checks.yml

name: Checks

on:
  push:
    branches: [main]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [main]

concurrency:
  # Pushing new changes to a branch will cancel any in-progress CI runs
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Restrict jobs in this workflow to have no permissions by default; permissions
# should be granted per job as needed using a dedicated `permissions` block
permissions: {}

jobs:
  tests_osv-linter:
    permissions:
      contents: read # to fetch code (actions/checkout)
    name: Run unit tests
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./tools/osv-linter
    steps:
      - name: Check out code
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
        with:
          persist-credentials: false
      - name: Set up Go
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          go-version: stable
          check-latest: true

      - run: go test ./...

  ecosystem_lists:
    permissions:
      contents: read # to fetch code (actions/checkout)
    name: Check ecosystem lists
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
        with:
          python-version: 3.13
      - run: python3 ./scripts/update-ecosystems-lists.py
      - run: |
          git diff --name-only \
            | xargs -I '{}' bash -c \
              'echo "::error file={}::This needs to be regenerated by running \`python3 ./scripts/update-ecosystems-lists.py\`" && false'