrix.suffix }}
          format: json
          scanners: vuln,secret
          severity: CRITICAL,HIGH
          exit-code: 0
          output: holycode-${{ matrix.suffix }}.trivy.json

      - name: Trivy pre-tag fixable critical and high gate
        if: github.event_name == 'workflow_dispatch'
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          version: v0.73.0
          skip-setup-trivy: true
          image-ref: holycode-pr-test:${{ matrix.suffix }}
          format: json
          scanners: vuln,secret
          severity: CRITICAL,HIGH
          exit-code: 0
          ignore-unfixed: true
          output: holycode-${{ matrix.suffix }}.trivy-fixable.json

      - name: Validate pre-tag Trivy fixable critical and high findings
        id: trivy_gate
        if: github.event_name == 'workflow_dispatch'
        continue-on-error: true
        run: |
          set -euo pipefail
          python scripts/validate_scanner_findings.py \
            --scanner trivy \
            --report "holycode-${{ matrix.suffix }}.trivy-fixable.json" \
            --as-of "$(date -u +%F)"

      - name: Collect pre-tag architecture evidence
        if: always() && github.event_name == 'workflow_dispatch'
        run: |
          set -euo pipefail

          docker run --rm --entrypoint cat \
            "holycode-pr-test:${{ matrix.suffix }}" \
            /usr/local/share/holycode/dpkg-inventory.txt \
            > "holycode-${{ matrix.suffix }}.dpkg-inventory.txt"
          docker image inspect \
            --format '{{.Id}}' \
            "holycode-pr-test:${{ matrix.suffix }}" \
            > "holycode-${{ matrix.suffix }}.image-id.txt"
          printf '%s\n' "$GITHUB_SHA" > "holycode-${{ matrix.suffix }}.commit-sha.txt"

      - name: Upload pre-tag architecture evidence
        if: always() && github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: holycode-pretag-${{ github.sha }}-${{ matrix.suffix }}-evidence
          if-no-files-found: error
          path: |
            holycode-${{ matrix.suffix }}.commit-sha.txt
            holycode-${{ matrix.suffix }}.dpkg-inventory.txt
            holycode-${{ matrix.suffix }}.image-id.txt
            holycode-${{ matrix.suffix }}.scout-fixable.sarif
            holycode-${{ matrix.suffix }}.scout.sarif
            holycode-${{ matrix.suffix }}.spdx.json
            holycode-${{ matrix.suffix }}.trivy-fixable.json
            holycode-${{ matrix.suffix }}.trivy.json

      - name: Enforce pre-tag scanner gates
        if: always() && github.event_name == 'workflow_dispatch'
        env:
          SCOUT_GATE_OUTCOME: ${{ steps.scout_gate.outcome }}
          TRIVY_GATE_OUTCOME: ${{ steps.trivy_gate.outcome }}
        run: |
          set -eu
          test "$SCOUT_GATE_OUTCOME" = "success"
          test "$TRIVY_GATE_OUTCOME" = "success"