test.yml

name: test

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

# Opt in to Node 24 runtime for actions/* (Node 20 is deprecated;
# forced default in June 2026, removed in September 2026).
env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

# Top-level read-only token per OpenSSF Scorecard `Token-Permissions`;
# jobs scope up only when needed.
permissions: read-all

jobs:
  headless:
    name: Pure-logic tests (pwsh 7.5+)
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
      - name: Install PowerShell 7.5+ (SnipIT.ps1 requires it)
        shell: bash
        run: |
          dotnet tool install --global PowerShell
          echo "$HOME/.dotnet/tools" >> "$GITHUB_PATH"
      - name: Show pwsh version
        shell: bash
        run: pwsh --version
      - name: Run headless tests
        shell: bash
        run: pwsh -NoProfile -File ./Test-SnipIT.ps1

  # PSScriptAnalyzer moved to .github/workflows/security.yml per RAN-54 — it is
  # the language-specific lint slot in the OSS-CLI security stack (codeiq's
  # SpotBugs equivalent), not a build-time gate.

  parse:
    name: Parse SnipIT.ps1 on Windows (no execution)
    runs-on: windows-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
      - name: Install PowerShell 7.5+ (SnipIT.ps1 requires it)
        shell: pwsh
        run: |
          dotnet tool install --global PowerShell
          "$HOME\.dotnet\tools" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
      - name: Show pwsh version
        shell: bash
        run: pwsh --version
      - name: Parse script (AST parser works with any pwsh version)
        shell: bash
        run: |
          pwsh -NoProfile -Command "
            \$errors = \$null
            [System.Management.Automation.Language.Parser]::ParseFile(
              (Resolve-Path ./SnipIT.ps1), [ref]\$null, [ref]\$errors) | Out-Null
            if (\$errors) {
              \$errors | ForEach-Object { Write-Host \"  \$(\$_.Message)  at line \$(\$_.Extent.StartLineNumber)\" }
              exit 1
            }
            Write-Host 'Parsed cleanly.'
          "
      - name: Run headless tests on Windows
        shell: bash
        run: pwsh -NoProfile -File ./Test-SnipIT.ps1