# Work-record validation gate (canon: work-record-types_v0.1.md, CUST-WP-0060-T04).
# Copy to: .forgejo/workflows/work-records.yaml in consumer repos.
# Validates all work-record YAML blocks (intake/decision/engagement + task ids)
# against the canon kind registry and JSON schemas before they reach the hub.
# Zero-config: repos without work records pass in seconds.
# Uses archive checkout (no actions/checkout; non-root runner has no git).
name: Work Records

on:
  push:
    branches:
      - main
    paths:
      - "**.md"
      - ".forgejo/workflows/work-records.yaml"
  pull_request:
  workflow_dispatch:

jobs:
  validate:
    runs-on: self-hosted
    steps:
      - name: Fetch repo + canon, validate work records
        run: |
          set -eu
          WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
          REF="${GITHUB_SHA:-main}"; SHORT="${REF:0:7}"
          BASE="https://forgejo.coulomb.social"
          mkdir -p "$WORK/repo" "$WORK/canon"
          # Forgejo archive endpoint accepts short SHA; full SHA can hang.
          wget -qO "$WORK/repo.tar.gz" \
            "${BASE}/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
          tar xzf "$WORK/repo.tar.gz" -C "$WORK/repo" --strip-components=1
          wget -qO "$WORK/canon.tar.gz" \
            "${BASE}/coulomb/the-custodian/archive/main.tar.gz"
          tar xzf "$WORK/canon.tar.gz" -C "$WORK/canon" --strip-components=1
          python3 -m pip install --user --quiet pyyaml jsonschema
          python3 "$WORK/canon/tools/validate_work_records.py" \
            --repo "$WORK/repo" --canon "$WORK/canon"