name: Lists

# The rules every change to the lists must pass: scripts/lists.test.mjs for the rules and the
# sync, scripts/checkLists.mjs for the committed files. Nothing to install, so this check stands
# on its own when the build toolchain does not.
on:
  pull_request:
  push:
    branches: [master]

permissions: {}

jobs:
  lists:
    name: lists
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "22"
      - name: Rules for the lists and the sync
        run: node --test scripts/lists.test.mjs
      - name: The committed lists
        run: node scripts/checkLists.mjs
      # What the repository says about itself: the build toolchain reads
      # repository.url and dies on a host it cannot parse, and a wrong homepage
      # ships to everyone who installs the package. This lives here rather than
      # in the build job because it must run even when the build cannot.
      - name: The repository's own metadata
        run: node scripts/checkRepoMeta.mjs
      # Whether the Deno build can still reach its dependencies. Same reason as
      # above: it must run even when the toolchain cannot be installed, and it
      # is the check that would have caught the broken map years earlier.
      - name: The Deno import map
        run: node scripts/checkDenoMap.mjs
      # What phishing.pezkuwichain.io runs before it serves a new master: against a scratch
      # repository and web root, with these lists.
      - name: The host's publish checks
        run: bash pezkuwi/host/test-publish.sh