###############################################################################
# Copyright (c) 2026 Eclipse ThreadX contributors
#
# This program and the accompanying materials are made available under the
# terms of the MIT License which is available at
# https://opensource.org/licenses/MIT.
#
# AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5).
# The AI-generated portions may be considered public domain (CC0-1.0)
# and not subject to the project's licence. The human contributor has
# reviewed and verified that the code is correct.
#
# SPDX-License-Identifier: MIT and CC0-1.0
###############################################################################

name: repo_checks

# Repository-wide text checks.
#
# THIS LIVES IN ITS OWN WORKFLOW BECAUSE IT MUST NOT BE PATH-FILTERED, and a
# path filter is a property of a workflow rather than of a job.  The check
# selects its input with `git ls-files` and scans every tracked file, so any
# file at all can carry a finding.
#
# That is not hypothetical here.  The pass that introduced the fixed
# disclosure line covered source files only, and the drift it was meant to end
# survived for months afterwards in CMake files, toolchain files, shell and
# PowerShell scripts, a GDB script and a Visual Studio manifest -- precisely
# the files a source-path filter would have skipped.  A workflow that gates no
# pull request anybody opens is worse than no workflow, because it looks like
# coverage.
#
# Cheap enough that running it on everything costs nothing worth measuring: it
# is grep over a repository this size, with no toolchain, no build and no
# cache.

on:
  # No `paths:` on either trigger, deliberately.  See above.
  push:
    branches: [ dev, master ]
  pull_request:
    branches: [ dev, master ]

# A second push to the same branch makes the first answer irrelevant.
concurrency:
  group: repo-checks-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  checks:
    runs-on: ubuntu-24.04
    steps:
    # Actions are pinned to a commit SHA with the version in the trailing
    # comment.  A tag can be moved; a SHA cannot, which is what makes "which
    # code ran in our CI" answerable from the repository.
    - name: Check out the repository
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    - name: Check the AI disclosure comments
      run: scripts/check_ai_disclosure.sh