name: Lint shellcheck (arm64 pilot)

# Mac-CI dual-track pilot (#233). ADDITIVE / NOT REQUIRED.
#
# Validates the arm64 self-hosted lane (no docker.sock, no privileged
# ops) before any required gate moves onto it. Until a Mac arm64 runner
# is registered with the `arm64` label, this workflow sits PENDING —
# that is FINE: `arm64` is NOT in branch_protections required contexts.
#
# Pairs with internal#543 (RFC: Mac arm64 multi-arch runner-base).
# No paths: filter on purpose (feedback_path_filtered_workflow_cant_be_required).

on:
  pull_request:
    branches:
      - main
      - staging
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  shellcheck-arm64:
    name: shellcheck-arm64 (pilot)
    runs-on: [self-hosted, arm64-darwin]
    # NOT a required check; safe to sit pending until Mac runner is up.
    # If the Mac runner has trouble pulling actions/checkout we fall
    # back to a plain git clone (see step 'fallback clone').
    timeout-minutes: 10
    env:
      GITHUB_SERVER_URL: https://git.moleculesai.app
    steps:
      - name: Identify runner
        run: |
          set -eu
          echo "arch=$(uname -m)"
          echo "kernel=$(uname -sr)"
          echo "shell=$BASH_VERSION"
          # Sanity: must actually be arm64. If amd64 sneaks in here,
          # fail fast — that means the label routing is wrong.
          case "$(uname -m)" in
            aarch64|arm64) echo "arm64 confirmed" ;;
            *) echo "ERROR: expected arm64, got $(uname -m)"; exit 1 ;;
          esac

      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Install shellcheck (arm64)
        continue-on-error: true
        run: |
          set -eu
          if command -v shellcheck >/dev/null 2>&1; then
            echo "shellcheck already present: $(shellcheck --version | head -1)"
          else
            # Prefer apt if the runner base ships it; else download arm64 binary.
            if command -v apt-get >/dev/null 2>&1; then
              sudo apt-get update -qq
              sudo apt-get install -y --no-install-recommends shellcheck
            else
              SC_VER=v0.10.0
              curl -fsSL "https://github.com/koalaman/shellcheck/releases/download/${SC_VER}/shellcheck-${SC_VER}.linux.aarch64.tar.xz" \
                | tar -xJf - --strip-components=1
              sudo mv shellcheck /usr/local/bin/
            fi
          fi
          shellcheck --version | head -2

      - name: Run shellcheck on .gitea/scripts/*.sh
        continue-on-error: true
        run: |
          set -eu
          # Only the scripts we control under .gitea/scripts. Pilot
          # scope is intentionally narrow — broaden in a follow-up
          # once the lane is proven.
          if ! command -v shellcheck >/dev/null 2>&1; then
            echo "WARN: shellcheck binary not found — skipping (pilot mode)"
            exit 0
          fi
          mapfile -t TARGETS < <(find .gitea/scripts -maxdepth 2 -type f -name '*.sh' | sort)
          if [ "${#TARGETS[@]}" -eq 0 ]; then
            echo "No .sh files found under .gitea/scripts — nothing to check"
            exit 0
          fi
          echo "Checking ${#TARGETS[@]} file(s):"
          printf '  %s\n' "${TARGETS[@]}"
          # SC1091 = couldn't follow non-constant source; expected for
          # CI-time analysis without the full runtime layout.
          shellcheck --severity=error --exclude=SC1091 "${TARGETS[@]}"
