validate.yml

name: validate

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  validate-workflows:
    name: validate-workflows
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node 20
        uses: actions/setup-node@v6
        with:
          node-version: '20'

      - name: Validate n8n workflow JSONs
        run: node scripts/validate-workflows.js

      - name: Hardcoded token grep (defense-in-depth)
        run: |
          set -e
          # Scan the workflow JSONs for any hardcoded secret shapes.
          # Only scans workflows/*.json — does NOT scan .github/workflows.
          if ! ls workflows/*.json >/dev/null 2>&1; then
            echo "No workflow JSONs to scan yet — skipping"
            exit 0
          fi
          if grep -RnE '(ghp_[A-Za-z0-9]{20,}|ntn_[A-Za-z0-9]{20,}|sk-[A-Za-z0-9]{20,}|ApiKey [A-Za-z0-9]{10,})' workflows/*.json; then
            echo "::error::Hardcoded token detected in workflows/*.json"
            exit 1
          fi
          echo "No hardcoded tokens found"

      - name: bash -n syntax check (all scripts)
        run: |
          set -e
          for f in scripts/*.sh daemon/*.sh; do
            [ -f "$f" ] || continue
            echo "bash -n $f"
            bash -n "$f"
          done

      - name: shellcheck (scripts/ + daemon/)
        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
        with:
          severity: warning
          scandir: './scripts'

      - name: node --check on JS scripts
        run: |
          set -e
          for f in scripts/*.js; do
            [ -f "$f" ] || continue
            node --check "$f"
          done

      - name: install-workflows DRY_RUN smoke
        env:
          DRY_RUN: '1'
          GITHUB_TOKEN: fake_gh
          MORGEN_KEY: fake_mg
          GITHUB_REPO_OWNER: example
          GITHUB_REPO_NAME: example-tasks
          N8N_API_KEY: fake_n8n
          N8N_BASE_URL: https://example.app.n8n.cloud
        run: ./scripts/install-workflows.sh